← WebKit Silent-Fix Report — 2026-W23

f8acb9cb819c1f8ae56c81b5e5076403a6b12a5b  Cherry pick 305413.672@safari-7624-branch (4fcd36e3a363)

severity medium class CrossOrigin confidence 0.55 WebKit Site Isolation
Ryosuke Niwa Thu Jun 4 21:57:40 2026 -0700 full: f8acb9cb819c1f8ae56c81b5e5076403a6b12a5b bug report ↗ view on GitHub ↗
Primitive: WebProcessProxy origin-commit tracking for remote-worker processes
Triage note: hasCommittedClientOrigin assumed a single m_site for worker processes (ASSERT(m_site)); fix tracks a HashSet m_committedSites populated on worker creation, provisional load, and site-isolation use, so origin-commit checks for processes hosting multiple sites are correct, a process/origin-isolation integrity fix.

Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.

Before / after

Loading diff…