← WebKit — 2026-W35
e1706a288fb5 BroadcastChannel cross-origin spoof
severity medium
class CrossOrigin
confidence 0.8
signal score 6.5
Source/WebKit/NetworkProcess
patch-now
Primitive: Missing origin-to-connection authorization lets a web process register/post BroadcastChannel for origins it cannot access
Triage note: Adds isOriginAllowedForConnection() (via allowsFirstPartyForCookies on the ClientOrigin.topOrigin) as a MESSAGE_CHECK in registerChannel/unregisterChannel/postMessage of NetworkBroadcastChannelRegistry, so a compromised/misbehaving web process can no longer inject into or observe cross-origin broadcast channels in the network process. Also drops a now-invalid ASSERT in allowsFirstPartyForCookies.
Triage note: Adds isOriginAllowedForConnection() (via allowsFirstPartyForCookies on the ClientOrigin.topOrigin) as a MESSAGE_CHECK in registerChannel/unregisterChannel/postMessage of NetworkBroadcastChannelRegistry, so a compromised/misbehaving web process can no longer inject into or observe cross-origin broadcast channels in the network process. Also drops a now-invalid ASSERT in allowsFirstPartyForCookies.
Structural signals: smartptr_member_added (+3.0), null_guard (+1.2), msg_soft (+1.0), surgical (+1.3)
Commit message
BroadcastChannel cross-origin spoof
rdar://172230453
Reviewed by Charlie Wolfe.
A compromised web content process can send a malicious message to the Networking process
to register for broadcast channel messages it should not have access to.
This adds message checks to validate that the IPC::Connection these messages are
coming from has access to the top security origin claimed.
Tests: Tools/TestWebKitAPI/Tests/WebKitCocoa/BroadcastChannelOriginSpoof.mm
* Source/WebKit/NetworkProcess/NetworkBroadcastChannelRegistry.cpp:
(WebKit::NetworkBroadcastChannelRegistry::isOriginAllowedForConnection const):
(WebKit::NetworkBroadcastChannelRegistry::registerChannel):
(WebKit::NetworkBroadcastChannelRegistry::unregisterChannel):
(WebKit::NetworkBroadcastChannelRegistry::postMessage):
* Source/WebKit/NetworkProcess/NetworkBroadcastChannelRegistry.h:
* Source/WebKit/NetworkProcess/NetworkProcess.cpp:
(WebKit::NetworkProcess::allowsFirstPartyForCookies): Remove an unnecessary ASSERT that prevents
this from being tested in the debug configuration.
* Tools/TestWebKitAPI/Tests/WebKitCocoa/NetworkProcess.mm:
(-[BroadcastChannelSpoofMessageHandler userContentController:didReceiveScriptMessage:]):
((NetworkProcess, BroadcastChannelOriginSpoof)):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/PasteHTML.mm:
Identifier: 305413.560@safari-7624-branch
Before / after
Loading diff…
On This Page