CVE-2025-24213
Overview
Impact:
Description: A type confusion issue could lead to memory corruption
Researchers: Google V8 Security Team
Key insight. The bug is an FP-environment scoping problem: WebAudio’s denormal guard flushed denormals to zero (and was absent/uncontrolled on ARM), and that non-IEEE FP mode could bleed into JIT-compiled JavaScript on the audio thread, breaking the optimizer’s floating-point assumptions into a type confusion. The fix makes the mode change precisely saved/restored and architecture-correct.
Patch Details
diff --git a/LayoutTests/platform/ios/imported/w3c/web-platform-tests/webaudio/the-audio-api/the-audioworklet-interface/audioworklet-denormals.https.window-expected.txt b/LayoutTests/platform/ios/imported/w3c/web-platform-tests/webaudio/the-audio-api/the-audioworklet-interface/audioworklet-denormals.https.window-expected.txt
deleted file mode 100644
index 4f23ae90695c..000000000000
--- a/LayoutTests/platform/ios/imported/w3c/web-platform-tests/webaudio/the-audio-api/the-audioworklet-interface/audioworklet-denormals.https.window-expected.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-
-PASS Test denormal behavior in AudioWorkletGlobalScope
-
diff --git a/LayoutTests/platform/mac/TestExpectations b/LayoutTests/platform/mac/TestExpectations
index 03b80350d704..399eac62697e 100644
--- a/LayoutTests/platform/mac/TestExpectations
+++ b/LayoutTests/platform/mac/TestExpectations
@@ -2085,7 +2085,6 @@ webkit.org/b/256108 media/video-audio-session-mode.html [ Failure ]
webkit.org/b/258181 [ Debug ] inspector/debugger/async-stack-trace-truncate.html [ Slow Failure ]
# webkit.org/b/258328 Umbrella Bug: Batch mark expectations slowing down EWS
-[ arm64 ] imported/w3c/web-platform-tests/webaudio/the-audio-api/the-audioworklet-interface/audioworklet-denormals.https.window.html [ Failure ]
[ Debug ] media/modern-media-controls/pip-support/pip-support-enabled.html [ Pass Crash ]
webkit.org/b/236128 imported/w3c/web-platform-tests/html/user-activation/activation-trigger-mouse-right.html [ Skip ]
diff --git a/LayoutTests/webaudio/audoworklet-denormal-float-values-expected.txt b/LayoutTests/webaudio/audoworklet-denormal-float-values-expected.txt
new file mode 100644
index 000000000000..df9266d13521
--- /dev/null
+++ b/LayoutTests/webaudio/audoworklet-denormal-float-values-expected.txt
@@ -0,0 +1,3 @@
+
+PASS audioworklet-denormal-float-values
+
diff --git a/LayoutTests/webaudio/audoworklet-denormal-float-values.html b/LayoutTests/webaudio/audoworklet-denormal-float-values.html
new file mode 100644
index 000000000000..59b7ee018b5b
--- /dev/null
+++ b/LayoutTests/webaudio/audoworklet-denormal-float-values.html
@@ -0,0 +1,52 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <meta charset="utf-8">
+ <meta name="viewport" content="width=device-width, initial-scale=1">
+ <title>audioworklet-denormal-float-values</title>
+ <script src="../resources/testharness.js"></script>
+ <script src="../resources/testharnessreport.js"></script>
+ <script>
+ promise_test(async test => {
+ const worklet_source = `
+ const denormal = 5e-324;
+
+ class DenormalProcessor extends AudioWorkletProcessor {
+ process(inputs, outputs, parameters) {
+ this.port.postMessage(\`Denormal value in inside processor: \${ denormal }\`);
+ return true;
+ }
+ }
+ registerProcessor('denormal-processor', DenormalProcessor);
+ `;
+
+ const denormal = 5e-324;
+ assert_equals(`Denormal value outside processor: ${ denormal }`, 'Denormal value outside processor: 5e-324');
+
+ let blob = new Blob([worklet_source], { type: 'application/javascript' });
+ let worklet = URL.createObjectURL(blob);
+
+ var context = new AudioContext({ sampleRate: 44100});
+ const dest = context.destination;
+
+ await context.audioWorklet.addModule(worklet);
+ var audioWorklet = new AudioWorkletNode(context, 'denormal-processor');
+ audioWorklet.connect(dest);
+
+ audioWorklet.port.onmessage = (msg) => console.log(msg.data);
+ audioWorkletMessagePromise = new Promise((resolve, reject) => {
+ audioWorklet.port.onmessage = resolve;
+ setTimeout(() => reject('audioWorklet message promise timed out'), 5000);
+ });
+
+ let message = await audioWorkletMessagePromise;
+ assert_equals(message.data, 'Denormal value in inside processor: 0');
