← WebKit — 2026-W41
cd17a97f62733e29cded46420a09863e6bcd5271 [Site Isolation] Web Inspector: Crash when a frame target logs to the console after reconnecting
severity low
class UAF
confidence 0.35
signal score 9.06
Source/WebCore/inspector
Primitive: inspector frontend channel outliving its LocalFrame across a process swap (stale m_inspectedFrame)
Triage note: FrameInspectorTarget now moves its channel to the current LocalFrame via connectToCurrentFrame() (disconnecting the previous inspectedFrame first) because 'the channel can outlive its LocalFrame' when a frame leaves and returns to the process, and guards sendMessageToTargetBackend/didCreateInjectedScript on a null channel/CommandLineAPIHost. Lifetime/UAF-adjacent fix but inspector-only (not ordinary web-content reachable) and the target pointer is a WeakPtr.
Triage note: FrameInspectorTarget now moves its channel to the current LocalFrame via connectToCurrentFrame() (disconnecting the previous inspectedFrame first) because 'the channel can outlive its LocalFrame' when a frame leaves and returns to the process, and guards sendMessageToTargetBackend/didCreateInjectedScript on a null channel/CommandLineAPIHost. Lifetime/UAF-adjacent fix but inspector-only (not ordinary web-content reachable) and the target pointer is a WeakPtr.
Structural signals: smartptr_member_added (+6.47), null_guard (+2.59)
Commit message
[Site Isolation] Web Inspector: Crash when a frame target logs to the console after reconnecting
https://bugs.webkit.org/show_bug.cgi?id=326170
rdar://188834553
Reviewed by BJ Burg.
FrameInspectorTarget could dispatch frontend messages to a LocalFrame whose inspector controller it never
connected, for example after the frame returned to a process, or when the main frame's target connected
before CreateWebPage. Console.enable then ran without a CommandLineAPIHost, and the next console message
crashed.
Connect the channel to the current LocalFrame before dispatching, create the main frame's target after
CreateWebPage, and skip CommandLineAPI injection when there is no host.
Tests: http/tests/site-isolation/inspector/console/message-from-iframe-returning-to-process.html
* LayoutTests/http/tests/site-isolation/inspector/console/message-from-iframe-returning-to-process-expected.txt: Added.
* LayoutTests/http/tests/site-isolation/inspector/console/message-from-iframe-returning-to-process.html: Added.
* LayoutTests/http/tests/site-isolation/inspector/console/resources/silent.html: Added.
* Source/WebCore/inspector/WebInjectedScriptManager.cpp:
(WebCore::WebInjectedScriptManager::didCreateInjectedScript):
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::initializeWebPage):
* Source/WebKit/WebProcess/Inspector/FrameInspectorTarget.cpp:
(WebKit::FrameInspectorTarget::connect):
(WebKit::FrameInspectorTarget::connectToCurrentFrame):
(WebKit::FrameInspectorTarget::sendMessageToTargetBackend):
* Source/WebKit/WebProcess/Inspector/FrameInspectorTarget.h:
Canonical link: https://commits.webkit.org/323032@main
Before / after
Loading diff…
On This Page