Cves

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to memory corruption

Researchers: Dung Do (@_piers2) of Calif.io

Root Cause Analysis

A memory corruption issue was addressed with improved memory handling.

Files Changed

Source Files

• Source/WebGPU/WebGPU/Queue.mm
• Source/WebGPU/WebGPU/Queue.swift
• Source/WebGPU/WebGPU/RenderPipeline.mm
• Source/WebGPU/WebGPU/WebGPUExt.h
• Source/WebKit/GPUProcess/graphics/WebGPU/RemoteQueue.cpp

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: wwwlk

Root Cause Analysis

The issue was addressed with improved memory handling.

Files Changed

Source Files

• Source/WebCore/Modules/webauthn/AuthenticationExtensionsClientOutputs.cpp

Test Files

• Tools/TestWebKitAPI/Tests/WebCore/CBORReaderTest.cpp

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative

Root Cause Analysis

A use-after-free issue was addressed with improved memory management.

Files Changed

Source Files

• Source/JavaScriptCore/b3/B3PureCSE.cpp
• Source/JavaScriptCore/b3/B3PureCSE.h
• Source/JavaScriptCore/b3/B3ReduceStrength.cpp

Test Files

• Source/JavaScriptCore/b3/testb3.h
• Source/JavaScriptCore/b3/testb3_1.cpp
• Source/JavaScriptCore/b3/testb3_6.cpp

Overview

Advisory: Apple Security Advisory

Impact:

Description: Visiting a maliciously crafted website may leak sensitive data

Researchers: Mohit Negi

Root Cause Analysis

The issue was addressed with improved checks.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: Shubham Chaskar, Tommy DeVoss from Braze Security Team (@thedawgyg)

Root Cause Analysis

A memory corruption vulnerability was addressed with improved locking.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: OpenAI Codex Security - Amy Burnett

Root Cause Analysis

The issue was addressed with improved checks.

Files Changed

Source Files

• Source/JavaScriptCore/b3/B3Procedure.cpp
• Source/JavaScriptCore/b3/B3Procedure.h
• Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp

Test Files

• JSTests/wasm/stress/inline-wasm-simd-into-non-simd.js

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: Thomas Guillem

Root Cause Analysis

The issue was addressed with improved input validation.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel

Root Cause Analysis

A memory corruption vulnerability was addressed with improved locking.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: Janggoon Lee of Out of Bounds, OpenAI Codex Security - Amy Burnett

Root Cause Analysis

UnlinkedMetadataTable::finalize() computed metadata buffer offsets using unchecked unsigned arithmetic. When compiling JavaScript functions with tens of millions of bytecode instructions, the cumulative offset calculation (numberOfEntries * metadataSize) overflows the 32-bit unsigned integer, wrapping to a small value. This causes a heap allocation that is far too small for the actual metadata, and all subsequent metadata reads/writes go out of bounds. The fix replaces raw unsigned arithmetic with CheckedUint32, detects the overflow before allocating, and propagates a failure boolean up through UnlinkedCodeBlockGenerator::finalize() to BytecodeGenerator::generate(), which then returns an OutOfMemory parser error instead of crashing.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process termination

Researchers: 杉山 壮太, Shubham Chaskar

Root Cause Analysis

trustedTypeCompliantString executes arbitrary JavaScript via Trusted Types policy callbacks. The callers in Document::parseHTMLUnsafe, Document::write, and Document::execCommand passed a raw Document* from contextDocument() without protecting its lifetime. If the policy callback manipulates the DOM — adopting nodes, removing iframes, or triggering GC — the Document can be freed while trustedTypeCompliantString still holds and later dereferences the dangling pointer. The fix wraps contextDocument() with protect() to create a strong reference that keeps the Document alive for the entire duration of the trustedTypeCompliantString call.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: OpenAI Codex Security - Amy Burnett

Root Cause Analysis

This issue was addressed through improved state management.

Files Changed

Source Files

• Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp

Test Files

• JSTests/stress/arith-abs-checked-input-range.js

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: OpenAI Codex Security - Amy Burnett

Root Cause Analysis

This issue was addressed through improved state management.

Files Changed

Source Files

• Source/JavaScriptCore/wasm/WasmFunctionParser.h

Test Files

• JSTests/wasm/regress/try-catch-result-type.js

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: OpenAI Codex Security - Amy Burnett

Root Cause Analysis

This issue was addressed through improved state management.

Files Changed

Source Files

• Source/JavaScriptCore/b3/B3Procedure.h
• Source/WTF/wtf/BackwardsGraph.h

Test Files

• JSTests/wasm/gc/backwards-graph-multi-backedge-licm.js
• Source/JavaScriptCore/b3/testb3.h
• Source/JavaScriptCore/b3/testb3_1.cpp
• Source/JavaScriptCore/b3/testb3_7.cpp

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: OpenAI Codex Security - Amy Burnett

Root Cause Analysis

A memory corruption issue was addressed with improved state management.

Files Changed

Source Files

• Source/JavaScriptCore/b3/B3ReduceStrength.cpp
• Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp

Test Files

• JSTests/wasm/stress/omg-reduce-strength-select-exception-stackmap.js

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: OpenAI Codex Security - Amy Burnett

Root Cause Analysis

This issue was addressed through improved state management.

Files Changed

Source Files

• Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp
• Source/JavaScriptCore/runtime/RegExp.cpp
• Source/JavaScriptCore/runtime/RegExp.h
• Source/JavaScriptCore/runtime/RegExpCache.cpp

Test Files

• JSTests/stress/new-regexp-untyped-soft-invalid-stale-captures.js

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: Josef Korbel

Root Cause Analysis

This issue was addressed through improved state management.

Files Changed

Source Files

• Source/JavaScriptCore/llint/InPlaceInterpreter64.asm
• Source/JavaScriptCore/wasm/WasmIPIntGenerator.cpp
• Source/JavaScriptCore/wasm/WasmIPIntGenerator.h

Test Files

• JSTests/wasm/stress/br-on-cast-fail-overlong-leb128.js
• JSTests/wasm/stress/br-on-cast-overlong-leb128.js

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: OpenAI Codex Security - Amy Burnett

Root Cause Analysis

This issue was addressed through improved state management.

Files Changed

Source Files

• Source/JavaScriptCore/bytecode/RepatchInlines.h
• Source/JavaScriptCore/jit/JITOperations.cpp
• Source/JavaScriptCore/llint/LLIntSlowPaths.cpp

Test Files

• JSTests/stress/operation-polymorphic-call-host-call-ic-reset.js

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: OpenAI Codex Security - Amy Burnett

Root Cause Analysis

The issue was addressed with improved memory handling.

Files Changed

Source Files

• Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp
• Source/JavaScriptCore/dfg/DFGCombinedLiveness.cpp
• Source/JavaScriptCore/dfg/DFGCombinedLiveness.h
• Source/JavaScriptCore/dfg/DFGForAllKills.h
• Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp

Test Files

• JSTests/stress/arguments-elimination-inlined-load-varargs-preserves-recoveries.js
• JSTests/stress/arguments-elimination-load-varargs-kills-promoted-recoveries.js

