diff --git a/scripts/build/deps/webkit.ts b/scripts/build/deps/webkit.ts
index bd46c4206e4a..7a42f9c652e1 100644
--- a/scripts/build/deps/webkit.ts
+++ b/scripts/build/deps/webkit.ts
@@ -258,6 +258,10 @@ export const webkit: Dependency = {
       // it. If a future version drops libbmalloc.a, you'll get a clear
       // "file not found" at link time (not silent omission + cryptic
       // undefined symbols).
+      //
+      // TODO(#28097): bmalloc/libpas causes crashes on Windows under memory
+      // pressure. Once oven-sh/WebKit rebuilds prebuilts with
+      // -DUSE_SYSTEM_MALLOC=ON, exclude bmallocLib on Windows here.
       const libs = [...coreLibs(cfg), ...prebuiltIcuLibs(cfg), bmallocLib(cfg)];
 
       const includes = ["include"];
@@ -281,6 +285,8 @@ export const webkit: Dependency = {
     // which source.ts appends to the resolved libs automatically. Listing
     // them here would make dep_build also claim to produce them (dup error).
     // Posix uses system ICU (linked via -licu* in bun.ts).
+    // TODO(#28097): same as above — exclude bmallocLib on Windows once
+    // prebuilts are rebuilt with -DUSE_SYSTEM_MALLOC=ON.
     const libs = [...coreLibs(cfg), bmallocLib(cfg)];
 
     const includes = [