+
+ context.suspend();
+ });
+</script>
+</head>
+<body>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/Source/WTF/wtf/PlatformHave.h b/Source/WTF/wtf/PlatformHave.h
index e25b258608a0..6d14f77c6af6 100644
--- a/Source/WTF/wtf/PlatformHave.h
+++ b/Source/WTF/wtf/PlatformHave.h
@@ -1891,3 +1891,8 @@
|| (PLATFORM(COCOA) && !PLATFORM(MAC))
#define HAVE_X25519_ZERO_CHECKS 1
#endif
+
+#if !defined(HAVE_DENORMAL) \
+ && (CPU(X86_SSE2) || CPU(ARM) || CPU(ARM64))
+#define HAVE_DENORMAL 1
+#endif
diff --git a/Source/WebCore/Sources.txt b/Source/WebCore/Sources.txt
index 310c103c6500..be57a81d9ce7 100644
--- a/Source/WebCore/Sources.txt
+++ b/Source/WebCore/Sources.txt
@@ -2381,6 +2381,7 @@ platform/audio/AudioResamplerKernel.cpp
platform/audio/AudioUtilities.cpp
platform/audio/Biquad.cpp
platform/audio/Cone.cpp
+platform/audio/DenormalDisabler.cpp
platform/audio/DirectConvolver.cpp
platform/audio/Distance.cpp
platform/audio/DownSampler.cpp
diff --git a/Source/WebCore/WebCore.xcodeproj/project.pbxproj b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
index 8a94c2ea1562..04e41af50e1b 100644
--- a/Source/WebCore/WebCore.xcodeproj/project.pbxproj
+++ b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -19273,6 +19273,7 @@
CDD8D310271F2C8D00DAA256 /* FormatDescriptionUtilities.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = FormatDescriptionUtilities.h; sourceTree = "<group>"; };
CDD8D311271F2C8D00DAA256 /* FormatDescriptionUtilities.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = FormatDescriptionUtilities.cpp; sourceTree = "<group>"; };
CDDC1E7918A952F30027A9D4 /* MediaSourcePrivateClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaSourcePrivateClient.h; sourceTree = "<group>"; };
+ CDDD004A2D49B890000B23CC /* DenormalDisabler.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = DenormalDisabler.cpp; sourceTree = "<group>"; };
CDDDEA222538CD8000A1300C /* MediaSession.idl */ = {isa = PBXFileReference; lastKnownFileType = text; path = MediaSession.idl; sourceTree = "<group>"; };
CDDDEA232538CD8000A1300C /* MediaSession.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = MediaSession.h; sourceTree = "<group>"; };
CDDDEA242538CD8000A1300C /* MediaSession.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = MediaSession.cpp; sourceTree = "<group>"; };
@@ -39324,6 +39325,7 @@
FD31605712B026F700C1A359 /* Biquad.h */,
FD31605812B026F700C1A359 /* Cone.cpp */,
FD31605912B026F700C1A359 /* Cone.h */,
+ CDDD004A2D49B890000B23CC /* DenormalDisabler.cpp */,
FD1660A413787C6D001FFA7B /* DenormalDisabler.h */,
FDAF19961513D131008DB0C3 /* DirectConvolver.cpp */,
FDAF19971513D131008DB0C3 /* DirectConvolver.h */,
diff --git a/Source/WebCore/platform/audio/DenormalDisabler.cpp b/Source/WebCore/platform/audio/DenormalDisabler.cpp
new file mode 100644
index 000000000000..35715e663ce7
--- /dev/null
+++ b/Source/WebCore/platform/audio/DenormalDisabler.cpp
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2025 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DenormalDisabler.h"
+
+namespace WebCore {
+
+#if HAVE(DENORMAL)
+
+#if CPU(X86_SSE2)
+constexpr int kDenormalBitMask = 0x8040;
+#elif CPU(ARM) || CPU(ARM64)
+constexpr int kDenormalBitMask = 1 << 24;
+#endif
+
+
+#if CPU(X86_SSE2)
+constexpr int kFlushDenormalsValue = kDenormalBitMask;
+#elif CPU(ARM) || CPU(ARM64)
+constexpr int kFlushDenormalsValue = kDenormalBitMask;
+#endif
+
+static intptr_t readStatusWord()
+{
+ intptr_t result = DenormalDisabler::kUndefinedStatusWord;
+#if CPU(X86_SSE2)
+ asm volatile("stmxcsr %0" : "=m"(result));
+#elif CPU(ARM)
+ asm volatile("vmrs %[result], FPSCR" : [result] "=r"(result));
+#elif CPU(ARM64)
+ asm volatile("mrs %x[result], FPCR" : [result] "=r"(result));
+#endif
+ return result;
+}
+
+static void setStatusWord(intptr_t statusWord)
+{
Background
Advisory: Apple Security Advisory
| Attribute | Value |
|---|---|
| CVE | CVE-2025-24213 |
| Bugzilla | 286694 |
| Component | WebCore |
| Bug Class | TypeConfusion |
| Severity | medium |
| Commit | c1b04541303ec183… |
| Advisory | Apple Advisory |
Terminology
- Denormal (subnormal) floats — Very small floating-point values near zero; processing them is slow, so audio code flushes them to zero via CPU mode bits.
