← WebKit Silent-Fix Report — 2026-W34
df8786e8b6a8fabb2ad9574914a4f33117f8950e Enable storage site validation
severity medium
class CrossOrigin
confidence 0.55
NetworkStorageManager site validation
Primitive: Enable per-connection storage site validation
Triage note: Wraps persisted/persist/estimate/quota storage IPC entrypoints in STORAGE_MESSAGE_CHECK verifying isSiteAllowedForConnection, enforcing that a connection may only touch storage for its allowed registrable domain (site-isolation cross-origin hardening).
Triage note: Wraps persisted/persist/estimate/quota storage IPC entrypoints in STORAGE_MESSAGE_CHECK verifying isSiteAllowedForConnection, enforcing that a connection may only touch storage for its allowed registrable domain (site-isolation cross-origin hardening).
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…