`0a6b5cd60b` [Site Isolation] Route popup menu value-changed IPC to the originating frame

severity low class LogicError confidence 0.45 WebKit UIProcess / Site Isolation

Zak Ridouh Mon May 18 17:58:33 2026 -0700 full: 0a6b5cd60b4f57cd24ce6131b0a40a0201d67a47 bug report ↗ view on GitHub ↗

Primitive: popup-menu IPC routed to wrong frame; index bounds
Triage note: Site-isolation IPC routing + bounds check; mild safety relevance.

Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.

Before / after

Loading diff…