Servo 0.4.0 ships record 558-commit June with SharedWorker, media queries, CVE fixes

Servo’s June release keeps up the browser engine’s accelerating pace, folding in 558 commits — its busiest month yet, up from 534 in April. The bulk of the work expands web platform coverage: experimental support for CSS attr(), late-resolving math expressions in calc(), and a large batch of media queries including pointer, hover, orientation, and aspect-ratio detection. New DOM surface includes SharedWorker, a constructable CustomElementRegistry, textStream() on Request/Response/Blob, pointer-capture and touch event handlers, and WebCrypto additions notable for their post-quantum bent — KT128/KT256 digests and public-key extraction for the ML-KEM and ML-DSA lattice schemes.

Security work is substantial. Servo pulled in SpiderMonkey 140.11.0 and 140.12.0 to close several JS-runtime CVEs (CVE-2026-8388 and others, plus the not-yet-enumerated fixes behind MFSA 2026-58). RSA in SubtleCrypto now runs modular exponentiation in constant time, though the project openly flags that its RSA remains exposed to the Marvin timing attack (RUSTSEC-2023-0071); ML-DSA’s Decompose step was likewise hardened to constant time, resolving RUSTSEC-2025-0144. The team also patched a stored-XSS bug in file:/// directory listings triggered by filenames containing a closing script tag.

Beyond features, the release signals a push toward real-world usability and embeddability. Variable-font handling improved enough to make sites like Zulip and Speedtest readable, and layout fixes helped lichess.org, while Google Maps and OpenStreetMap render but still lag on interactivity. Longer-term efforts include a stable C ABI wrapper so Servo can finally be consumed as a prebuilt shared library rather than compiled from source, plus early work on text selection, Web Animations, accessibility, and expanded WebGPU support.