← WebKit — 2026-W36
bd4ce6001e93131ec13bdeb5434ae4deab2c2718 [Site Isolation] Don't use crashed processes in BrowsingContextGroup
severity medium
class PolicyBypass
confidence 0.5
signal score 11.42
Source/WebKit/UIProcess
Primitive: a terminated shared WebContent process could be reused to host a new site under site isolation
Triage note: Introduces liveSharedProcess()/clearSharedProcess so a State::Terminated shared process is dropped instead of reused in sharedProcessForSite/ensureProcessForSite/processForSite, removeFrameProcess only clears when it owns the process, and resetStateAfterProcessExited clears processInheritedFromOpener. Site-isolation process-lifetime hardening; no concrete memory-safety primitive shown.
Triage note: Introduces liveSharedProcess()/clearSharedProcess so a State::Terminated shared process is dropped instead of reused in sharedProcessForSite/ensureProcessForSite/processForSite, removeFrameProcess only clears when it owns the process, and resetStateAfterProcessExited clears processInheritedFromOpener. Site-isolation process-lifetime hardening; no concrete memory-safety primitive shown.
Structural signals: smartptr_member_added (+6.47), security_assert (+3.0), null_guard (+1.95)
Commit message
[Site Isolation] Don't use crashed processes in BrowsingContextGroup
https://bugs.webkit.org/show_bug.cgi?id=322868
rdar://186115818
Reviewed by Sihui Liu and Per Arne Vollan.
BrowsingContextGroup returns potentially terminated processes in both sharedProcessForSite and
processForSite. Fix this by not handing back terminated processes.
Test: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm
* Source/WebKit/UIProcess/BrowsingContextGroup.cpp:
(WebKit::BrowsingContextGroup::sharedProcessForSite):
(WebKit::BrowsingContextGroup::ensureProcessForSite):
(WebKit::BrowsingContextGroup::liveSharedProcess):
(WebKit::BrowsingContextGroup::clearSharedProcess):
(WebKit::BrowsingContextGroup::processForSite):
(WebKit::BrowsingContextGroup::processDidTerminate):
(WebKit::BrowsingContextGroup::removeFrameProcess):
* Source/WebKit/UIProcess/BrowsingContextGroup.h:
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::resetStateAfterProcessExited):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:
(TestWebKitAPI::(SiteIsolation, SharedProcessNotReusedAfterCrash)):
(TestWebKitAPI::(SiteIsolation, SharedProcessMainFrameNotReusedAfterCrash)):
(TestWebKitAPI::(SiteIsolation, SharedProcessShutsDownWhenLastRemoteFrameIsRemoved)):
Canonical link: https://commits.webkit.org/320297@main
Before / after
Loading diff…
On This Page