When the Fix Is the Bug: Two QuickJS Findings from a WebKit Audit Harness
Posted on Mon 11 May 2026 in Thought, vulnerability research and discovery • Tagged with chronicles, vulnerability research, vulnerability discovery, QuickJS, JavaScript engines, patch auditing, methodology
I built this pipeline for WebKit. The idea was simple: stop reading patches and start attacking them. Every proposed fix gets treated as a hypothesis, if this commit closes off attack surface X, the job is to prove it, find the adjacent sites it missed, and explicitly challenge the "currently …
Continue reading