← WebKit Silent-Fix Report — 2026-W34
f76f30efcb689ec60174addc19d38b9150b67c69 [SOUP] An Authorization header set by the page is replaced by cached credentials
severity low
class LogicError
confidence 0.55
SOUP auth credential cache
Primitive: Page-set Authorization header overridden by cached credentials
Triage note: Now sets DO_NOT_USE_AUTH_CACHE when the request already has an Authorization header, preventing cached credentials from replacing page-supplied auth; a credential-handling logic fix.
Triage note: Now sets DO_NOT_USE_AUTH_CACHE when the request already has an Authorization header, preventing cached credentials from replacing page-supplied auth; a credential-handling logic fix.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…