Patch Preview

diff --git a/JSTests/stress/arguments-elimination-inlined-load-varargs-preserves-recoveries.js b/JSTests/stress/arguments-elimination-inlined-load-varargs-preserves-recoveries.js
new file mode 100644
index 000000000000..6a9e21ffb290
--- /dev/null
+++ b/JSTests/stress/arguments-elimination-inlined-load-varargs-preserves-recoveries.js
@@ -0,0 +1,84 @@
+//@ runDefault("--thresholdForJITAfterWarmUp=10", "--thresholdForFTLOptimizeAfterWarmUp=1000", "--useConcurrentJIT=false", "--validateFTLOSRExitLiveness=true")
+
+"use strict";
+
+function shouldBe(actual, expected)
+{
+    if (actual !== expected)
+        throw new Error("bad value: " + actual + ", expected: " + expected);
+}
+
+function five(values1, values2)
+{
+    let result = null;
+    for (let i = 0; i < 5; ++i) {
+        function arg() { "use strict"; return arguments; }
+        const a = arg.apply(undefined, values1);
+        const b = arg.apply(undefined, values2);
+        try {
+            (3881)(b);
+        } catch (error) {
+            a.toString();
+            result = a;
+        }
+    }
+    return result;
+}
+
+function eight(values1, values2)
+{
+    let result = null;
+    for (let i = 0; i < 5; ++i) {
+        function arg() { "use strict"; return arguments; }
+        const a = arg.apply(undefined, values1);
+        const b = arg.apply(undefined, values2);
+        try {
+            (3881)(b);
+        } catch (error) {
+            a.toString();
+            result = a;
+        }
+    }
+    return result;
+}
+
+function filled(length, value)
+{
+    const result = [];
+    for (let i = 0; i < length; ++i)
+        result.push(value);
+    return result;
+}
+
+const fiveMarker = { marker: "five" };
+const eightMarker = { marker: "eight" };
+const seedArray = [{ marker: "seed" }, 1, 2, 3, 4, 5];
+
+const firstFive = filled(5, fiveMarker);
+const overwriteFive = filled(30, fiveMarker);
+overwriteFive[22] = 9;
+
+const firstEight = filled(8, eightMarker);
+const overwriteEight = filled(30, eightMarker);
+overwriteEight[20] = 9;
+
+for (let i = 0; i < testLoopCount; ++i) {
+    five(firstFive, overwriteFive);
+    eight(firstEight, overwriteEight);
+}
+
+const seedValues = filled(30, seedArray);
+seedValues[20] = 9;
+for (let i = 0; i < testLoopCount; ++i)
+    eight(firstEight, seedValues);
+
+const recoveredEight = eight(firstEight, seedValues);
+shouldBe(recoveredEight.length, firstEight.length);
+for (let i = 0; i < firstEight.length; ++i)
+    shouldBe(recoveredEight[i], eightMarker);
+
+const recoveredFive = five(firstFive, overwriteFive);
+shouldBe(recoveredFive.length, firstFive.length);
+for (let i = 0; i < firstFive.length; ++i)
+    shouldBe(recoveredFive[i], fiveMarker);
+shouldBe(recoveredFive[5], undefined);
diff --git a/JSTests/stress/arguments-elimination-load-varargs-kills-promoted-recoveries.js b/JSTests/stress/arguments-elimination-load-varargs-kills-promoted-recoveries.js
new file mode 100644
index 000000000000..aa818cb6d313
--- /dev/null
+++ b/JSTests/stress/arguments-elimination-load-varargs-kills-promoted-recoveries.js
@@ -0,0 +1,88 @@
+//@ runDefault("--thresholdForJITAfterWarmUp=10", "--thresholdForFTLOptimizeAfterWarmUp=1000", "--useConcurrentJIT=false")
+
+"use strict";
+
+function shouldBe(actual, expected)
+{
+    if (actual !== expected)
+        throw new Error("bad value: " + actual + ", expected: " + expected);
+}
+noInline(shouldBe);
+
+function five(values1, values2)
+{
+    let result = null;
+    for (let i = 0; i < 5; ++i) {
+        function arg() { "use strict"; return arguments; }
+        const a = arg.apply(undefined, values1);
+        const b = arg.apply(undefined, values2);
+        try {
+            (3881)(b);
+        } catch (error) {
+            a.toString();
+            result = a;
+        }
+    }
+    return result;
+}
+noInline(five);
+
+function eight(values1, values2)
+{
+    let result = null;
+    for (let i = 0; i < 5; ++i) {
+        function arg() { "use strict"; return arguments; }
+        const a = arg.apply(undefined, values1);
+        const b = arg.apply(undefined, values2);
+        try {
+            (3881)(b);
+        } catch (error) {
+            a.toString();
+            result = a;
+        }
+    }
+    return result;
+}
+noInline(eight);
+
+function filled(length, value)
+{
+    const result = [];
+    for (let i = 0; i < length; ++i)
+        result.push(value);
+    return result;
+}
+noInline(filled);
+
+const fiveMarker = { marker: "five" };
+const eightMarker = { marker: "eight" };
+const seedArray = [{ marker: "seed" }, 1, 2, 3, 4, 5];
+
+const firstFive = filled(5, fiveMarker);
+const overwriteFive = filled(30, fiveMarker);
+overwriteFive[22] = 9;
+
+const firstEight = filled(8, eightMarker);
+const overwriteEight = filled(30, eightMarker);
+overwriteEight[20] = 9;
+
+for (let i = 0; i < testLoopCount; ++i) {
+    five(firstFive, overwriteFive);
+    eight(firstEight, overwriteEight);
+}
+
+const seedValues = filled(30, seedArray);
+seedValues[20] = 9;
+for (let i = 0; i < testLoopCount; ++i)
+    eight(firstEight, seedValues);
+
+const recoveredEight = eight(firstEight, seedValues);
+shouldBe(recoveredEight.length, firstEight.length);
+for (let i = 0; i < firstEight.length; ++i)
+    shouldBe(recoveredEight[i], eightMarker);
+
+const recoveredFive = five(firstFive, overwriteFive);
+shouldBe(recoveredFive.length, firstFive.length);
+for (let i = 0; i < firstFive.length; ++i)
+    shouldBe(recoveredFive[i], fiveMarker);
+shouldBe(recoveredFive[5], undefined);
diff --git a/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp b/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp
index b90a0b9649cf..52567cea948e 100644
--- a/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp
@@ -33,6 +33,7 @@
 #include "DFGArgumentsUtilities.h"
 #include <wtf/IndexMap.h>
 #include "DFGClobberize.h"
+#include "DFGCombinedLiveness.h"
 #include "DFGForAllKills.h"
 #include "DFGGraph.h"
 #include "DFGInsertionSet.h"
@@ -722,7 +723,16 @@ class ArgumentsEliminationPhase : public Phase {
             }
 
             if (clobberStack) {

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Josef Korbel (Citadelo)

Root Cause Analysis

This issue was addressed through improved state management.

Files Changed

Source Files

• Source/JavaScriptCore/runtime/RegExpMatchesArray.h
• Source/JavaScriptCore/yarr/YarrJIT.cpp

Test Files

• JSTests/stress/yarr-jit-non-bmp-backtrack-index-overflow.js
• JSTests/stress/yarr-jit-non-bmp-backtrack-index-underflow.js

Patch Preview

diff --git a/JSTests/stress/yarr-jit-non-bmp-backtrack-index-overflow.js b/JSTests/stress/yarr-jit-non-bmp-backtrack-index-overflow.js
new file mode 100644
index 000000000000..8657a02fb82c
--- /dev/null
+++ b/JSTests/stress/yarr-jit-non-bmp-backtrack-index-overflow.js
@@ -0,0 +1,12 @@
+const re = /d\0e?|\u{10000}c/u;
+const subj = "\u{10000}d";
+const m = re.exec(subj);
+
+if (m !== null) {
+    throw new Error(
+        "expected null, got match=" + JSON.stringify(m[0]) +
+        " at index=" + m.index +
+        " (m.index + m[0].length = " + (m.index + m[0].length) +
+        " > subj.length = " + subj.length + ")"
+    );
+}
diff --git a/JSTests/stress/yarr-jit-non-bmp-backtrack-index-underflow.js b/JSTests/stress/yarr-jit-non-bmp-backtrack-index-underflow.js
new file mode 100644
index 000000000000..52fb0bbf4021
--- /dev/null
+++ b/JSTests/stress/yarr-jit-non-bmp-backtrack-index-underflow.js
@@ -0,0 +1,5 @@
+const re = /(?!\u{10000})a*|\u{10000}b/u;
+const subj = "\u{10000}cc";
+const m = re.exec(subj);
+if (m[0].length > subj.length)
+    throw new Error("m[0].length (" + m[0].length + ") > subj.length (" + subj.length + ")");
diff --git a/Source/JavaScriptCore/runtime/RegExpMatchesArray.h b/Source/JavaScriptCore/runtime/RegExpMatchesArray.h
index 4d5d2304e1d1..4d46a7f017f8 100644
--- a/Source/JavaScriptCore/runtime/RegExpMatchesArray.h
+++ b/Source/JavaScriptCore/runtime/RegExpMatchesArray.h
@@ -76,7 +76,8 @@ ALWAYS_INLINE JSArray* createRegExpMatchesArray(
 
     result.start = position;
     result.end = subpatternResults[1];
-    
+    RELEASE_ASSERT(result.end >= result.start);
+
     JSArray* array;
     JSArray* indicesArray = nullptr;
 
diff --git a/Source/JavaScriptCore/yarr/YarrJIT.cpp b/Source/JavaScriptCore/yarr/YarrJIT.cpp
index d5dc7005cc4d..90ead5391420 100644
--- a/Source/JavaScriptCore/yarr/YarrJIT.cpp
+++ b/Source/JavaScriptCore/yarr/YarrJIT.cpp
@@ -3925,9 +3925,19 @@ class YarrGenerator final : public YarrJITInfo {
                             // already correctly incremented, if more than one then decrement as appropriate.
                             unsigned delta = alternative->m_minimumSize - beginOp->m_alternative->m_minimumSize;
                             ASSERT(delta);
+                            bool advancedIndexForNonBMP = false;
+#if ENABLE(YARR_JIT_UNICODE_EXPRESSIONS) && ENABLE(YARR_JIT_UNICODE_CAN_INCREMENT_INDEX_FOR_NON_BMP)
+                            if (m_useFirstNonBMPCharacterOptimization) {
+                                m_jit.add32(m_regs.firstCharacterAdditionalReadSize, m_regs.index);
+                                advancedIndexForNonBMP = true;
+                            }
+#endif
                             if (delta != 1)
                                 m_jit.sub32(MacroAssembler::Imm32(delta - 1), m_regs.index);
-                            m_jit.jump(beginOp->m_reentry);
+                            if (advancedIndexForNonBMP)
+                                checkInput().linkTo(beginOp->m_reentry, &m_jit);
+                            else
+                                m_jit.jump(beginOp->m_reentry);
                         } else {
                             // If the first alternative has minimum size 0xFFFFFFFFu, then there cannot
                             // be sufficent input available to handle this, so just fall through.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to memory corruption

Researchers: Henock Habte

Root Cause Analysis

The issue was addressed with improved memory handling.

