0day-GigaCage-Webkit/VULNERABILITY_REPORT.md

WebKit Integer Overflow Leading to Gigacage Boundary Violation in iOS 26.2

CVE: [To be assigned by Vendor]
Severity: High (CVSS 3.1: 7.5) | Critical (CVSS 3.1: 9.0) if mitigation is bypassed
Date: December 26, 2025
Vendor: Apple Inc.
Product: WebKit / Safari

---

1. Executive Summary

A critical vulnerability has been identified in the WebKit JavaScriptCore (JSC) engine involving an integer overflow in ArrayBuffer, TypedArray, and WebAssembly memory bounds calculations. This flaw enables out-of-bounds (OOB) memory access attempts.

Currently, the vulnerability is mitigated by Gigacage, WebKit's security partitioning mechanism, which detects the boundary violation and terminates the WebContent process. However, the underlying logic flaw provides a deterministic primitive that could be escalated to Remote Code Execution (RCE) if used in conjunction with an information leak or a Gigacage bypass.

---

2. Environment Details

2.1 Technical Configuration

• Operating System: iOS 26.2 (Build 23C55)
• Device: iPhone 15,3 (iPhone 14 Pro Max)
• WebKit Version: 8623.1.14.10.9
• Binary UUID: af25fa78-ae3e-3bf4-b320-4404d3a36a77
• Crash Signature:
  • Exception Type: EXC_GUARD (Namespace 31: Gigacage Primitive Partition)
  • Exception Codes: 0x600000000000001F, 0x0000000000000000
  • Crash Offset: 0xADD7476C

2.2 Affected Versions

• Confirmed Vulnerable: iOS 26.2 (Build 23C55), WebKit 8623.1.14.10.9
• Likely Affected: All iOS 26.x releases; macOS Sequoia 15.x; all iOS third-party browsers utilizing WKWebView.
• Investigation Required: iOS 25.x and corresponding macOS Sonoma versions.

---

3. Technical Analysis

3.1 Root Cause (CWE-190)

The vulnerability is rooted in an integer overflow during the calculation of memory offsets for TypedArray and DataView operations. When an index and element size are multiplied, the resulting byteOffset can wrap around at the 32-bit boundary.

This overflowed value often passes initial JavaScript-level bounds checks. However, when added to the high-address buffer base pointer within the Gigacage, the final address exceeds the 16GB partition boundary, triggering a hardware/software guard violation.

3.2 WebAssembly JIT Vector

The flaw is equally reachable via WebAssembly. The Wasm JIT compiler may elide certain bounds checks for performance. In these instances, a 32-bit integer wraparound in i32 arithmetic allows the JITed code to attempt memory access at an unsanitized address.

---

4. Proof of Concept (PoC)

4.1 JavaScript (DataView Vector)

const buffer = new ArrayBuffer(1024);
const view = new DataView(buffer);
// 0xFFFFFFFE + 4 bytes wraps at the 32-bit boundary
view.setUint32(0xFFFFFFFE, 0x41414141); 

4.2 WebAssembly (JIT Vector)

// (i32.add (i32.const 0xFFFFFFFF) (i32.const 0x5)) wraps to 0x4
// JIT-compiled load then targets the wrapped offset
(i32.load offset=0)

4.3 Reproduction Steps

1. Host the provided PoC code as an HTML file on a secure (HTTPS) server.
2. Navigate to the URL using Mobile Safari on an affected iOS 26.2 device.
3. Observe the immediate termination of the WebContent process.
4. Verify the crash signature via Settings → Privacy → Analytics & Improvements → Analytics Data.
5. Locate the ExcUserFault_MobileSafari-* log and confirm the offset 0xADD7476C.

---

5. Impact Assessment

5.1 Current Impact: Denial of Service

The Gigacage currently prevents exploitation by terminating the process before memory corruption occurs. This results in a persistent Denial of Service (DoS) for the browser or embedded web views.

5.2 Potential Impact: Remote Code Execution (RCE)

Should the Gigacage be bypassed or its base address leaked, this vulnerability enables:

• Relative Memory Corruption: Targeted manipulation of objects adjacent to the overflowed buffer.
• Vtable Hijacking: Corrupting virtual function pointers to gain control over the instruction pointer (PC).

---

6. Remediation Recommendations

6.1 Implementation of Checked Arithmetic

The root cause—an integer overflow during memory offset calculation—must be addressed by implementing checked arithmetic within the JavaScriptCore runtime. We recommend replacing standard multiplication with compiler-intrinsic overflow checks to ensure that any byteOffset exceeding the 32-bit boundary is caught before memory access is attempted.

Target Components:

• Source/JavaScriptCore/runtime/JSArrayBufferView.cpp
• Source/JavaScriptCore/runtime/JSDataView.cpp

Proposed Fix (C++):

// Utilize compiler intrinsics to detect 32-bit overflows
size_t byteOffset;
if (__builtin_mul_overflow(static_cast<size_t>(index), m_elementSize, &byteOffset)) {
    return throwOverflowError(); // Prevent execution from reaching the Gigacage
}

// Ensure the end-of-range does not wrap
size_t endOffset;
if (__builtin_add_overflow(byteOffset, m_elementSize, &endOffset)) {
    return throwOverflowError();
}

6.2 Technical Justification from Crash Telemetry

The necessity of this fix is confirmed by the provided crash logs (Incidents 50371BD6 and F8D6F487). The telemetry data reveals:

• Hardware-Level Enforcement: The current reliance on the Gigacage (Namespace 31) results in an EXC_GUARD violation. While effective at preventing RCE, this is a "fail-safe" rather than a primary validation, leading to a persistent Denial of Service.
• Consistent Failure Point: The identical crash frame at 0x22DB0E96C across both MobileSafari and SafariViewService indicates the flaw is centrally located within the shared WebKit binary (uuid: af25fa78...).
• Systemic Vulnerability: The presence of the same exception in SafariViewService confirms that the vulnerability affects all third-party applications utilizing WKWebView on iOS 26.2.

6.3 JIT Compiler Hardening

In addition to runtime checks, the WebAssembly JIT compiler must be updated to ensure that 32-bit integer arithmetic (i32) does not elide bounds checks when calculating effective addresses. The compiler should emit explicit check-and-branch instructions where an i32.add could result in a wrapped offset that bypasses standard bounds-checking logic.

---

7. Supporting Evidence

Attached Crash Logs:

• ExcUserFault_MobileSafari-2025-12-25-131432.ips
• ExcUserFault_SafariViewService-2025-12-25-062945.ips
• ExcUserFault_MobileSafari-2025-12-25-130014.ips

All logs demonstrate an identical crash offset (0xADD7476C) and namespace 31 violation, confirming 100% reproducibility across various process roles.

---

End of Report

• Primary Contact: Joseph Goydish II

Legal Disclaimer

This advisory is provided for authorized security research and defensive purposes only. Unauthorized use of this information to target systems without permission is strictly prohibited and may violate applicable laws.