← WebKit — 2026-W41
ca9cf2bac154b2dc19c14122732c737b6fe3c1e5 REGRESSION(322609@main): History items and origin-agent-cluster keying use the old browsing context group during a COOP swap
severity medium
class CrossOrigin
confidence 0.4
signal score 6.47
Source/WebKit/UIProcess
Primitive: agent-cluster keying used the page's stale browsing context group instead of the committing provisional page's group
Triage note: Adds browsingContextGroupForCommittingNavigation() and threads the correct BrowsingContextGroup into backForwardAddItemShared and into resolveAgentClusterKeying during receivedNavigationResponsePolicyDecision, so a cross-process (provisional-page) commit keys agent clusters against the group it actually commits into. Affects process/origin-isolation decisions; largely plumbing and the concrete exploit is not demonstrable from the diff.
Triage note: Adds browsingContextGroupForCommittingNavigation() and threads the correct BrowsingContextGroup into backForwardAddItemShared and into resolveAgentClusterKeying during receivedNavigationResponsePolicyDecision, so a cross-process (provisional-page) commit keys agent clusters against the group it actually commits into. Affects process/origin-isolation decisions; largely plumbing and the concrete exploit is not demonstrable from the diff.
Structural signals: smartptr_member_added (+6.47)
Commit message
REGRESSION(322609@main): History items and origin-agent-cluster keying use the old browsing context group during a COOP swap
https://bugs.webkit.org/show_bug.cgi?id=326551
rdar://189335683
Reviewed by Alex Christensen.
Since 322609@main, the page adopts a COOP swap's new browsing context group only when the navigation
commits, in swapToProvisionalPage(). Two things happen earlier, while the provisional page loads, and
still read the page's old group:
- The back/forward item for the new document. The web process adds it before it reports the commit,
so the item recorded the old group, and going back to it picked a process for that group. With site
isolation, ProcessSwap.CommittedURLAfterNavigatingBackToCOOP got a new process instead of the one
that showed the page. Without site isolation, going back to a cross-origin isolated page also got a
new process and missed the back/forward cache, because the old group is not isolated.
- Origin-agent-cluster keying of the response. The new document used the old group's keying for its
origin, so a COOP page that sends Origin-Agent-Cluster: ?1 after a same-origin page that does not
was site-keyed.
Use the group that the navigation commits into. ProvisionalPageProxy passes its own group when it
adds the item, and the new browsingContextGroupForCommittingNavigation() returns the provisional
page's group for that page's navigation. Both changes also apply to other process swaps that start a
new group.
Tests: TestWebKitAPI.ProcessSwap.CommittedURLAfterNavigatingBackToCrossOriginIsolated
TestWebKitAPI.ProcessSwap.OriginAgentClusterKeyingAfterCOOPSwap
* Source/WebKit/UIProcess/ProvisionalPageProxy.cpp:
(WebKit::ProvisionalPageProxy::backForwardAddItem): Pass the provisional page's group.
* Source/WebKit/UIProcess/WebBackForwardList.cpp:
(WebKit::WebBackForwardList::backForwardAddItem):
(WebKit::WebBackForwardList::backForwardAddItemShared): Create the item with the given group.
* Source/WebKit/UIProcess/WebBackForwardList.h:
* Source/WebKit/UIProcess/WebBackForwardList.swift:
(WebBackForwardList.backForwardAddItemShared(connection:navigatedFrameState:loadedWebArchive:browsingContextGroup:)):
(WebBackForwardList.addItemInternal(connection:navigatedFrameState:loadedWebArchive:browsingContextGroup:)):
Create the item with the given group.
(WebBackForwardList.backForwardAddItem(connection:navigatedFrameState:)):
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::browsingContextGroupForCommittingNavigation const): Added.
(WebKit::WebPageProxy::receivedNavigationResponsePolicyDecision): Resolve origin-agent-cluster keying
in the group that the navigation commits into.
(WebKit::WebPageProxy::triggerProcessSwapForEnhancedSecurity): Use browsingContextGroupForCommittingNavigation().
(WebKit::WebPageProxy::backForwardAddItemShared):
* Source/WebKit/UIProcess/WebPageProxy.h:
* Tools/Scripts/webkitpy/api_tests/allowlist.txt:
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ProcessSwapOnNavigation.mm:
(TestWebKitAPI::TEST(ProcessSwap, CommittedURLAfterNavigatingBackToCrossOriginIsolated)): Added.
(TestWebKitAPI::TEST(ProcessSwap, OriginAgentClusterKeyingAfterCOOPSwap)): Added.
Canonical link: https://commits.webkit.org/323190@main
Before / after
Loading diff…
On This Page