← WebKit — 2026-W40
cae8ae4bcecac04182955b33c075f88030233483 [Site Isolation] Dragging from a cross-origin iframe to its parent frame twice hits an assertion in WebPage::willStartDrag()
not a security fix
confidence 0.12
signal score 13.64
Source/WebCore/page
Classified as not security-relevant.
Triage note: Threads FrameIdentifier through the drag pipeline (m_dragSourceFrameID, dragEndedInFrame, DragSourceEnded/DragCancelled messages, EventHandler::dragSourceEnded) so dragend/dragcancel are dispatched in the process owning the drag source under site isolation, plus a Swift build-flags change. Feature plumbing to support site-isolated drag-and-drop; no memory-safety or exploitable logic bug fixed in this diff.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Triage note: Threads FrameIdentifier through the drag pipeline (m_dragSourceFrameID, dragEndedInFrame, DragSourceEnded/DragCancelled messages, EventHandler::dragSourceEnded) so dragend/dragcancel are dispatched in the process owning the drag source under site isolation, plus a Swift build-flags change. Feature plumbing to support site-isolated drag-and-drop; no memory-safety or exploitable logic bug fixed in this diff.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Structural signals: smartptr_member_added (+6.47), null_guard (+2.59), uaf_lifetime (+3.57), msg_soft (+1.0)
Before / after
Loading diff…
On This Page