Files Changed

Source Files

• Source/WebCore/svg/animation/SVGSMILElement.cpp

Test Files

• LayoutTests/svg/animations/smil-seek-huge-repeat-count-crash-expected.txt
• LayoutTests/svg/animations/smil-seek-huge-repeat-count-crash.html

Patch Preview

diff --git a/LayoutTests/svg/animations/smil-seek-huge-repeat-count-crash-expected.txt b/LayoutTests/svg/animations/smil-seek-huge-repeat-count-crash-expected.txt
new file mode 100644
index 000000000000..cd68e3612acf
--- /dev/null
+++ b/LayoutTests/svg/animations/smil-seek-huge-repeat-count-crash-expected.txt
@@ -0,0 +1,3 @@
+Passes if it does not crash.
+
+
diff --git a/LayoutTests/svg/animations/smil-seek-huge-repeat-count-crash.html b/LayoutTests/svg/animations/smil-seek-huge-repeat-count-crash.html
new file mode 100644
index 000000000000..c30fa119a3e8
--- /dev/null
+++ b/LayoutTests/svg/animations/smil-seek-huge-repeat-count-crash.html
@@ -0,0 +1,14 @@
+<body>
+    <p>Passes if it does not crash.</p>
+    <svg id="svg">
+        <rect width="100" height="100" fill="green">
+            <animate attributeName="x" from="0" to="10" dur="0.0001s" repeatCount="indefinite"/>
+        </rect>
+    </svg>
+    <script>
+        if (window.testRunner)
+            testRunner.dumpAsText();
+
+        svg.setCurrentTime(400000);
+    </script>
+</body>
diff --git a/Source/WebCore/svg/animation/SVGSMILElement.cpp b/Source/WebCore/svg/animation/SVGSMILElement.cpp
index 8bd88254df52..8a9d6c1670b1 100644
--- a/Source/WebCore/svg/animation/SVGSMILElement.cpp
+++ b/Source/WebCore/svg/animation/SVGSMILElement.cpp
@@ -1049,12 +1049,13 @@ float SVGSMILElement::calculateAnimationPercentAndRepeat(SMILTime elapsed, unsig
     SMILTime activeTime = elapsed - m_intervalBegin;
     SMILTime repeatingDuration = this->repeatingDuration();
 
+    // Clamp the page-controlled repeat count to prevent overflow.
     if ((elapsed >= m_intervalEnd && !repeatingDuration.isIndefinite()) || activeTime > repeatingDuration) {
-        repeat = static_cast<unsigned>(repeatingDuration.value() / simpleDuration.value());
-        if (!fmod(repeatingDuration.value(), simpleDuration.value()))
+        repeat = clampTo<unsigned>(repeatingDuration.value() / simpleDuration.value());
+        if (repeat && !fmod(repeatingDuration.value(), simpleDuration.value()))
             --repeat;
     } else
-        repeat = static_cast<unsigned>(activeTime.value() / simpleDuration.value());
+        repeat = clampTo<unsigned>(activeTime.value() / simpleDuration.value());
 
     double percent;
     if (elapsed >= m_intervalEnd || activeTime > repeatingDuration) {
@@ -1187,16 +1188,9 @@ bool SVGSMILElement::progress(SMILTime elapsed, SVGSMILElement& firstAnimation,
         if (m_activeState == Inactive || m_activeState == Frozen)
             smilEventSender().dispatchEventSoon(*this, eventNames().endEventEvent);
 
-        if (repeat) {
-            // We intentionally dispatch repeat - 1 events here because the first repeat
-            // event (for the initial loop) is sent elsewhere during continuous animation run.
-            // If repeat == 1, no events are dispatched here.
-            for (unsigned i = 0; i < repeat - 1; ++i)
-                smilEventSender().dispatchEventSoon(*this, eventNames().repeatEventEvent);
-
-            if (m_activeState == Inactive)
-                smilEventSender().dispatchEventSoon(*this, eventNames().repeatEventEvent);
-        }
+        // Coalesce the skipped repeat iterations into a single event instead of one per interval.
+        if (repeat > 1 || (repeat && m_activeState == Inactive))
+            smilEventSender().dispatchEventSoon(*this, eventNames().repeatEventEvent);
     }
 
     m_nextProgressTime = calculateNextProgressTime(elapsed);

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: Niels Hofmans

Root Cause Analysis

This issue was addressed through improved state management.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Visiting a website may lead to an app denial-of-service

Researchers: Heiko Kiesel of SEEMOO, TU Darmstadt

Root Cause Analysis

This issue was addressed through improved state management.

Files Changed

Source Files

• Source/WebCore/loader/FrameLoader.cpp

Test Files

• Tools/TestWebKitAPI/Tests/WebKitCocoa/VerifyUserGestureFromUIProcess.mm

Overview

Advisory: Apple Security Advisory

Impact:

Description: An app may be able to read files outside of its sandbox

Researchers: Brian Carpenter

Root Cause Analysis

An access issue was addressed with improved access restrictions.

Files Changed

Source Files

• Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp

Overview

Advisory: Apple Security Advisory

Impact:

Description: Websites may know if the user has visited a given link

Researchers: Kwak Kiyong, Song Nuri

Root Cause Analysis

This issue was addressed with improved checks.

Files Changed

Source Files

• Source/WebCore/page/LargestContentfulPaintData.cpp

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: OGINOME Tomohito, an anonymous researcher

Root Cause Analysis

A use-after-free issue was addressed with improved memory management.

Files Changed

Source Files

• Source/WebCore/platform/graphics/cg/PathCG.cpp

Test Files

• LayoutTests/fast/canvas/offscreen-worker-unsafe-isPointInStroke-call-expected.txt
• LayoutTests/fast/canvas/offscreen-worker-unsafe-isPointInStroke-call.html

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: Shaheen Fazim

Root Cause Analysis

An out-of-bounds access issue was addressed with improved bounds checking.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Maliciously crafted web content may violate iframe sandboxing policy

Researchers: an anonymous researcher

Root Cause Analysis

A permissions issue was addressed with improved validation.

Files Changed

Source Files

• Source/WebCore/loader/FrameLoader.cpp

Test Files

• LayoutTests/http/tests/cookies/same-site/fetch-in-srcdoc-iframe-inside-cross-origin-iframe-expected.txt
• LayoutTests/http/tests/cookies/same-site/fetch-in-srcdoc-iframe-inside-cross-origin-iframe.html
• LayoutTests/http/tests/cookies/same-site/img-from-srcdoc-iframe-inside-cross-origin-iframe-expected.txt
• LayoutTests/http/tests/cookies/same-site/img-from-srcdoc-iframe-inside-cross-origin-iframe.html
• LayoutTests/http/tests/cookies/same-site/resources/record-image-cookies.py
• LayoutTests/http/tests/cookies/same-site/resources/srcdoc-creator-img-inside-cross-origin-iframe.html
• LayoutTests/http/tests/cookies/same-site/resources/srcdoc-creator-inside-cross-origin-iframe.html

Overview

Advisory: Apple Security Advisory

Impact:

Description: Visiting a website that frames malicious content may lead to UI spoofing

Researchers: Kagami Rosylight of Mozilla

Root Cause Analysis

The issue was addressed with improved UI.

Files Changed

Source Files

• Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: Milad Nasr and Nicholas Carlini with Claude, Anthropic

Root Cause Analysis

A memory corruption issue was addressed with improved state management.

Files Changed

Source Files

• Source/JavaScriptCore/runtime/CachedTypes.cpp
• Source/JavaScriptCore/runtime/ScopedArgumentsTable.cpp
• Source/JavaScriptCore/runtime/ScopedArgumentsTable.h
• Source/WTF/wtf/Vector.h

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: 杉山 壮太, lattice, Behzad Najjarpour Jabbari (@G4ru), Junyeong Lee, Mooth.ai, OGINOME Tomohito, Using GLM From Z.AI, Gia Bui (@yabeow) from Calif.io

Root Cause Analysis

A use-after-free issue was addressed with improved memory management.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Root Cause Analysis

An out-of-bounds access issue was addressed with improved bounds checking.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Utkarsh Pal, Ignacio Sanmillan (@ulexec)

Root Cause Analysis

The issue was addressed with improved memory handling.

Files Changed

Source Files

• Source/WebCore/Modules/webaudio/WaveShaperDSPKernel.cpp
• Source/WebCore/Modules/webaudio/WaveShaperNode.cpp
• Source/WebCore/Modules/webaudio/WaveShaperNode.h
• Source/WebCore/Modules/webaudio/WaveShaperProcessor.cpp
• Source/WebCore/Modules/webaudio/WaveShaperProcessor.h

Test Files

• LayoutTests/webaudio/WaveShaper/waveshaper-curve-getter-during-rendering-crash-expected.txt
• LayoutTests/webaudio/WaveShaper/waveshaper-curve-getter-during-rendering-crash.html

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Using GLM From Z.AI, Tristan Madani (@TristanInSec) from Talence Security, stratan (@5tratan) of Almamater Technologies, Soyeon Park, Amy Burnett, Khai Tran, sherkito, Kota Toda, HexRabbit (@h3xr4bb1t) and NiNi (@terrynini38514) of DEVCORE Research Team, Brian Carpenter

Root Cause Analysis

The issue was addressed with improved memory handling.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: Tommy DeVoss from Braze Security Team (@thedawgyg), Mateusz Krzywicki (iVerify.io), dr3dd

Root Cause Analysis

An out-of-bounds access issue was addressed with improved bounds checking.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Tommy DeVoss from Braze Security Team (@thedawgyg)

Root Cause Analysis

A use-after-free issue was addressed with improved memory management.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may disclose sensitive user information

Researchers: Vitaly Simonovich, Muhamad Syaiful, Christian Meurer Xavier

Root Cause Analysis

A cross-origin issue was addressed with improved tracking of security origins.

Files Changed

Source Files

• Source/WebCore/Modules/WebGPU/GPUDevice.cpp

Test Files

• LayoutTests/fast/webgpu/regression/repro_315368-expected.txt
• LayoutTests/fast/webgpu/regression/repro_315368.html
• LayoutTests/fast/webgpu/regression/repro_315368b-expected.txt
• LayoutTests/fast/webgpu/regression/repro_315368b.html

Overview

Advisory: Apple Security Advisory

Impact:

Description: A malicious website may be able to process restricted web content outside the sandbox

Researchers: Aaron Grattafiori - NVIDIA AI Red Team

Root Cause Analysis

The issue was addressed with improved checks.

