← WebKit Silent-Fix Report — 2026-W21
774fe6ba2f Unreviewed, reverting 312738@main.
severity medium
class Bypass
confidence 0.55
WebCore History (sandbox/unique origin)
Primitive: pushState path change in unique/sandboxed origin
Triage note: Reverting the earlier relaxation re-enforces the same-document/path restriction for sandboxed and opaque-origin documents, a history-URL spoofing guard.
Triage note: Reverting the earlier relaxation re-enforces the same-document/path restriction for sandboxed and opaque-origin documents, a history-URL spoofing guard.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…