← WebKit — 2026-W37
173261c80c9adef54161b4f821af8404ccdcc827 Validate transient user activation in UIProcess for async clipboard reads
severity medium
class PolicyBypass
confidence 0.72
signal score 7.47
Source/WebKit/UIProcess
patch-now
Primitive: compromised WebContent process forging transient activation to obtain clipboard paste access via requestDOMPasteAccess
Triage note: Adds UIProcess-side transient-activation tracking (WebFrameProxy::notifyActivated/hasTransientActivation driven by mouse/key/touch events) and makes WebPageProxy::requestDOMPasteAccess reject when !frame->hasTransientActivation(). Comment states this stops a compromised WebContent process from bypassing the WebCore-side gesture check by calling the IPC directly.
Triage note: Adds UIProcess-side transient-activation tracking (WebFrameProxy::notifyActivated/hasTransientActivation driven by mouse/key/touch events) and makes WebPageProxy::requestDOMPasteAccess reject when !frame->hasTransientActivation(). Comment states this stops a compromised WebContent process from bypassing the WebCore-side gesture check by calling the IPC directly.
Structural signals: smartptr_member_added (+6.47), msg_soft (+1.0)
Commit message
Validate transient user activation in UIProcess for async clipboard reads
https://bugs.webkit.org/show_bug.cgi?id=314886
rdar://177152667
Reviewed by Ryosuke Niwa.
Follow-up to 305413.908@safari-7624-branch, which added a WebCore-side
transient activation check to navigator.clipboard.readText() / read(). That
check is bypassable by a compromised WebContent process that calls the
RequestDOMPasteAccess IPC directly with a fabricated activation claim.
Mirror the spec's transient activation tracking
(LocalDOMWindow::notifyActivated, LocalDOMWindow::hasTransientActivation) in
the UIProcess so the UIProcess can independently verify that the requesting
frame really is activated:
- WebFrameProxy gains m_lastActivationTimestamp, notifyActivated(), and
hasTransientActivation(). notifyActivated() propagates the timestamp to
ancestor frames (any origin) and same-origin descendant frames, matching
the HTML spec's activation notification algorithm.
- The four input-event entry points in WebPageProxy
(sendMouseEvent / sendKeyEvent / sendPreventableTouchEvent /
sendUnpreventableTouchEvent) now call WebFrameProxy::notifyActivated for
activation-triggering events on the target frame. The pre-existing
page-level lastActivationTimestamp updates remain; they serve a different
heuristic.
- WebPageProxy::requestDOMPasteAccess rejects with DeniedForGesture if the
requesting WebFrameProxy does not have transient activation. A compromised
WebContent process can no longer get past this gate.
- WebFrameProxy::didCommitLoad resets m_lastActivationTimestamp so a new
document does not inherit activation from the previous one (matches
LocalDOMWindow::consumeLastActivationIfNecessary semantics).
* Source/WebKit/UIProcess/WebFrameProxy.cpp:
(WebKit::WebFrameProxy::didCommitLoad):
(WebKit::WebFrameProxy::notifyActivated):
(WebKit::WebFrameProxy::propagateActivationToSameOriginDescendants):
(WebKit::WebFrameProxy::hasTransientActivation const):
(WebKit::WebFrameProxy::securityOrigin const):
* Source/WebKit/UIProcess/WebFrameProxy.h:
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::sendMouseEvent):
(WebKit::WebPageProxy::sendKeyEvent):
(WebKit::WebPageProxy::sendPreventableTouchEvent):
(WebKit::WebPageProxy::sendUnpreventableTouchEvent):
(WebKit::WebPageProxy::requestDOMPasteAccess):
Originally-landed-as: 305413.928@safari-7624-branch (6e4e21af9c2e). rdar://184744416
Canonical link: https://commits.webkit.org/320639@main
Before / after
Loading diff…
On This Page