CVE-2026-43725
Overview
Background
- loadImageForDecoding
- An IPC path where the renderer asks the Network process to fetch and decode an image, returning the data.
- protocolIsInHTTPFamily
- A check that a URL uses http/https; without it, file:// and other schemes are accepted.
- MESSAGE_CHECK
- A WebKit IPC guard that rejects a malformed/malicious message (and can terminate the sender) when a precondition fails.
Root Cause Analysis
This fixes a local-file-read / SSRF-style sandbox escape in the Network process’s image-decoding load path. NetworkConnectionToWebProcess::loadImageForDecoding (an IPC entry point callable by the WebContent process) validated only url.isValid() before loading the request and returning the bytes for decoding. Because the scheme was not restricted, a compromised WebContent process could send a request with a file:// URL (or another non-HTTP scheme) and have the Network process read that local file and hand its contents back — reading files outside the WebContent sandbox (the test uses file:///private/etc/hosts). It also did not re-check first-party cookie access.
The fix adds two MESSAGE_CHECKs: url.isValid() && url.protocolIsInHTTPFamily() (rejecting file:// and other non-HTTP schemes) and m_networkProcess->allowsFirstPartyForCookies(…) == Allow (enforcing the first-party-for-cookies policy for the request). The sibling UIProcess entry, WebPageProxy::loadAndDecodeImage, likewise adds !request.url().protocolIsInHTTPFamily() to its early rejection.
The restored invariant is that renderer-initiated image-decoding loads are limited to HTTP(S) and honor cookie policy, closing the local-file/cross-boundary read. The regression test drives the IPC directly with a file:// request and expects a MESSAGE_CHECK failure mentioning protocolIsInHTTPFamily.
Attack Path
- Compromise WebContent An attacker with code execution in the WebContent process can send crafted IPC to the Network process.
- Request a file:// URL Send NetworkConnectionToWebProcess::LoadImageForDecoding with a file:///… request that previously only had to be url.isValid().
- Network process reads the file The Network process loads the local file and returns its bytes as image data.
- Exfiltrate outside the sandbox The renderer reconstructs the local file contents it should not have access to — a sandbox escape.
Impact Assessment
Changed Functions
| Function | Change | Notes |
|---|---|---|
NetworkConnectionToWebProcess::loadImageForDecodingSource/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp |
modified | Adds MESSAGE_CHECKs that the URL is valid AND protocolIsInHTTPFamily(), and that allowsFirstPartyForCookies(...)==Allow, rejecting file:// and non-HTTP schemes. |
WebPageProxy::loadAndDecodeImageSource/WebKit/UIProcess/WebPageProxy.cpp |
modified | Extends the early-return guard to also reject requests whose URL is not in the HTTP family. |
Files Changed
LayoutTests/ipc/load-image-for-decoding-file-url-expected.txtLayoutTests/ipc/load-image-for-decoding-file-url.htmlSource/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cppSource/WebKit/UIProcess/WebPageProxy.cpp
Audit Directions
- Same file: renderer-reachable loadsGrep NetworkConnectionToWebProcess for IPC load handlers that check only url.isValid() without protocolIsInHTTPFamily()/scheme allow-listing.
- Scheme validation on IPC URLsAudit UIProcess/NetworkProcess entry points that accept a ResourceRequest from the renderer for file://, data:, and custom-scheme handling and first-party policy checks.