Files Changed

Source Files

• Source/WebCore/loader/DocumentLoader.cpp
• Source/WebKit/UIProcess/API/APINavigation.h
• Source/WebKit/UIProcess/WebPageProxy.cpp

Overview

Advisory: Apple Security Advisory

Impact:

Description: A malicious web extension may be able to cause an unexpected process crash

Researchers: dr3dd

Root Cause Analysis

A use-after-free issue was addressed with improved memory management.

Files Changed

Source Files

• Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIDevToolsExtensionPanelCocoa.mm
• Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIPortCocoa.mm

Test Files

• Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIRuntime.mm

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to memory corruption

Researchers: dr3dd

Root Cause Analysis

A type confusion issue was addressed with improved checks.

Files Changed

Source Files

• Source/WebCore/Modules/streams/TransformStream.cpp

Test Files

• LayoutTests/streams/transform-stream-poisoned-iterator-crash-expected.txt
• LayoutTests/streams/transform-stream-poisoned-iterator-crash.html

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: stratan (@5tratan) of Almamater Technologies, OpenAI Codex Security - Amy Burnett

Root Cause Analysis

A memory corruption issue was addressed with improved memory handling.

Overview

Advisory: Apple Security Advisory

Impact:

Description: A malicious website may exfiltrate data cross-origin

Researchers: Behzad Najjarpour Jabbari (@G4ru)

Root Cause Analysis

The issue was addressed with improved input validation.

Files Changed

Source Files

• Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm

Test Files

• Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKHTTPCookieStore.mm

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Root Cause Analysis

A use-after-free issue was addressed with improved memory management.

Files Changed

Source Files

• Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/ContextMtl.h
• Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/ContextMtl.mm
• Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/QueryMtl.h
• Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/QueryMtl.mm
• Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_command_buffer.mm
• Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_occlusion_query_pool.h
• Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_occlusion_query_pool.mm
• Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_render_utils.h
• Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_render_utils.mm

Test Files

• LayoutTests/platform/mac-wk2/TestExpectations
• Source/ThirdParty/ANGLE/src/tests/gl_tests/OcclusionQueriesTest.cpp

Patch Preview

diff --git a/LayoutTests/platform/mac-wk2/TestExpectations b/LayoutTests/platform/mac-wk2/TestExpectations
index 5661950f388b..5066d4b54544 100644
--- a/LayoutTests/platform/mac-wk2/TestExpectations
+++ b/LayoutTests/platform/mac-wk2/TestExpectations
@@ -2309,6 +2309,8 @@ webkit.org/b/315877 [ Sequoia Debug x86_64 ] webgl/2.0.y/conformance2/textures/m
 webkit.org/b/315877 [ Sequoia Debug x86_64 ] webgl/2.0.y/conformance2/textures/webgl_canvas/tex-3d-r11f_g11f_b10f-rgb-float.html [ Pass Timeout ]
 webkit.org/b/315877 [ Sequoia Debug x86_64 ] webgl/2.0.y/conformance2/textures/image_bitmap_from_video/tex-2d-rgba32f-rgba-float.html [ Pass Failure ]
 
+webkit.org/b/318751 [ Debug arm64 ] webgl/2.0.y/conformance2/textures/misc/tex-unpack-params.html [ Pass Failure ]
+
 webkit.org/b/315881 [ Sequoia Release x86_64 ] fast/attachment/cocoa/wide-attachment-class.html [ Pass ImageOnlyFailure ]
 webkit.org/b/315881 [ Sequoia Release x86_64 ] fast/attachment/cocoa/wide-attachment-default-icon.html [ Pass ImageOnlyFailure ]
 webkit.org/b/315881 [ Sequoia Release x86_64 ] fast/attachment/cocoa/wide-attachment-folder-icon.html [ Pass ImageOnlyFailure ]
diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/ContextMtl.h b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/ContextMtl.h
index 41553c65283a..a85c8ecffa9f 100644
--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/ContextMtl.h
+++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/ContextMtl.h
@@ -31,6 +31,7 @@ namespace rx
 {
 class DisplayMtl;
 class FramebufferMtl;
+class QueryMtl;
 class VertexArrayMtl;
 class ProgramMtl;
 class ProgramExecutableMtl;
@@ -301,20 +302,22 @@ class ContextMtl : public ContextImpl, public mtl::Context
                                        bool renderPassChanged);
     void onBackbufferResized(const gl::Context *context, WindowSurfaceMtl *backbuffer);
 
-    // Invoke by QueryMtl
-    angle::Result onOcclusionQueryBegin(const gl::Context *context, QueryMtl *query);
-    void onOcclusionQueryEnd(const gl::Context *context, QueryMtl *query);
-    void onOcclusionQueryDestroy(const gl::Context *context, QueryMtl *query);
+    angle::Result onOcclusionQueryBegin(QueryMtl &query);
+    void onOcclusionQueryEnd();
+    void onOcclusionQueryDestroy(QueryMtl &query);
 
     // Useful for temporarily pause then restart occlusion query during clear/blit with draw.
-    bool hasActiveOcclusionQuery() const { return mOcclusionQuery; }
+    bool isOcclusionQueryEnabledInRenderPass() const
+    {
+        return mOcclusionQueryIsEnabledInRenderPass;
+    }
     // Disable the occlusion query in the current render pass.
     // The render pass must already started.
-    void disableActiveOcclusionQueryInRenderPass();
+    void disableOcclusionQueryInRenderPass();
     // Re-enable the occlusion query in the current render pass.
     // The render pass must already started.
     // NOTE: the old query's result will be retained and combined with the new result.
-    angle::Result restartActiveOcclusionQueryInRenderPass();
+    angle::Result enableOcclusionQueryInRenderPass();
 
     // Invoke by TransformFeedbackMtl
     void onTransformFeedbackActive(const gl::Context *context, TransformFeedbackMtl *xfb);
@@ -536,8 +539,6 @@ class ContextMtl : public ContextImpl, public mtl::Context
                                          bool xfbPass,
                                          bool *pipelineDescChanged);
 
-    angle::Result startOcclusionQueryInRenderPass(QueryMtl *query, bool clearOldValue);
-
     angle::Result checkCommandBufferError();
 
     // Dirty bits.
@@ -607,7 +608,6 @@ class ContextMtl : public ContextImpl, public mtl::Context
     FramebufferMtl *mDrawFramebuffer  = nullptr;
     VertexArrayMtl *mVertexArray      = nullptr;
     ProgramExecutableMtl *mExecutable = nullptr;
-    QueryMtl *mOcclusionQuery         = nullptr;
 
     using DirtyBits = angle::BitSet<DIRTY_BIT_MAX>;
 
@@ -658,6 +658,9 @@ class ContextMtl : public ContextImpl, public mtl::Context
     id<MTLTexture> mRasterizationRateMapTexture;
 
     mtl::ContextDevice mContextDevice;
+
+    mtl::BufferRef mOcclusionQueryResultBuffer;
+    bool mOcclusionQueryIsEnabledInRenderPass{false};
 };
 
 }  // namespace rx
diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/ContextMtl.mm b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/ContextMtl.mm
index 644b213beee9..8703f6c2d578 100644
--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/ContextMtl.mm
+++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/ContextMtl.mm
@@ -1823,7 +1823,7 @@ GLint GetOwnershipIdentity(const egl::AttributeMap &attribs)
             mRenderEncoder.setStoreAction(MTLStoreActionStore);
         }
 
-        disableActiveOcclusionQueryInRenderPass();
+        disableOcclusionQueryInRenderPass();
 
         mOcclusionQueryPool.prepareRenderPassVisibilityPoolBuffer(this);
 
@@ -2281,84 +2281,67 @@ GLint GetOwnershipIdentity(const egl::AttributeMap &attribs)
     onDrawFrameBufferChangedState(context, framebuffer, true);
 }
 
-angle::Result ContextMtl::onOcclusionQueryBegin(const gl::Context *context, QueryMtl *query)
+angle::Result ContextMtl::onOcclusionQueryBegin(QueryMtl &query)
 {
-    ASSERT(mOcclusionQuery == nullptr);
-    mOcclusionQuery = query;
-
+    ASSERT(!mOcclusionQueryResultBuffer);  // Frontend guarantees none active at the time.
+    const mtl::BufferRef &resultBuffer = query.getVisibilityResultBuffer();
+    bool isEnabledInRenderPass;
     if (mRenderEncoder.valid())
     {
-        // if render pass has started, start the query in the encoder
-        return startOcclusionQueryInRenderPass(query, true);
+        size_t resultOffset;
+        ANGLE_TRY(mOcclusionQueryPool.beginQuery(this, resultBuffer, &resultOffset));
+        mRenderEncoder.setVisibilityResultMode(MTLVisibilityResultModeBoolean, resultOffset);
+        // Result is available after flush.
+        mCmdBuffer.setWriteDependency(resultBuffer, /*isRenderCommand=*/true);
+        isEnabledInRenderPass = true;
     }
     else
     {
-        query->resetVisibilityResult(this);
+        // Reset the occlusion query result stored in buffer to zero.
+        // Later draws will use continueQuery() to enable the visibility buffer writes.
+        auto blitEncoder = getBlitCommandEncoder();
+        blitEncoder->fillBuffer(resultBuffer, NSMakeRange(0, mtl::kOcclusionQueryResultSize), 0);
+        resultBuffer->syncContent(this, blitEncoder);
+        isEnabledInRenderPass = false;
     }
-
+    mOcclusionQueryResultBuffer          = resultBuffer;
+    mOcclusionQueryIsEnabledInRenderPass = isEnabledInRenderPass;
     return angle::Result::Continue;
 }
-void ContextMtl::onOcclusionQueryEnd(const gl::Context *context, QueryMtl *query)
-{
-    ASSERT(mOcclusionQuery == query);
-
-    if (mRenderEncoder.valid())
-    {
-        // if render pass has started, end the query in the encoder
-        disableActiveOcclusionQueryInRenderPass();
-    }
 