- FP status/control word (MXCSR / FPCR) — The per-thread register controlling FP behavior, including flush-to-zero (FTZ) and denormals-are-zero (DAZ); changing it alters arithmetic semantics for all subsequent FP ops on that thread.
- AudioWorklet — A WebAudio feature that runs author-supplied JavaScript on the real-time audio rendering thread, where DenormalDisabler governs the FP environment.
- JIT FP soundness — The DFG/FTL constant-fold and range-analyze floating-point assuming IEEE-754; if the runtime FP mode differs (FTZ/DAZ), runtime results can diverge from compile-time assumptions.
- RAII scoping — Acquiring/releasing the FP mode in a constructor/destructor so it is changed and restored exactly, preventing leakage beyond the intended region.
Root Cause Analysis
OBSERVED (from the diff): DenormalDisabler is an RAII guard used around WebAudio rendering to put the CPU floating-point environment into flush-to-zero / denormals-are-zero mode (denormals badly hurt audio DSP performance). The pre-patch implementation defined the guard only for OS(WINDOWS) && COMPILER(MSVC) or COMPILER(GCC_COMPATIBLE) && defined(__SSE__) (x86), wrapping the whole class in #ifdef HAVE_DENORMAL; on ARM (Apple Silicon / iOS / iPadOS) HAVE_DENORMAL was undefined, so there was effectively no working, correctly-scoped denormal control on Apple’s primary architecture. Its constructor unconditionally OR’d flush bits into the status word (setCSR(m_savedCSR | 0x8040/0x8000)) and the destructor wrote back m_savedCSR, with x86 detection done via inline stmxcsr/ldmxcsr and an fxsave-based DAZ probe. The fix rewrites it: it reads the status word once (readStatusWord: stmxcsr on x86, mrs FPCR on ARM64, vmrs FPSCR on ARM), records m_disablingActivated = areDenormalsEnabled(m_savedCSR), changes the mode ONLY when denormals were actually enabled, and in the destructor restores the exact saved word only if it changed it; HAVE_DENORMAL moves into PlatformHave.h for X86_SSE2/ARM/ARM64 and a manual flushDenormalFloatToZero fallback covers platforms without hardware support. The net effect is a precisely-scoped, save-exactly/restore-exactly FP-environment guard that is correct on ARM as well as x86. INFERENCE (mechanism, not shown by the diff): the security significance is the interaction between this non-IEEE FP mode and JIT-compiled JavaScript. AudioWorklet executes author JS on the audio rendering thread where the denormal guard is active, and the DFG/FTL JIT constant-folds and range-analyzes floating-point operations assuming standard IEEE-754 semantics. If the flush-to-zero/denormals-are-zero mode is left active, mis-scoped, or (on ARM) uncontrolled while JIT-compiled JS runs, runtime FP results (denormals becoming zero, changed comparisons) diverge from the values the optimizer proved at compile time, breaking a JIT soundness invariant; such a divergence can be turned into a type confusion where a value the compiler treated as a specific type/shape differs at runtime, leading to memory corruption. The patch removes that divergence by making the FP-mode change tightly scoped and architecture-correct so it cannot bleed into JIT-compiled code with mismatched assumptions.
