← WebKit — 2026-W35
e88c8b010e7f325019231b36d6031c41462c5ee8 BroadcastChannel cross-origin spoof
severity medium
class CrossOrigin
confidence 0.8
signal score 6.5
Source/WebKit/NetworkProcess
patch-now
Primitive: Missing origin-to-connection authorization lets a web process register/post BroadcastChannel for origins it cannot access
Triage note: Same NetworkBroadcastChannelRegistry fix as e1706a288fb5 (variant using webProcessConnection and also checking !name.isNull()): adds isOriginAllowedForConnection() MESSAGE_CHECK to registerChannel/unregisterChannel/postMessage so a web process cannot drive cross-origin broadcast channels in the network process.
Triage note: Same NetworkBroadcastChannelRegistry fix as e1706a288fb5 (variant using webProcessConnection and also checking !name.isNull()): adds isOriginAllowedForConnection() MESSAGE_CHECK to registerChannel/unregisterChannel/postMessage so a web process cannot drive cross-origin broadcast channels in the network process.
Structural signals: smartptr_member_added (+3.0), null_guard (+1.2), msg_soft (+1.0), surgical (+1.3)
Commit message
BroadcastChannel cross-origin spoof
rdar://172230453
Reviewed by Charlie Wolfe.
A compromised web content process can send a malicious message to the Networking process
to register for broadcast channel messages it should not have access to.
This adds message checks to validate that the IPC::Connection these messages are
coming from has access to the top security origin claimed.
Tests: Tools/TestWebKitAPI/Tests/WebKitCocoa/BroadcastChannelOriginSpoof.mm
* Source/WebKit/NetworkProcess/NetworkBroadcastChannelRegistry.cpp:
(WebKit::NetworkBroadcastChannelRegistry::isOriginAllowedForConnection const):
(WebKit::NetworkBroadcastChannelRegistry::registerChannel):
(WebKit::NetworkBroadcastChannelRegistry::unregisterChannel):
(WebKit::NetworkBroadcastChannelRegistry::postMessage):
* Source/WebKit/NetworkProcess/NetworkBroadcastChannelRegistry.h:
* Source/WebKit/NetworkProcess/NetworkProcess.cpp:
(WebKit::NetworkProcess::allowsFirstPartyForCookies): Remove an unnecessary ASSERT that prevents
this from being tested in the debug configuration.
* Tools/TestWebKitAPI/Tests/WebKitCocoa/NetworkProcess.mm:
(-[BroadcastChannelSpoofMessageHandler userContentController:didReceiveScriptMessage:]):
((NetworkProcess, BroadcastChannelOriginSpoof)):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/PasteHTML.mm:
Originally-landed-as: 305413.560@safari-7624-branch (e1706a288fb5). rdar://185459196
Canonical link: https://commits.webkit.org/319914@main
Before / after
Loading diff…
On This Page