Documentation
WebKit Security Monitor tracks WebKit CVEs from Apple and WebKitGTK advisories, correlates each to its fixing commit, and runs an autonomous root-cause pipeline over the patch. The search page exposes a structured query language so you can filter by component, weakness class, severity, CVSS, researcher, exploitation status, and analysis state — and combine any of them freely.
Search operators
| Operator | Example | Description |
|---|---|---|
component: |
component:JavaScriptCore |
WebKit component. Also comp:. Values include JavaScriptCore, WebCore, WebKit, WTF, ANGLE |
class: |
class:UseAfterFree |
Bug class. Also type:, bugclass:. e.g. UseAfterFree, OutOfBounds, TypeConfusion, LogicError, IntegerOverflow |
severity: |
severity:critical |
Severity rating. Also sev:. Values: critical, high, medium, low |
cvss: |
cvss:8+ |
NVD CVSS base-score filter. See syntax below. |
cwe: |
cwe:CWE-416 |
CWE weakness id, or a name substring (cwe:use-after-free). Also cwe_id: |
kev: |
kev:true |
CISA Known Exploited Vulnerabilities status. kev:true / kev:false, or the bare word kev |
year: |
year:2025 |
Advisory year, YYYY |
month: |
month:2025-08 |
Advisory month, YYYY-MM |
bug: |
bug:290100 |
WebKit Bugzilla id |
researcher: |
researcher:"Pinkie Pie" |
Credited researcher, case-insensitive substring. Also author:. Quote multi-word names. |
status: |
status:analyzed |
Pipeline state: analyzed, correlated, pending |
analyzed: |
analyzed:true |
Has a completed root-cause analysis. true / false |
fixed: |
fixed:true |
Has a correlated fixing commit. Also hascommit:. true / false |
embargoed: |
embargoed:true |
Bug known but no public commit yet. Also emb: |
itw |
itw |
Exploited in the wild. Also exploited, or exploited:true |
The boolean facets — kev:, analyzed:, fixed:, embargoed:, exploited: — take an explicit true or false, so you can search for either presence or absence (e.g. fixed:false finds CVEs still awaiting a correlated commit). itw, exploited, embargoed, and kev also work as bare keyword shorthands.
Exploitation signals — these mean different things:
itw— flagged exploited in the wild at disclosure (from the advisory text).kev:true— listed on the CISA Known Exploited Vulnerabilities catalog, which is added to over time as exploitation is confirmed.
CVSS score syntax
The cvss: operator accepts three forms, matched against the NVD base score:
| Syntax | Meaning | Example |
|---|---|---|
cvss:N+ |
Score ≥ N | cvss:8+ |
cvss:N-M |
Score between N and M (inclusive) | cvss:7-9 |
cvss:N.N |
Exact score (±0.05) | cvss:9.8 |
CVSS scores and CWE ids are sourced from the NVD. Newly disclosed CVEs — and STAR Labs advisory IDs that NVD has not yet ingested — may have no score; those simply do not match a cvss: filter until NVD publishes one.
Combining operators
Separate operators with a space — that space is the AND. Every operator you add narrows the results further; all conditions must match. There is no AND keyword (typing AND would be treated as a free-text word) and no OR.
component:JavaScriptCore class:UseAfterFree
severity:critical cvss:9+
cwe:CWE-416 year:2025
researcher:"Manfred Paul" component:WebCore
itw cvss:8+
You can also mix operators with free-text keywords, which match the CVE id, Bugzilla id, key insight, researcher, component, and bug class:
component:WebCore garbage collector
class:TypeConfusion array
Researcher search
researcher: (or author:) matches the credited researcher string, case-insensitively, as a substring. Quote multi-word names, otherwise only the first word is taken as the operator value and the rest becomes free text:
researcher:"Nan Wang"
researcher:pinkie
author:"Google Threat Analysis Group"
Common queries
| Query | What it finds |
|---|---|
itw |
Exploited in the wild |
kev:true |
On the CISA KEV catalog |
component:JavaScriptCore class:UseAfterFree |
JSC use-after-free bugs |
severity:critical cvss:9+ |
Critical CVEs with CVSS ≥ 9 |
cwe:CWE-843 |
Type-confusion weaknesses |
cwe:CWE-787 |
Out-of-bounds write |
class:IntegerOverflow year:2025 |
2025 integer-overflow bugs |
analyzed:true component:WebCore |
WebCore CVEs with a completed RCA |
fixed:false |
CVEs still awaiting a correlated fixing commit |
embargoed:true |
Bug known, no public commit yet |
cvss:7-9 month:2025-08 |
CVSS 7–9 CVEs from August 2025 |
researcher:"Manfred Paul" |
CVEs credited to Manfred Paul |
Data fields
Each CVE page and the search table draw on:
- Overview — WebKit component, bug class, severity, exploitation status, advisory date, and correlated fixing commit
- CVSS — NVD base score, severity band, and vector (where NVD has published one)
- CWE — one or more NVD weakness classifications
- Root-cause analysis — the pipeline’s key insight, attack path, affected functions, and patch diff, when analysis is complete
- Credits — the researcher(s) named in the advisory
Coverage
Data covers WebKit CVEs from Apple security advisories and WebKitGTK/WPE security advisories. Non-WebKit Safari CVEs (UI, networking, and other Safari-app issues that are not WebKit engine bugs) are excluded. Each CVE is correlated to its fixing commit in the WebKit repository where one is public; CVSS and CWE come from NVD where available.