Attack Path
1. Set up a WebAudio graph with AudioWorklet
Create an AudioContext and register an AudioWorkletProcessor so attacker JavaScript runs on the audio rendering thread, where DenormalDisabler controls the FP environment.
2. Induce an FP-mode mismatch
[inference] Rely on the flush-to-zero/denormals-are-zero mode being active (or, on ARM, uncontrolled) while JIT-compiled JS on that thread executes floating-point the DFG/FTL folded assuming IEEE semantics.
3. Diverge runtime from compile-time FP
[inference] Craft FP computations (denormal-producing arithmetic, comparisons against tiny values) whose runtime results under flush-to-zero differ from the constant-folded/range-analyzed values the JIT baked in.
4. Break a JIT invariant into type confusion
[inference] Use the divergence so a value the optimizer proved to be a given type/shape (or an index proved in-bounds) is different at runtime — a type confusion.
5. Corrupt memory
[inference] Escalate the type confusion to out-of-bounds or confused-object read/write in the WebContent process.
Impact Assessment
The patch itself is a correctness/scoping fix to the audio FP-environment guard (precise save/restore, only-when-needed, and a previously-absent ARM implementation). Its security weight — reflected in the advisory’s ’type confusion could lead to memory corruption’ — comes from the inferred interaction between a mis-scoped flush-to-zero FP mode and JIT-compiled JavaScript (notably AudioWorklet on the same thread), where an FP-semantics mismatch can break JIT soundness into a type confusion and thence memory corruption. That exploitation chain is reasoned inference, not shown by the diff; what the diff establishes is the removal of the FP-mode divergence. Confined to the WebContent process. Rated medium (CVSS per NVD).
Audit Directions
Other FP-mode changers
grep for MXCSR/FPCR/FPSCR access (stmxcsr/ldmxcsr, mrs/msr FPCR, _controlfp) and rounding/flush-mode changes anywhere reachable from a thread that also runs JIT-compiled JS (audio, WebGL, workers).
AudioWorklet thread FP invariants
Audit the AudioWorklet render path for places where author JS executes while a non-default FP environment is active, and confirm the environment is IEEE (or restored) before JIT-compiled JS runs.
RAII scope leaks
Review DenormalDisabler use sites (and similar scoped-mode guards) for early returns, exceptions, or nested/threaded scopes where the mode could outlive the guard.
Changed Functions
| Function | File | Change | Note |
|---|---|---|---|
DenormalDisabler::DenormalDisabler / ~DenormalDisabler |
Source/WebCore/platform/audio/DenormalDisabler.cpp |
added | New out-of-line RAII implementation: reads the FP status word (MXCSR/FPCR/FPSCR), sets flush-to-zero only when denormals were enabled (m_disablingActivated), and restores the exact saved word in the destructor — including a correct ARM/ARM64 implementation. |
readStatusWord / setStatusWord / areDenormalsEnabled |
Source/WebCore/platform/audio/DenormalDisabler.cpp |
added | Per-architecture FP status-word accessors (stmxcsr/ldmxcsr on x86, mrs/msr FPCR on ARM64, vmrs/vmsr FPSCR on ARM) and a helper to test whether denormals are currently enabled. |
DenormalDisabler (class) / flushDenormalFloatToZero |
Source/WebCore/platform/audio/DenormalDisabler.h |
modified | Removes the x86/Windows-only #ifdef gating and inline asm, declares the ctor/dtor out-of-line, and keeps a manual flush fallback for !HAVE(DENORMAL). |
HAVE_DENORMAL definition |
Source/WTF/wtf/PlatformHave.h |
modified | Defines HAVE_DENORMAL for X86_SSE2/ARM/ARM64 so denormal control exists and is consistent on Apple’s ARM platforms, not just x86. |
Files Changed
Source Files
Source/WTF/wtf/PlatformHave.hSource/WebCore/Sources.txtSource/WebCore/WebCore.xcodeproj/project.pbxprojSource/WebCore/platform/audio/DenormalDisabler.cppSource/WebCore/platform/audio/DenormalDisabler.h
Test Files
