When a navigation resolves to a Download, WebKit must still honor the Safe Browsing check associated with that navigation.

Pre-patch, a download policy decision could proceed without waiting for the navigation’s Safe Browsing check to finish (and without correctly applying its result per frame), so a download initiated from a subframe/iframe could bypass or mis-apply the Safe Browsing warning – described as a malicious iframe using another website’s download settings, i.e. the download was not gated on the correct, per-navigation Safe Browsing state.

The fix adds a completion mechanism on API::Navigation – whenSafeBrowsingCheckCompletes(callback), which runs immediately if no check is ongoing else queues the callback, and fireSafeBrowsingCheckCompletionCallbacks(), invoked from WebPageProxy::beginSafeBrowsingCheck when the check finishes (using std::exchange to drain the queue). In WebPageProxy::decidePolicyForNavigationAction, when policyAction == Download and a Safe Browsing check is ongoing, the download decision is deferred via whenSafeBrowsingCheckCompletes; on completion, if a Safe Browsing warning matched, the download is refused: for a non-main frame it fails the provisional navigation and returns PolicyAction::Ignore, and for the main frame it shows the browsing warning and only proceeds per the user’s choice.

The restored invariant is that a download is authorized only after the navigation’s own Safe Browsing check completes and only if it did not match, so a subframe cannot slip a download past the warning or inherit another frame’s settings.

A security-policy bypass (not memory safety): a subframe-initiated download could proceed without correctly waiting for or applying the navigation’s Safe Browsing check, letting a malicious iframe evade the warning or use another site’s download handling. It executes in the UIProcess and affects download safety/attribution; no code-execution path. Rated medium.