Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

tauri-apps/wry

              dev @ 2f768ae
            

Fixes

CVEs

HIGH

Peak severity

66.7%

Coverage

Highlights

Denial of Service: 2 prior fixes. Scrutinize any change in this area.

src/wkwebview/class/url_scheme_handler.rs: most-fixed (2 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Memory Safety: Custom protocol handlers in macOS WKWebView are highly susceptible to race conditions and use-after-free (UAF) vulnerabilities if callback closures, webview instances, and task pointers are not safely managed across thread boundaries. Developers must ensure proper reference counting (Rc/Arc) and thread-safe synchronization (Mutex instead of RefCell).

Auth Bypass: Kotlin-to-Rust permission requests in WebChromeClient can overgrant device resources if permissions are automatically allowed without validating against the configured Rust-side handler callback. Strict allowlist checks must be enforced before granting resource requests.

Denial of Service: Concurrent access to non-thread-safe Rust static variables (such as RefCell borrows) by Android UI/Java threads and Rust background worker threads can trigger panic-on-borrow crashes, resulting in application denial of service.