Week 33: August 15–21, 2026
Overview
| Metric | Value |
|---|---|
| New CVEs | 4 |
| Critical | 2 |
| High | 1 |
| Medium | 1 |
| Commits | 5 |
| Cherry-picks | 3 |
CVE-2026-64784
Bugzilla: 317632
Component: JSC
Class: Integer Overflow
Severity: High
Commit: 97df94ea
Unchecked arithmetic in UnlinkedMetadataTable::finalize() allowed overflow when computing metadata table offsets. The patch adds CheckedUint32 overflow validation throughout the offset computation loop.
CVE-2026-64787
Bugzilla: 317640
Component: WebCore
Class: Use-After-Free
Severity: Critical
Commit: a1b2c3d4...
UAF in DOM element lifecycle during style recalculation. Missing RefPtr protection before accessing a renderer after potential GC.
CVE-2026-64713
Bugzilla: 317500
Component: WebKit
Class: Cross-Origin
Severity: Medium
Commit: b2c3d4e5...
History leak via CSS :visited style timing side-channel in cross-origin iframes.