-    mOcclusionQuery = nullptr;
-}
-void ContextMtl::onOcclusionQueryDestroy(const gl::Context *context, QueryMtl *query)
+void ContextMtl::onOcclusionQueryEnd()
 {
-    if (query->getAllocatedVisibilityOffsets().empty())
-    {
-        return;
-    }
-    if (mOcclusionQuery == query)
-    {
-        onOcclusionQueryEnd(context, query);
-    }
-    mOcclusionQueryPool.deallocateQueryOffset(this, query);
+    ASSERT(mOcclusionQueryResultBuffer);  // Frontend guarantees one active at the time.
+    disableOcclusionQueryInRenderPass();
+    mOcclusionQueryResultBuffer = nullptr;
 }
 
-void ContextMtl::disableActiveOcclusionQueryInRenderPass()
+void ContextMtl::onOcclusionQueryDestroy(QueryMtl &query)
 {
-    if (!mOcclusionQuery || mOcclusionQuery->getAllocatedVisibilityOffsets().empty())
-    {
-        return;
-    }
-
-    ASSERT(mRenderEncoder.valid());
-    mRenderEncoder.setVisibilityResultMode(MTLVisibilityResultModeDisabled,
-                                           mOcclusionQuery->getAllocatedVisibilityOffsets().back());
+    // On normal operation frontend guaraantees that end is called before destroy.
+    // On context destruction, active query is destroyed without end.
+    // Discard is valid for both.
+    mOcclusionQueryPool.discardQuery(query.getVisibilityResultBuffer());
 }
 
-angle::Result ContextMtl::restartActiveOcclusionQueryInRenderPass()
+void ContextMtl::disableOcclusionQueryInRenderPass()
 {
-    if (!mOcclusionQuery || mOcclusionQuery->getAllocatedVisibilityOffsets().empty())
+    if (mOcclusionQueryResultBuffer && mOcclusionQueryIsEnabledInRenderPass)
     {
-        return angle::Result::Continue;
+        ASSERT(mRenderEncoder.valid());
+        mRenderEncoder.setVisibilityResultMode(MTLVisibilityResultModeDisabled, 0);
+        mOcclusionQueryIsEnabledInRenderPass = false;
     }
-
-    return startOcclusionQueryInRenderPass(mOcclusionQuery, false);
 }
 
-angle::Result ContextMtl::startOcclusionQueryInRenderPass(QueryMtl *query, bool clearOldValue)
+angle::Result ContextMtl::enableOcclusionQueryInRenderPass()
 {
     ASSERT(mRenderEncoder.valid());
-

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Kwak Kiyong, Song nuri, Tristan Madani (@TristanInSec) from Talence Security

Root Cause Analysis

The issue was addressed with improved memory handling.

Files Changed

Source Files

• Source/JavaScriptCore/wasm/WasmGlobal.h
• Source/JavaScriptCore/wasm/WasmTable.cpp
• Source/JavaScriptCore/wasm/WasmTable.h

Test Files

• JSTests/wasm/gc/transitive-type-retention-global.js
• JSTests/wasm/gc/transitive-type-retention-table.js

Overview

Advisory: Apple Security Advisory

Impact:

Description: Visiting a website may leak sensitive data

Researchers: Jody Ritonga

Root Cause Analysis

A permissions issue was addressed with additional restrictions.

Files Changed

Source Files

• Source/WebCore/Modules/async-clipboard/Clipboard.cpp

Test Files

• LayoutTests/editing/async-clipboard/clipboard-change-data-while-getting-type.html
• LayoutTests/editing/async-clipboard/clipboard-get-type-with-old-items.html
• LayoutTests/editing/async-clipboard/resources/async-clipboard-helpers.js
• LayoutTests/http/tests/security/clipboard/clipboard-access-in-cross-origin-iframe-denied-expected.txt
• LayoutTests/http/tests/security/clipboard/clipboard-access-in-cross-origin-iframe-denied.html
• LayoutTests/http/tests/security/clipboard/resources/clipboard-access-from-iframe.html
• LayoutTests/imported/w3c/web-platform-tests/clipboard-apis/async-navigator-clipboard-basics.https-expected.txt
• LayoutTests/imported/w3c/web-platform-tests/clipboard-apis/async-navigator-clipboard-basics.https.html
• LayoutTests/imported/w3c/web-platform-tests/clipboard-apis/resources/user-activation.js

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to memory corruption

Researchers: Milad Nasr and Nicholas Carlini with Claude, Anthropic

Root Cause Analysis

A use-after-free issue was addressed with improved memory management.

Files Changed

Source Files

• Source/WebCore/css/CSSFontFace.cpp

Test Files

• LayoutTests/fonts/font-face-load-crash-expected.txt
• LayoutTests/fonts/font-face-load-crash.html

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: Maher Azzouzi, Tuan and Duc from Calif.io, OpenAI Codex Security - Amy Burnett, Evan Lambert

Root Cause Analysis

The issue was addressed with improved memory handling.

Files Changed

Source Files

• Source/JavaScriptCore/runtime/ArrayBuffer.cpp
• Source/JavaScriptCore/runtime/ArrayBuffer.h
• Source/JavaScriptCore/runtime/JSArrayBuffer.cpp
• Source/JavaScriptCore/runtime/JSArrayBuffer.h
• Source/JavaScriptCore/runtime/JSArrayBufferPrototype.cpp
• Source/JavaScriptCore/wasm/WasmMemory.h
• Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.cpp

Test Files

• JSTests/wasm/stress/wasm-resizable-buffer-resize-after-gc.js

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: Nan Wang (@eternalsakura13)

Root Cause Analysis

A use-after-free issue was addressed with improved memory management.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: Nan Wang (@eternalsakura13)

Root Cause Analysis

A stack overflow was addressed with improved input validation.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: Josef Korbel, Gia Bui (@yabeow) from Calif.io

Root Cause Analysis

A use-after-free issue was addressed with improved memory management.

Files Changed

Source Files

• Source/WebCore/html/HTMLCanvasElement.cpp
• Source/WebCore/html/OffscreenCanvas.cpp

Test Files

• LayoutTests/fast/canvas/canvas-getContext-reentrant-expected.txt
• LayoutTests/fast/canvas/canvas-getContext-reentrant.html

Overview

Advisory: Apple Security Advisory

Impact:

Description: A malicious website may be able to silently hijack clipboard data

Researchers: Idan Masas

Root Cause Analysis

This issue was addressed through improved state management.

Files Changed

Source Files

• Source/WebCore/dom/DocumentStorageAccess.cpp
• Source/WebCore/dom/DocumentStorageAccess.h
• Source/WebCore/page/ChromeClient.h
• Source/WebKit/NetworkProcess/Classifier/WebResourceLoadStatisticsStore.cpp
• Source/WebKit/NetworkProcess/Classifier/WebResourceLoadStatisticsStore.h
• Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
• Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.h
• Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.messages.in
• Source/WebKit/Scripts/webkit/messages.py
• Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in
• Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp
• Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.h
• Source/WebKit/WebProcess/WebPage/WebPage.cpp
• Source/WebKit/WebProcess/WebPage/WebPage.h

Test Files

• LayoutTests/http/tests/storageAccess/request-storage-access-rejected-without-gesture-should-not-activate-expected.txt
• LayoutTests/http/tests/storageAccess/request-storage-access-rejected-without-gesture-should-not-activate.html
• LayoutTests/http/tests/storageAccess/resources/request-storage-access-without-gesture-check-activation-iframe.html

Overview

Advisory: Apple Security Advisory

Impact:

Description: A malicious website may be able to process restricted web content outside the sandbox

Researchers: Luke Francis

Root Cause Analysis

The issue was addressed with improved input validation.

Files Changed

Source Files

• Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
• Source/WebKit/UIProcess/WebPageProxy.cpp

Test Files

• LayoutTests/ipc/load-image-for-decoding-file-url-expected.txt
• LayoutTests/ipc/load-image-for-decoding-file-url.html

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Utkarsh Pal, Tristan Madani (@TristanInSec) from Talence Security, stratan (@5tratan) of Almamater Technologies, Narendra Singh (@_3P1C), Josef Korbel (Citadelo), Gia Bui (@yabeow) from Calif.io

Root Cause Analysis

A use-after-free issue was addressed with improved memory management.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: Tommy DeVoss from Braze Security Team (@thedawgyg), Gurpreet Shergill, Gia Bui (@yabeow) from Calif.io

Root Cause Analysis

A use-after-free issue was addressed with improved memory management.

Files Changed

Source Files

• Source/WebCore/Modules/async-clipboard/ClipboardItemBindingsDataSource.cpp

Test Files

• LayoutTests/editing/async-clipboard/clipboard-write-item-crash-expected.txt
• LayoutTests/editing/async-clipboard/clipboard-write-item-crash.html

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to memory corruption

Researchers: dr3dd

Root Cause Analysis

A use-after-free issue was addressed with improved memory management.

Files Changed

Source Files

• Source/WebKit/GPUProcess/webrtc/UserMediaCaptureManagerProxy.cpp

Test Files

• LayoutTests/ipc/usermedia-capture-start-producing-data-race-expected.txt
• LayoutTests/ipc/usermedia-capture-start-producing-data-race.html
• LayoutTests/platform/glib/TestExpectations

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may disclose sensitive user information

Researchers: Nan Wang (@eternalsakura13)

Root Cause Analysis

A path handling issue was addressed with improved validation.