LayoutTests/platform/ios/imported/w3c/web-platform-tests/webaudio/the-audio-api/the-audioworklet-interface/audioworklet-denormals.https.window-expected.txtLayoutTests/platform/mac/TestExpectationsLayoutTests/webaudio/audoworklet-denormal-float-values-expected.txtLayoutTests/webaudio/audoworklet-denormal-float-values.html
Regression Test
The fix ships this proof-of-concept / regression test:
diff --git a/LayoutTests/platform/ios/imported/w3c/web-platform-tests/webaudio/the-audio-api/the-audioworklet-interface/audioworklet-denormals.https.window-expected.txt b/LayoutTests/platform/ios/imported/w3c/web-platform-tests/webaudio/the-audio-api/the-audioworklet-interface/audioworklet-denormals.https.window-expected.txt
deleted file mode 100644
index 4f23ae90695c..000000000000
--- a/LayoutTests/platform/ios/imported/w3c/web-platform-tests/webaudio/the-audio-api/the-audioworklet-interface/audioworklet-denormals.https.window-expected.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-
-PASS Test denormal behavior in AudioWorkletGlobalScope
-
diff --git a/LayoutTests/platform/mac/TestExpectations b/LayoutTests/platform/mac/TestExpectations
index 03b80350d704..399eac62697e 100644
--- a/LayoutTests/platform/mac/TestExpectations
+++ b/LayoutTests/platform/mac/TestExpectations
@@ -2085,7 +2085,6 @@ webkit.org/b/256108 media/video-audio-session-mode.html [ Failure ]
webkit.org/b/258181 [ Debug ] inspector/debugger/async-stack-trace-truncate.html [ Slow Failure ]
# webkit.org/b/258328 Umbrella Bug: Batch mark expectations slowing down EWS
-[ arm64 ] imported/w3c/web-platform-tests/webaudio/the-audio-api/the-audioworklet-interface/audioworklet-denormals.https.window.html [ Failure ]
[ Debug ] media/modern-media-controls/pip-support/pip-support-enabled.html [ Pass Crash ]
webkit.org/b/236128 imported/w3c/web-platform-tests/html/user-activation/activation-trigger-mouse-right.html [ Skip ]
diff --git a/LayoutTests/webaudio/audoworklet-denormal-float-values-expected.txt b/LayoutTests/webaudio/audoworklet-denormal-float-values-expected.txt
new file mode 100644
index 000000000000..df9266d13521
--- /dev/null
+++ b/LayoutTests/webaudio/audoworklet-denormal-float-values-expected.txt
@@ -0,0 +1,3 @@
+
+PASS audioworklet-denormal-float-values
+
diff --git a/LayoutTests/webaudio/audoworklet-denormal-float-values.html b/LayoutTests/webaudio/audoworklet-denormal-float-values.html
new file mode 100644
index 000000000000..59b7ee018b5b
--- /dev/null
+++ b/LayoutTests/webaudio/audoworklet-denormal-float-values.html
@@ -0,0 +1,52 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <meta charset="utf-8">
+ <meta name="viewport" content="width=device-width, initial-scale=1">
+ <title>audioworklet-denormal-float-values</title>
+ <script src="../resources/testharness.js"></script>
+ <script src="../resources/testharnessreport.js"></script>
+ <script>
+ promise_test(async test => {
+ const worklet_source = `
+ const denormal = 5e-324;
+
+ class DenormalProcessor extends AudioWorkletProcessor {
+ process(inputs, outputs, parameters) {
+ this.port.postMessage(\`Denormal value in inside processor: \${ denormal }\`);
+ return true;
+ }
+ }
+ registerProcessor('denormal-processor', DenormalProcessor);
+ `;
+
+ const denormal = 5e-324;
+ assert_equals(`Denormal value outside processor: ${ denormal }`, 'Denormal value outside processor: 5e-324');
+
+ let blob = new Blob([worklet_source], { type: 'application/javascript' });
+ let worklet = URL.createObjectURL(blob);
+
+ var context = new AudioContext({ sampleRate: 44100});
+ const dest = context.destination;
+
+ await context.audioWorklet.addModule(worklet);
+ var audioWorklet = new AudioWorkletNode(context, 'denormal-processor');
+ audioWorklet.connect(dest);
+
+ audioWorklet.port.onmessage = (msg) => console.log(msg.data);
+ audioWorkletMessagePromise = new Promise((resolve, reject) => {
+ audioWorklet.port.onmessage = resolve;
+ setTimeout(() => reject('audioWorklet message promise timed out'), 5000);
+ });
+
+ let message = await audioWorkletMessagePromise;
+ assert_equals(message.data, 'Denormal value in inside processor: 0');
+
+ context.suspend();
+ });
+</script>
+</head>
+<body>
+
+</body>
+</html>
\ No newline at end of file