🕵️ SicherheitslückenHak5: Hackers Just Poisoned the Rust Supply Chain | Threat Wire(01.09.2026 um 14:00 Uhr)
🕵️ SicherheitslückenHak5: Hackers Found a Way Into Humanoid Robots | Threat Wire(04.09.2026 um 15:04 Uhr)
🔧 AI Nachrichten Bits und so #1021 (Passwort für Laufwerk)(31.08.2026 um 22:15 Uhr)
🔧 AI Nachrichten Bits und so #1022 (Wie Weißbier)(06.09.2026 um 20:39 Uhr)
🍏 iOS / Mac OSHue-App 6.0 ist da: das sind die Neuerungen(07.09.2026 um 17:21 Uhr)
🕵️ SicherheitslückenHak5: Hackers Just Poisoned the Rust Supply Chain | Threat Wire(01.09.2026 um 14:00 Uhr)
🕵️ SicherheitslückenHak5: Hackers Found a Way Into Humanoid Robots | Threat Wire(04.09.2026 um 15:04 Uhr)
🔧 AI Nachrichten Bits und so #1021 (Passwort für Laufwerk)(31.08.2026 um 22:15 Uhr)
🔧 AI Nachrichten Bits und so #1022 (Wie Weißbier)(06.09.2026 um 20:39 Uhr)
🍏 iOS / Mac OSHue-App 6.0 ist da: das sind die Neuerungen(07.09.2026 um 17:21 Uhr)

💾 Tools 🕛 kürzlich 13 Min Lesezeit CVE-2026-8388
0

The Servo Blog: June in Servo: real world compat, media queries, SharedWorker, and more!

Cyber Threat & Vulnerability Dossier CVSS 5.8 MEDIUM (Heuristik) EPSS 4.7%
ANGRIPPSVEKTOR
🌐 Netzwerk (Remote)
AUTHENTIFIZIERUNG
🔓 Keine Authentifizierung nötig
SCHADENSPROFIL
⛔ Dienstausfall (DoS) / Full Compromise
CWE-KLASSIFIZIERUNG
CWE-79: Cross-Site Scripting
Handlungsempfehlung: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.
Im CVE-Radar öffnen
↗ Quelle (servo.org)
🗣️ Stimme:
📑 Inhaltsübersicht

.



()
  • ‘image(<color>)’, ‘closest-corner’, and ‘farthest-corner’ in ‘ellipse()’ and ‘circle()’ ()

  • ‘calc()’ and other , , , , , )

  • ‘@media (orientation)’ ()

  • ‘@media (pointer)’ and ‘@media (any-pointer)’ ()

  • ‘@media (hover)’ and ‘@media (any-hover)’ ()


  • Plus a bunch of new DOM APIs:



    • Shared­Worker ()

    • console­.dir() ()

    • custom­Element­Registry on Document and Shadow­Root ()

    • initialize() on Custom­Element­Registry (, , )

    • text­Stream() on Request, Response, and Blob (, , , , ,

















    • Servo is steadily becoming a bigger and busier project every month, and by June 2026, we’ve been reading through over four times the commits as we did when we started in September 2023.



      , it’s now easier than ever for you to help us answer those questions, using the Servo Highfive bot!
      If you’re working on a pull request that you think might be interesting for the next monthly update, even if you’re not 100% sure, tell us about it by following the steps below:




      1. You add the monthly update label to your pull request, or comment monthly update answer




      Security , , , .


      Several more security bugs in Servo’s JS runtime have been fixed in Servo 0.4.0 with the update to SpiderMonkey 140.12.0 ().
      The exact CVEs that apply to us are not yet known, but for more details, see , – for more details, see ().


      We’ve fixed an HTML injection bug (XSS) in file:/// directory listings, which affected file names containing </script> ().


      Real world compat , and many websites have become a lot more readable thanks to our improved handling of variable fonts (), including Zulip ().





      v0.3.0

      v0.4.0





      )





      v0.3.0

      v0.4.0





      Speedtest () and Cash Converters () and OpenStreetMap (
      Google Photos (
      Cash Converters (
      Google Maps (
      OpenStreetMap (, and failures


      We’re implementing the more powerful version of ‘attr()’ that can be used anywhere, not just in ‘content’, under --pref layout­_css­_attr­_enabled (, , , , , , , , .


      We’ve made more progress towards accessibility support, under --pref accessibility_enabled (, , , ), one of the most long-awaited features of any web browser.
      Stay tuned!


      We’ve also started working on Web Animations, under --pref dom­_web­_animations­_enabled (, , , so it has generally not been possible to embed Servo in another application without building Servo from source.
      To make it possible, we’ve started designing a wrapper C API that will let you consume Servo as a prebuilt shared library using the stable and ubiquitous C ABI ().
      Eventually the idea is that we’ll create a wrapper Rust API around that wrapper C API, so you can have both the ergonomics of Rust and the build simplicity of C.


      Embedding API :



      • ()


      Breaking changes:



      • , , ).


