← WebKit Silent-Fix Report — 2026-W34
f78e2fb7cfb10417c5a99affaba7fcad58226c52 REGRESSION (319105@main): a policy decision that outlives its navigation is honored for a load it does not belong to
severity medium
class LogicError
confidence 0.55
UIProcess navigation policy / downloads
Primitive: Stale navigation policy decision honored for a server-redirect load it does not belong to
Triage note: A server redirect carrying the download attribute was flagged IsDownloadPolicyCheck::Yes so it did not displace the frame's outstanding navigation policy listener, letting a prior policy decision be applied to a load it did not belong to; fixed by adding !navigationAction->isRedirect().
Triage note: A server redirect carrying the download attribute was flagged IsDownloadPolicyCheck::Yes so it did not displace the frame's outstanding navigation policy listener, letting a prior policy decision be applied to a load it did not belong to; fixed by adding !navigationAction->isRedirect().
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…