Files Changed

Source Files

• Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
• Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.h
• Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.messages.in
• Source/WebKit/NetworkProcess/storage/IDBStorageConnectionToClient.cpp
• Source/WebKit/NetworkProcess/storage/IDBStorageConnectionToClient.h
• Source/WebKit/NetworkProcess/storage/IDBStorageRegistry.cpp
• Source/WebKit/NetworkProcess/storage/IDBStorageRegistry.h
• Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp
• Source/WebKit/NetworkProcess/storage/NetworkStorageManager.h

Test Files

• LayoutTests/ipc/register-file-backed-blob-path-validation-expected.txt
• LayoutTests/ipc/register-file-backed-blob-path-validation.html

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Jonathan Alush-Aben

Root Cause Analysis

A use-after-free issue was addressed with improved memory management.

Files Changed

Source Files

• Source/WebCore/Modules/mediasource/MediaSource.cpp
• Source/WebCore/platform/graphics/MediaPlayer.cpp
• Source/WebCore/platform/graphics/MediaPlayer.h

Overview

Advisory: Apple Security Advisory

Impact:

Description: A malicious website may exfiltrate data cross-origin

Researchers: Rhyru9, Merrick Hare, Kwak Kiyong, Song Nuri, Khai Tran, John Lussier, Gurpreet Shergill, Drinor Selmanaj (Sentry)

Root Cause Analysis

The issue was addressed with improved checks.

Files Changed

Source Files

• Source/WebCore/Modules/WebGPU/GPUDevice.cpp
• Source/WebCore/Modules/WebGPU/GPUDevice.h
• Source/WebCore/Modules/WebGPU/GPUDevice.idl

Test Files

• LayoutTests/http/tests/webgpu/import-external-texture-cross-origin-video-expected.txt
• LayoutTests/http/tests/webgpu/import-external-texture-cross-origin-video.html

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may result in the disclosure of process memory

Researchers: Arni Hardarson, Nathaniel Oh (@calysteon)

Root Cause Analysis

The issue was addressed with improved memory handling.

Files Changed

Source Files

• Source/JavaScriptCore/yarr/YarrJIT.cpp

Test Files

• JSTests/stress/regexp-backreference-unicode-offset.js

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Юлия Мерцалова

Root Cause Analysis

A use-after-free issue was addressed with improved memory management.

Files Changed

Source Files

• Source/WebCore/html/canvas/WebGL2RenderingContext.h
• Source/WebCore/html/canvas/WebGLRenderingContext.h
• Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp
• Source/WebCore/html/canvas/WebGLRenderingContextBase.h

Test Files

• LayoutTests/fast/canvas/webgl/context-restore-concurrent-gc-no-crash-expected.txt
• LayoutTests/fast/canvas/webgl/context-restore-concurrent-gc-no-crash.html

Patch Preview

diff --git a/LayoutTests/fast/canvas/webgl/context-restore-concurrent-gc-no-crash-expected.txt b/LayoutTests/fast/canvas/webgl/context-restore-concurrent-gc-no-crash-expected.txt
new file mode 100644
index 000000000000..c2541f4f3dd7
--- /dev/null
+++ b/LayoutTests/fast/canvas/webgl/context-restore-concurrent-gc-no-crash-expected.txt
@@ -0,0 +1 @@
+PASS if no crash.
diff --git a/LayoutTests/fast/canvas/webgl/context-restore-concurrent-gc-no-crash.html b/LayoutTests/fast/canvas/webgl/context-restore-concurrent-gc-no-crash.html
new file mode 100644
index 000000000000..a62c55af8994
--- /dev/null
+++ b/LayoutTests/fast/canvas/webgl/context-restore-concurrent-gc-no-crash.html
@@ -0,0 +1,66 @@
+<!DOCTYPE html>
+<html>
+<body>
+<!-- Exercises a race between WebGL2 context restoration (which reinitializes
+     bound-object state via initializeNewContext) and concurrent GC marking (which
+     traverses that state via addMembersToOpaqueRoots). Without objectGraphLock()
+     held during restoration, the restore path can free objects the GC marker is
+     still reading, causing a use-after-free. -->
+<script>
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    testRunner.waitUntilDone();
+}
+if (window.internals)
+    internals.settings.setWebGLErrorsToConsoleEnabled(false);
+
+const tick = () => new Promise(r => setTimeout(r, 0));
+
+// Ensure the GC marker doesn't reach the WebGL wrapper until the concurrent phase.
+const heapPaddingSize = 300000;
+const heapPadding = new Array(heapPaddingSize);
+for (let i = 0; i < heapPaddingSize; i++)
+    heapPadding[i] = { a: i, b: { c: i } };
+
+async function loseAndRestoreContext() {
+    const canvas = document.body.appendChild(document.createElement('canvas'));
+    canvas.width = 1;
+    canvas.height = 1;
+    const gl = canvas.getContext('webgl2');
+    const ext = gl.getExtension('WEBGL_lose_context');
+    for (let i = 0; i < heapPaddingSize; i += 4096)
+        heapPadding[i].g = gl;
+
+    const contextLost = new Promise(r => {
+        canvas.addEventListener('webglcontextlost', e => { e.preventDefault(); r(); });
+    });
+    const contextRestored = new Promise(r => {
+        canvas.addEventListener('webglcontextrestored', () => r());
+    });
+
+    ext.loseContext();
+    await contextLost;
+    await tick();
+
+    // Trigger GC so its concurrent marking phase overlaps the restore timer.
+    new WebAssembly.Memory({ initial: 1024 });
+    new WebAssembly.Memory({ initial: 1024 });
+    ext.restoreContext();
+    await tick();
+    await tick();
+    await contextRestored;
+
+    canvas.remove();
+}
+
+async function runTest() {
+    for (let i = 0; i < 50; i++)
+        await loseAndRestoreContext();
+    document.body.textContent = 'PASS if no crash.';
+    if (window.testRunner)
+        testRunner.notifyDone();
+}
+runTest();
+</script>
+</body>
+</html>
diff --git a/Source/WebCore/html/canvas/WebGL2RenderingContext.h b/Source/WebCore/html/canvas/WebGL2RenderingContext.h
index dcf736d39056..b691cd7a4c8b 100644
--- a/Source/WebCore/html/canvas/WebGL2RenderingContext.h
+++ b/Source/WebCore/html/canvas/WebGL2RenderingContext.h
@@ -261,7 +261,7 @@ class WebGL2RenderingContext final : public WebGLRenderingContextBase {
 
 private:
     using WebGLRenderingContextBase::WebGLRenderingContextBase;
-    void initializeContextState() final;
+    void initializeContextState() WTF_REQUIRES_LOCK(objectGraphLock()) final;
 
     RefPtr<ArrayBufferView> arrayBufferViewSliceFactory(ASCIILiteral functionName, const ArrayBufferView& data, unsigned startByte, unsigned bytelength);
     RefPtr<ArrayBufferView> sliceArrayBufferView(ASCIILiteral functionName, const ArrayBufferView& data, GCGLuint srcOffset, GCGLuint length);
@@ -269,7 +269,7 @@ class WebGL2RenderingContext final : public WebGLRenderingContextBase {
     long long getInt64Parameter(GCGLenum) final;
     Vector<bool> getIndexedBooleanArrayParameter(GCGLenum pname, GCGLuint index);
 
-    void initializeDefaultObjects() final;
+    void initializeDefaultObjects() WTF_REQUIRES_LOCK(objectGraphLock()) final;
     void detachAndRemoveAllObjects() WTF_REQUIRES_LOCK(objectGraphLock()) final;
     bool validateBufferTarget(ASCIILiteral functionName, GCGLenum target) final;
     bool validateBufferTargetCompatibility(ASCIILiteral, GCGLenum, WebGLBuffer*);
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.h b/Source/WebCore/html/canvas/WebGLRenderingContext.h
index 7404a87eb9a4..a9b2f1b3e9de 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.h
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.h
@@ -60,7 +60,7 @@ class WebGLRenderingContext final : public WebGLRenderingContextBase {
 
 private:
     using WebGLRenderingContextBase::WebGLRenderingContextBase;
-    void initializeDefaultObjects() final;
+    void initializeDefaultObjects() WTF_REQUIRES_LOCK(objectGraphLock()) final;
     void detachAndRemoveAllObjects() WTF_REQUIRES_LOCK(objectGraphLock()) final;
 };
 
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp b/Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp
index f128a2833781..2216b3ef9011 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp
+++ b/Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp
@@ -524,8 +524,11 @@ void WebGLRenderingContextBase::initializeNewContext(Ref<GraphicsContextGL> cont
     updateActiveOrdinal();
     if (!wasActive)
         addActiveContext(*this);
-    initializeContextState();
-    initializeDefaultObjects();
+    {
+        Locker locker { objectGraphLock() };
+        initializeContextState();
+        initializeDefaultObjects();
+    }
     // Next calls will receive the context lost callback.
     m_context->setClient(this);
 }
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContextBase.h b/Source/WebCore/html/canvas/WebGLRenderingContextBase.h
index 57fc93560676..9313e4ff0bca 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContextBase.h
+++ b/Source/WebCore/html/canvas/WebGLRenderingContextBase.h
@@ -538,8 +538,8 @@ class WebGLRenderingContextBase : public GraphicsContextGL::Client, public GPUBa
     friend class ScopedWebGLRestoreTexture;
 
     void initializeNewContext(Ref<GraphicsContextGL>);
-    virtual void initializeContextState();
-    virtual void initializeDefaultObjects();
+    virtual void initializeContextState() WTF_REQUIRES_LOCK(objectGraphLock());
+    virtual void initializeDefaultObjects() WTF_REQUIRES_LOCK(objectGraphLock());
     virtual void detachAndRemoveAllObjects() WTF_REQUIRES_LOCK(objectGraphLock());
 
     // ActiveDOMObject

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: OpenAI Codex Security - Amy Burnett, Khai Tran

Root Cause Analysis

An out-of-bounds write issue was addressed with improved input validation.