        For users and developers , , , , , , , , )




      When using the Firefox DevTools:




      • in the Console tab, uncaught exceptions are reported correctly ()




      • in the Console and Debugger tabs, you can now inspect the elements of nested arrays and the entries of Map objects (, )




      • in the Debugger tab, the Scopes panel now shows any ‘(uninitialized)’ variables, the value of this, and the global scope (, )




      We’ve fixed some build issues on riscv32, riscv64, and arm64 (, ), and modernised servoshell for Android to use Compose UI and Kotlin (, , , , , , , , , , , , , in a single command (), rather than having to run mach test-wpt --log-raw <path> followed by mach update-wpt <path>




    More on the web platform event listeners ().
    Note that like in Firefox, ‘wheel’ events are passive by default.


    ‘dotted’, ‘dashed’, and ‘wavy’ text decorations are now continuous across element boundaries ().


    We’ve improved the conformance of <dialog> (, ), <iframe sandbox> (), <input minlength> and <input maxlength> (), CSS gradients (), ‘font-style’ and ‘unicode-range’ in ‘, , ), HTML­Input­Element (), Intersection­Observer (, ), new Response() (), URL.create­Object­URL() and URL.revoke­Object­URL() (, , ).


    We’ve fixed bugs related to <input hidden> (), ‘animation-delay’ (), ‘clip-path’ (, , ), ‘width’ and ‘height’ (), ‘box-shadow: inset’ (), ‘animation­iteration’ events (), ‘click’ events (), ‘load’ events (), ‘error’ events in Worker global scopes (), and document­.get­Element­By­Id() ().


    Garbage collection safety to store many of our DOM types in other DOM types, enforcing Rust’s “aliasing xor mutability” rule at runtime by panicking if the rule is violated.
    But when garbage collection happens, we need to , call to prove that GC can not occur by passing a NoGC marker value.
    We can then require that a &NoGC must be borrowed from a &JSContext (which blocks GC) and not a &mut JSContext (which allows GC), taking advantage of how Rust references work without needing any custom static analysis.


    We have a large codebase that needs to be migrated in parts, so for now we’ve created the new method , , rather than creating an owned JSContext on the spot.


    This continues our long-running effort to use the Rust type system to make Servo’s integration with SpiderMonkey safer and more reliable (, , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,


    NoGC was designed to prevent dynamic borrow failures, but it also enables some performance optimisations!
    If we can prove that garbage collection is impossible in some part of Servo, we can often avoid rooting JavaScript objects when interacting with them within that region of code.
    This has allowed us to reduce overheads by over 1% in the layout process and in HTML­Collection (, , , ).


    We’ve fixed some nasty memory leaks when reloading and in 2D canvases (, , ).


    Speaking of which, 2D canvases now use up to 23% less power (), and we now avoid rasterising the same SVG more than once (, , ).
    On top of that, we’ve improved incremental layout (, , , ).


    We’ve also reduced allocations, copies, GC rooting steps, and other operations in many parts of Servo (, , , , , ).


    For several months, Frédéric ( for Servo bugs, and thanks to his work we’ve fixed sixteen (16) crash bugs in June, affecting <iframe>, <slot>, <link onerror>, ‘animation’, ‘clip-path’, ‘content’, ‘rotate’, ‘transition’, ‘transform-style’, ‘display: contents’, ‘overflow: clip’, CSS­Keyframes­Rule, Font­Face, stop() on Window, document­.element­From­Point(), and the DOM tree (, , , , , , , , , , ).


    We’ve also fixed crash bugs related to IPC failures, HTML­Input­Element, Range, the DevTools Debugger tab, and when servoshell is built with --features native-bluetooth (, , , , ).


    New contributors , , , , , , , , , , , , , , , , , , , , , of issues that are good for new contributors!


    Donations , one of our latest that helps more people contribute to Servo.


    Servo is also on , , or could be a good way for you (or your employer) to give back to the community.


    We now have , and active proposals are tracked in .

    Vollständiger Original-Bericht
    Ausführliche Details, Code-Beispiele & Hersteller-Stellungnahme auf servo.org.
    ↗ Original-Artikel auf servo.org lesen

    Wie bewertest du diesen Beitrag?
    1 Klick Feedback
    Teilen mit Netzwerk & Team:

    Community-Analysen & Experten-Meinungen 0

    Verfasse deine eigene Analyse, teile Workarounds oder diskutiere diesen Vorfall im Blog.
    Noch keine Community-Analyse verfasst. Markiere einen Textabschnitt oder klicke oben auf Eigene Analyse verfassen“!
    Community Pulse: Relevanz-Einschätzung
    1 Klick Experten-Votum
    🔴 Akute Relevanz 0%
    🟡 In Evaluierung 0%
    🟢 Keine Auswirkung 0%
    Spannende Innovation 0%
    Verwandte Story-Cluster & Quellen (Vektor-KI)
    Port 8095 Engine
    1 Quelle
    Hackers Just Poisoned the Rust Supply Chain | Threat Wire
    1 Quelle
    Hackers Found a Way Into Humanoid Robots | Threat Wire
    1 Quelle
    Bits und so #1021 (Passwort für Laufwerk)