← WebKit Silent-Fix Report — 2026-W23
e118db06408d11b659613936beccef24dea1421e Bad IPC from WebProcess could cause UIProcess to crash in WebPermissionControllerProxy::mostReasonableWebPageProxy()
severity low
class LogicError
confidence 0.55
UIProcess Permissions
Primitive: Unvalidated IPC in WebPermissionControllerProxy::query crashes UIProcess
Triage note: query() called mostReasonableWebPageProxy() with no identifier for non-worker sources; a malicious WebProcess could trigger a null/invalid path and crash the UIProcess. The fix adds MESSAGE_CHECK_COMPLETION requiring an identifier unless source is SharedWorker/ServiceWorker.
Triage note: query() called mostReasonableWebPageProxy() with no identifier for non-worker sources; a malicious WebProcess could trigger a null/invalid path and crash the UIProcess. The fix adds MESSAGE_CHECK_COMPLETION requiring an identifier unless source is SharedWorker/ServiceWorker.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…