Medium CVSS 4.3 webkit Logic Error 🔧 Commit mapped

Overview

Medium
Severity
4.3
CVSS
No
Exploited ITW
Fixed
Fix Status
DescriptionA malicious website may be able to track users in Safari private browsing mode
ComponentWebCore Platform/EME
Bug ClassLogic Error
Tracker286580
Fix commitdf02f84bef71 (WebKit/WebKit) +68/-4
CWECWE-284
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CISA KEVNot listed
Creditedan anonymous researcher
Disclosed2025-03-31

Background

ClearKey / EME
The Encrypted Media Extensions ClearKey CDM; each media key session receives an identifier exposed to script as session.sessionId.
Process-global static counter
A single static incremented across all instances/origins, producing a value that persists across contexts.
Private-browsing isolation
Contexts that should not share correlatable state; a global counter defeats that isolation.

Root Cause Analysis

This fixes a private-browsing tracking vector: ClearKey EME session identifiers were drawn from a process-global static counter, exposing a persistent, cross-instance value to script. CDMInstanceSessionClearKey::requestLicense assigned each Encrypted Media session an ID from static uint32_t s_sessionIdValue, incremented on every license request across ALL CDM instances and origins. The resulting session.sessionId (readable by the page) is therefore a monotonic, process-wide value that persists across MediaKeys instances and browsing contexts, letting a site correlate or fingerprint a user — including across isolation boundaries such as private browsing — by observing the counter.

The fix scopes the counter to the parent CDM instance: CDMInstanceClearKey gains a per-instance member m_nextSessionIdValue and getNextSessionIdValue(), and requestLicense uses protectedParentInstance()->getNextSessionIdValue() (or an empty string if there is no parent), so session IDs restart per instance and no longer leak a global sequence.

The restored invariant is that session identifiers are scoped to their CDM instance rather than a global counter. The regression test creates two MediaKeys instances and checks each yields session IDs 0 and 1 (not a continuing global sequence).

Key insight
ClearKey session IDs came from a process-global static counter, so the script-visible sessionId persisted and incremented across instances and contexts; scoping the counter per CDM instance removes the cross-context tracking signal.

Attack Path

  1. Create EME sessions Use ClearKey EME (requestMediaKeySystemAccess org.w3.clearkey) and create media key sessions.
  2. Read session.sessionId Observe the session ID, which pre-patch came from a global static counter.
  3. Correlate across contexts Because the counter is process-global and monotonic, its value persists across MediaKeys instances and browsing contexts.
  4. Track the user Use the persistent, increasing ID to correlate visits / fingerprint the user, including in private browsing.

Impact Assessment

A privacy/tracking issue in the WebContent process with no memory corruption: a global session-ID counter leaked a persistent, cross-instance value usable to track users, including in Safari private browsing. The impact is correlation/deanonymization rather than code execution.

Changed Functions

FunctionChangeNotes
CDMInstanceSessionClearKey::requestLicense
Source/WebCore/platform/encryptedmedia/clearkey/CDMClearKey.cpp
modified Derives the session ID from the parent instance's per-instance counter (getNextSessionIdValue) instead of a process-global static, using an empty string when there is no parent.
CDMInstanceClearKey::getNextSessionIdValue / m_nextSessionIdValue
Source/WebCore/platform/encryptedmedia/clearkey/CDMClearKey.h
modified Adds a per-instance session-ID counter so IDs are scoped to the CDM instance.

Files Changed

  • LayoutTests/http/tests/media/clearkey/clear-key-session-id-expected.txt
  • LayoutTests/http/tests/media/clearkey/clear-key-session-id.html
  • Source/WebCore/platform/encryptedmedia/clearkey/CDMClearKey.cpp
  • Source/WebCore/platform/encryptedmedia/clearkey/CDMClearKey.h

Audit Directions

  • Global counters exposed to script
    Grep the EME/CDM code (and other platform modules) for static counters/IDs whose values are exposed to web content and can persist across instances/origins.
  • Session/identifier scoping
    Audit identifier generation (session IDs, request IDs) to confirm they are scoped to an instance/origin rather than process-global.

Original Bug Report

The reporter's bug is still restricted on the tracker.