← WebKit Silent-Fix Report — 2026-W23
f8acb9cb819c1f8ae56c81b5e5076403a6b12a5b Cherry pick 305413.672@safari-7624-branch (4fcd36e3a363)
severity medium
class CrossOrigin
confidence 0.55
WebKit Site Isolation
Primitive: WebProcessProxy origin-commit tracking for remote-worker processes
Triage note: hasCommittedClientOrigin assumed a single m_site for worker processes (ASSERT(m_site)); fix tracks a HashSet m_committedSites populated on worker creation, provisional load, and site-isolation use, so origin-commit checks for processes hosting multiple sites are correct, a process/origin-isolation integrity fix.
Triage note: hasCommittedClientOrigin assumed a single m_site for worker processes (ASSERT(m_site)); fix tracks a HashSet m_committedSites populated on worker creation, provisional load, and site-isolation use, so origin-commit checks for processes hosting multiple sites are correct, a process/origin-isolation integrity fix.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…