Files Changed

Source Files

• Source/JavaScriptCore/wasm/WasmEntryPlan.cpp
• Source/JavaScriptCore/wasm/WasmEntryPlan.h
• Source/JavaScriptCore/wasm/WasmIPIntPlan.cpp

Test Files

• JSTests/wasm/stress/streaming-compile-try-table-agreement.js

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: dr3dd

Root Cause Analysis

A use-after-free issue was addressed with improved memory management.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Idan Masas, DARKNAVY (@DarkNavyOrg), Anonymous working with TrendAI Zero Day Initiative, Daniel Rhea

Root Cause Analysis

The issue was addressed with improved memory handling.

Files Changed

Source Files

• Source/JavaScriptCore/yarr/RegularExpression.cpp

Test Files

• Tools/TestWebKitAPI/CMakeLists.txt
• Tools/TestWebKitAPI/Tests/JavaScriptCore/RegularExpression.cpp

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: kwak kiyong / kakaogames

Root Cause Analysis

A use-after-free issue was addressed with improved memory management.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Aisle offensive security research team (Joshua Rogers, Luigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi, Ngan Nguyen of Calif.io

Root Cause Analysis

The issue was addressed with improved memory handling.

Files Changed

Source Files

• Source/JavaScriptCore/wasm/WasmTypeDefinition.cpp

Test Files

• JSTests/wasm/regress/310207.js

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Tristan Madani (@TristanInSec) from Talence Security, Nathaniel Oh (@calysteon)

Root Cause Analysis

The issue was addressed with improved memory handling.

Files Changed

Source Files

• Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h

Test Files

• JSTests/stress/growable-sharedarraybuffer-parallel-grow-during-prototype-methods.js

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Mateusz Krzywicki (iVerify.io)

Root Cause Analysis

The issue was addressed with improved memory handling.

Files Changed

Source Files

• Source/JavaScriptCore/b3/air/AirFixObviousSpills.cpp

Test Files

• JSTests/stress/fixobviousspills-earlydefs.js

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Luka Rački

Root Cause Analysis

The issue was addressed with improved memory handling.

Files Changed

Source Files

• Source/JavaScriptCore/assembler/AssemblerBuffer.h
• Source/JavaScriptCore/yarr/YarrErrorCode.cpp
• Source/JavaScriptCore/yarr/YarrErrorCode.h
• Source/JavaScriptCore/yarr/YarrParser.h
• Source/JavaScriptCore/yarr/YarrPattern.cpp
• Source/JavaScriptCore/yarr/YarrSyntaxChecker.cpp

Test Files

• JSTests/stress/regexp-alternative-heavy.js
• JSTests/stress/regexp-bol-optimize-out-of-stack.js
• JSTests/stress/regexp-combined-large.js
• JSTests/stress/regexp-deep-nested.js
• JSTests/stress/regexp-heavy-mixed.js
• JSTests/stress/regexp-lookahead-heavy.js
• JSTests/stress/stack-overflow-regexp.js
• LayoutTests/js/script-tests/stack-overflow-regexp.js
• LayoutTests/js/stack-overflow-regexp-expected.txt

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang

Root Cause Analysis

FTL JIT OSR exit had a phantom array unwritten slot bug where an array’s length was not properly updated after arr.map(f) when f returned the same array. This is a JIT compilation bug in FTL’s OSR exit handling where the compiler incorrectly assumed array shape during bailout.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may prevent Content Security Policy from being enforced

Researchers: Cantina

Root Cause Analysis

CSP path matching did not percent-decode path segments before comparison, allowing %2F..%2F path traversal to bypass script-src path restrictions. Fix: pathMatches() now splits on /, then percent-decodes each segment individually before comparing.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: an anonymous researcher

Root Cause Analysis

The issue was addressed with improved memory handling.

Files Changed

Source Files

• Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/TextureMtl.mm

Test Files

• Source/ThirdParty/ANGLE/src/tests/gl_tests/ETCTextureTest.cpp

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Vitaly Simonovich

Root Cause Analysis

The issue was addressed with improved input validation.

Files Changed

Source Files

• Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/ProvokingVertexHelper.mm

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: Milad Nasr and Nicholas Carlini with Claude, Anthropic

Root Cause Analysis

A use-after-free issue was addressed with improved memory management.

Files Changed

Source Files

• Source/WebCore/html/HTMLDialogElement.cpp

Test Files

• LayoutTests/fast/html/dialog-close-from-button-crash-expected.txt
• LayoutTests/fast/html/dialog-close-from-button-crash.html

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Kenneth Hsu of Palo Alto Networks, Jérôme DJOUDER, dr3dd

Root Cause Analysis

WebRTC encoded stream transformer allowed writing audio frames to video streams and vice versa. RTCEncodedStreamProducer::writeFrame did not validate that the incoming frame type matched the stream type. Fix: Added m_hasTransformer and m_transformer weak pointer checks; writeFrame now returns early if m_isVideo != isVideo or if the frame is not from the expected transformer.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: Gia Bui (@yabeow) from Calif.io, dr3dd, w0wbox

Root Cause Analysis

A use-after-free issue was addressed with improved memory management.

Files Changed

Source Files

• Source/WebCore/html/BaseDateAndTimeInputType.cpp
• Source/WebCore/html/BaseDateAndTimeInputType.h
• Source/WebCore/html/shadow/DateTimeEditElement.cpp
• Source/WebCore/html/shadow/DateTimeEditElement.h

Test Files

• LayoutTests/fast/forms/date/date-editable-components/date-editable-components-change-type-on-input-event-expected.txt
• LayoutTests/fast/forms/date/date-editable-components/date-editable-components-change-type-on-input-event.html

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: dr3dd

Root Cause Analysis

JSWebAssemblyInstance destructor called m_anchor->tearDown() after unregistering ICs and destroying baseline data. If GC ran during destruction, the anchor could be accessed after partial teardown. Fix: Moved m_anchor->tearDown() to the beginning of the destructor, before any other cleanup.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Maher Azzouzi

Root Cause Analysis

The issue was addressed with improved memory handling.

Files Changed

Test Files

• JSTests/wasm/regress/309628.js

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: wac and Kookhwan Lee working with TrendAI Zero Day Initiative

Root Cause Analysis

The issue was addressed with improved memory handling.

Files Changed

Source Files

• Source/WebCore/inspector/agents/InspectorCSSAgent.cpp

Overview

Advisory: Apple Security Advisory

Impact:

Description: An app may be able to access sensitive user data

Researchers: Cantina

Root Cause Analysis

FrameLoader::load called addSameSiteInfoToRequestIfNeeded before checking if the initiator should inherit the security origin from its owner. This caused SameSite=Strict cookies to be sent on cross-site navigations initiated by iframes. Fix: Passes initiator.ptr() only when shouldInheritSecurityOriginFromOwner is false.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may disclose sensitive user information

Researchers: Luke Francis, Vaagn Vardanian, kwak kiyong / kakaogames, Vitaly Simonovich, Adel Bouachraoui, greenbynox

Root Cause Analysis

Pasteboard drag-and-drop and file upload paths were not validated against an allowlist. A compromised web process could register attachment identifiers pointing to arbitrary files (e.g. /etc/passwd). Fix: Added m_allowedAttachmentFilePaths HashSet to WebProcessProxy, validates paths before registration.

Overview

Advisory: Apple Security Advisory

Impact:

Description: A malicious iframe may use another website’s download settings

Researchers: Khiem Tran

Root Cause Analysis

Safe Browsing checks were asynchronous and could complete after the navigation policy decision had already proceeded to download. This allowed malicious downloads to start before the Safe Browsing warning was shown. Fix: decidePolicyForNavigationAction and decidePolicyForResponseShared now defer download decisions until whenSafeBrowsingCheckCompletes fires.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: Artem Dinaburg of Trail of Bits via Anthropic CVD

Root Cause Analysis

The issue was addressed with improved memory handling.

Files Changed

Source Files

• Source/JavaScriptCore/ftl/FTLOperations.cpp

Test Files

• JSTests/stress/ftl-osr-exit-phantom-new-array-with-butterfly-having-a-bad-time.js

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: Do Young Park

Root Cause Analysis

WebAssembly BBQCallee could be freed while its OMGOSREntryCallee was still being referenced during callsite repatching, causing use-after-free. Fix: updateCallsitesToCallUs now keeps BBQCallee alive via keepAliveBBQCallees vector and only keeps OMGOSREntryCallee alive if the BBQ callee was not already tracked.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may prevent Content Security Policy from being enforced

Researchers: Cantina

Root Cause Analysis

CSP blob URL iframe was only inheriting the last CSP header when a document had multiple enforced CSP headers. ContentSecurityPolicyResponseHeaders::addPolicyHeadersTo used setHTTPHeaderField which overwrote instead of appended.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may bypass Content Security Policy

Researchers: lebr0nli of National Yang Ming Chiao Tung University, Security and Systems Lab

Root Cause Analysis

AudioWorklet and PaintWorklet did not inherit the owner document’s CSP, allowing eval() and remote script loading even when CSP blocked them. Fix: WorkletParameters now carries contentSecurityPolicyResponseHeaders; worklet global scopes call applyContentSecurityPolicyResponseHeaders() on creation. WorkerModuleScriptLoader now treats worklet destinations as script-src governed.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may bypass Same Origin Policy

Researchers: Thomas Espach

Root Cause Analysis

A cross-origin issue in the Navigation API was addressed with improved input validation.

