← WebKit Silent-Fix Report — 2026-W21
97721a8704 Cross-origin XMLHttpRequest triggers additional extension permissions request
severity low
class CrossOrigin
confidence 0.55
WebKit WebExtensions
Primitive: CORS-failed XHR triggers permission prompt for arbitrary cross-origin URL
Triage note: Previously any cross-origin XHR/Fetch CORS failure could drive a permission-to-access-URL request regardless of origin, a permission-scope issue.
Triage note: Previously any cross-origin XHR/Fetch CORS failure could drive a permission-to-access-URL request regardless of origin, a permission-scope issue.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…