← WebKit Silent-Fix Report — 2026-W34
7d09127ca947791dc0a72109466a9b0433ab898e Return a digest instead of the Cookie header for Vary: Cookie validation
severity medium
class CrossOrigin
confidence 0.55
CookieJar / Vary:Cookie validation
Primitive: Send cookie digest instead of raw Cookie header to web process for Vary validation
Triage note: Adds cookieRequestHeaderFieldValueDigest returning a SHA1 digest so WebKit2 can compare header values 'without sending the header to a web process', closing a cross-process cookie disclosure to the untrusted content process.
Triage note: Adds cookieRequestHeaderFieldValueDigest returning a SHA1 digest so WebKit2 can compare header values 'without sending the header to a web process', closing a cross-process cookie disclosure to the untrusted content process.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…