← WebKit — 2026-W41
d0aabe7a8b228b18ad5b8e2005e705e9db2302ca Cross-Origin-Embedder-Policy should be ignored in non-secure contexts
severity medium
class PolicyBypass
confidence 0.4
signal score 6.87
Source/WebCore/dom
Primitive: secure-context for COEP/DIP/origin-agent-cluster derived from the response URL alone, ignoring the ancestor chain
Triage note: Introduces IsSecureContext and threads the document's full secure-context (Document::isSecureContext, now also accounting for a not-yet-attached frame's main frame) into obtainCrossOriginEmbedderPolicy/obtainDocumentIsolationPolicy/obtainOriginAgentClusterPolicy, replacing checks that only tested response.url()/topLevelCreationURL trustworthiness. Fixes isolation-policy gating for framed documents with an insecure ancestor; mostly plumbing and effect is on policy correctness, not a demonstrable memory-safety exploit.
Triage note: Introduces IsSecureContext and threads the document's full secure-context (Document::isSecureContext, now also accounting for a not-yet-attached frame's main frame) into obtainCrossOriginEmbedderPolicy/obtainDocumentIsolationPolicy/obtainOriginAgentClusterPolicy, replacing checks that only tested response.url()/topLevelCreationURL trustworthiness. Fixes isolation-policy gating for framed documents with an insecure ancestor; mostly plumbing and effect is on policy correctness, not a demonstrable memory-safety exploit.
Structural signals: smartptr_member_added (+4.87), area:Source/WebCore/dom (+2.0)
Commit message
Cross-Origin-Embedder-Policy should be ignored in non-secure contexts
https://bugs.webkit.org/show_bug.cgi?id=326351
rdar://189193030
Reviewed by Chris Dumez.
An embedder policy is only obtained for a secure context, but we only checked
the response URL, so an HTTPS document in an HTTP page, and the workers it
creates, still required CORP.
obtainCrossOriginEmbedderPolicy(), obtainDocumentIsolationPolicy() and
obtainOriginAgentClusterPolicy() now take whether the environment is a secure
context, rather than each determining it themselves. A document uses
Document::isSecureContext() and a worker uses its owner's.
With site isolation, Document::isSecureContext() is asked before a provisional
frame is added to the frame tree, so it now also checks the main frame when
there is no parent yet. Document-Isolation-Policy, which requires site
isolation, depends on this as well.
This is a first step towards determining once per navigation whether the
reserved environment is a secure context, as HTML does, so that
Document::isSecureContext() can stop walking the frame tree.
Tests: imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/no-secure-context-https-iframe.html
imported/w3c/web-platform-tests/html/document-isolation-policy/no-secure-context-https-iframe.tentative.html
Canonical link: https://commits.webkit.org/322838@main
Before / after
Loading diff…
On This Page