Files Changed

Source Files

• Source/WebCore/page/Navigation.cpp

Test Files

• Tools/TestWebKitAPI/Tests/WebKit/WKWebView/NavigationAPI.mm

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Yeonghyeon Choi, Daniel Rhea, Söhnke Benedikt Fischedick (Tripton), Emrovsky & Switch3301, Yevhen Pervushyn

Root Cause Analysis

The issue was addressed with improved memory handling.

Files Changed

Source Files

• Source/JavaScriptCore/runtime/ArrayBuffer.cpp
• Source/JavaScriptCore/runtime/JSArrayBufferView.h
• Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h

Test Files

• JSTests/wasm/stress/resizable-buffer-grow-view-refresh.js

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may prevent Content Security Policy from being enforced

Researchers: webb

Root Cause Analysis

This issue was addressed through improved state management.

Files Changed

Source Files

• Source/WebCore/loader/DocumentWriter.cpp

Test Files

• LayoutTests/http/tests/security/contentSecurityPolicy/iframe-srcdoc-import-bypass-expected.txt
• LayoutTests/http/tests/security/contentSecurityPolicy/iframe-srcdoc-import-bypass.html
• LayoutTests/http/tests/security/contentSecurityPolicy/resources/module-pass.py
• LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/inheritance-from-initiator.sub-expected.txt

Overview

Advisory: Apple Security Advisory

Impact:

Description: A maliciously crafted webpage may be able to fingerprint the user

Researchers: Gongyu Ma (@Mezone0)

Root Cause Analysis

An authorization issue was addressed with improved state management.

Files Changed

Source Files

• Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.cpp
• Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.h
• Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Minse Kim, Narcis Oliveras Fontàs, Söhnke Benedikt Fischedick (Tripton), Daniel Rhea, Nathaniel Oh (@calysteon)

Root Cause Analysis

The issue was addressed with improved memory handling.

Files Changed

Source Files

• Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h

Test Files

• JSTests/stress/growable-sharedarraybuffer-parallel-grow-during-prototype-methods.js

Overview

Advisory: Apple Security Advisory

Impact:

Description: A malicious website may be able to process restricted web content outside the sandbox

Researchers: greenbynox, Arni Hardarson, and an anonymous researcher

Root Cause Analysis

The issue was addressed with improved memory handling.

Files Changed

Source Files

• Source/WebKit/GPUProcess/graphics/RemoteGraphicsContext.cpp

Overview

Advisory: Apple Security Advisory

Impact:

Description: A malicious website may be able to access script message handlers intended for other origins

Researchers: Hongze Wu and Shuaike Dong from Ant Group Infrastructure Security Team, and webb

Root Cause Analysis

A logic issue was addressed with improved state management.

Files Changed

Source Files

• Source/WebCore/page/UserMessageHandler.cpp
• Source/WebCore/page/UserMessageHandler.h
• Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMDOMWindow.cpp

Test Files

• Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebViewEvaluateJavaScript.mm

Overview

Advisory: Apple Security Advisory

Impact:

Description: Visiting a maliciously crafted website may lead to a cross-site scripting attack

Researchers: @hamayanhamayan

Root Cause Analysis

A logic issue was addressed with improved checks.

Files Changed

Source Files

• Source/WebCore/dom/DOMImplementation.cpp
• Source/WebCore/platform/MIMETypeRegistry.cpp
• Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm

Test Files

• LayoutTests/media/iframe-load-html-as-m2ts-expected.txt
• LayoutTests/media/iframe-load-html-as-m2ts.html

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: HanQing from TSDubhe and Nan Wang (@eternalsakura13)

Root Cause Analysis

This issue was addressed through improved state management.

Files Changed

Source Files

• Source/JavaScriptCore/runtime/PropertyTable.cpp

Test Files

• JSTests/stress/private-names-seal-freeze.js

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: EntryHi

Fix not public. The WebKit fix for this bug is embargoed or not yet disclosed. The bug ID is confirmed from the Apple advisory, but no public commit references it.

Root Cause Analysis

The issue was addressed with improved memory handling.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: EntryHi

Fix not public. The WebKit fix for this bug is embargoed or not yet disclosed. The bug ID is confirmed from the Apple advisory, but no public commit references it.

Root Cause Analysis

The issue was addressed with improved memory handling.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: HanQing from TSDubhe and Nan Wang (@eternalsakura13)

Root Cause Analysis

The issue was addressed with improved memory handling.

Files Changed

Source Files

• Source/JavaScriptCore/wasm/WasmBBQJIT.cpp
• Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp

Test Files

• JSTests/wasm/stress/omg-tail-call-clobber-scratch-register-2.js

Overview

Advisory: Apple Security Advisory

Impact:

Description: A remote attacker may be able to cause a denial-of-service

Researchers: Nathaniel Oh (@calysteon)

Root Cause Analysis

The issue was addressed with improved memory handling.

Files Changed

Source Files

• Source/WebCore/platform/audio/AudioResamplerKernel.cpp

Overview

Advisory: Apple Security Advisory

Impact:

Description: A website may be able to track users through Safari web extensions

Researchers: Tom Van Goethem

Root Cause Analysis

This issue was addressed through improved state management.

Files Changed

Source Files

• Source/WebCore/xml/XMLSerializer.cpp

Test Files

• Tools/TestWebKitAPI/Tests/WebKitCocoa/WKWebViewConfiguration.mm

Overview

Advisory: Apple Security Advisory

Impact:

Description: A download’s origin may be incorrectly associated

Researchers: @retsew0x01

Root Cause Analysis

This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org .

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-43529 was also issued in response to this report.

Researchers: Apple and Google Threat Analysis Group

Fix not public. The WebKit fix for this bug is embargoed or not yet disclosed. The bug ID is confirmed from the Apple advisory, but no public commit references it.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative

Root Cause Analysis

A buffer overflow issue was addressed with improved memory handling.

Files Changed

Source Files

• Source/WTF/wtf/HashTable.h

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: 이동하 (Lee Dong Ha of BoB 14th)

Root Cause Analysis

A use-after-free issue was addressed with improved memory management.

Files Changed

Source Files

• Source/WebCore/inspector/agents/InspectorAnimationAgent.cpp
• Source/WebCore/inspector/agents/InspectorAnimationAgent.h

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.

Researchers: Google Threat Analysis Group

Root Cause Analysis

A use-after-free issue was addressed with improved memory management.

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Phil Pizlo of Epic Games

Root Cause Analysis

A race condition was addressed with improved state handling.

Files Changed

Source Files

• Source/bmalloc/libpas/src/libpas/pas_local_allocator_inlines.h
• Source/bmalloc/libpas/src/libpas/pas_segregated_heap.c
• Source/bmalloc/libpas/src/libpas/pas_segregated_heap.h

Test Files

• Source/bmalloc/libpas/src/test/ExpendableMemoryTests.cpp

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Google Big Sleep, Nan Wang (@eternalsakura13)

Root Cause Analysis

The issue was addressed with improved memory handling.

Files Changed

Source Files

• Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp

Test Files

• JSTests/wasm/stress/bbq-array-set-consume.js

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Nan Wang (@eternalsakura13)

Root Cause Analysis

A use-after-free issue was addressed with improved memory management.

Files Changed

Source Files

• Source/JavaScriptCore/bytecode/CodeBlock.cpp

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative

Root Cause Analysis

A type confusion issue was addressed with improved state handling.

Files Changed

Source Files

• Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

Test Files

• JSTests/stress/data-view-byte-length-oob-exit.js

Overview

Advisory: Apple Security Advisory

Impact:

Description: An app may be able to access sensitive user data

Researchers: Wojciech Regula of SecuRing (wojciechregula.blog)

Root Cause Analysis

The issue was addressed with additional permissions checks.

Files Changed

Source Files

• Source/WebKit/UIProcess/UserMediaPermissionRequestManagerProxy.cpp
• Source/WebKit/UIProcess/WebPageProxy.cpp
• Source/WebKit/UIProcess/WebPageProxy.h

Test Files

• Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
• Tools/TestWebKitAPI/Tests/WebKit/GetUserMedia.mm
• Tools/TestWebKitAPI/Tests/WebKitCocoa/NotificationAPI.mm
• Tools/TestWebKitAPI/Tests/WebKitCocoa/UIDelegate.mm
• Tools/TestWebKitAPI/Tests/WebKitCocoa/example.webarchive

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative, Nan Wang (@eternalsakura13)

Root Cause Analysis

The issue was addressed with improved memory handling.

Files Changed

Source Files

• Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp

Test Files

• JSTests/stress/array-sink-conditional-initialization.js
• JSTests/stress/array-sink-diamond-initialization-then-read.js
• JSTests/stress/array-sink-read-uninitialized-hole.js

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may disclose internal states of the app

Researchers: Google Big Sleep

Fix not public. The WebKit fix for this bug is embargoed or not yet disclosed. The bug ID is confirmed from the Apple advisory, but no public commit references it.

Root Cause Analysis

A memory initialization issue was addressed with improved memory handling.

Overview

Advisory: Apple Security Advisory

Impact:

Description: A website may exfiltrate image data cross-origin

Researchers: Tom Van Goethem