← WebKit — 2026-W37
a37a6505759f8bb5f420ccc45828d1f62ae4b8c4 Popunder bypass via overlappping transient activations
severity low
class Spoofing
confidence 0.5
signal score 8.17
Source/WebCore/loader
Primitive: A page could focus/raise a named target window via createWindow() without a transient user activation.
Triage note: createWindow() now requires openerWindow->hasTransientActivation() before page->chrome().focus() on an existing named frame. Gates focus-stealing behind a user gesture; a UI/activation policy fix, not memory safety.
Triage note: createWindow() now requires openerWindow->hasTransientActivation() before page->chrome().focus() on an existing named frame. Gates focus-stealing behind a user gesture; a UI/activation policy fix, not memory safety.
Structural signals: smartptr_member_added (+4.87), area:Source/WebCore/loader (+2.0), surgical (+1.3)
Commit message
Popunder bypass via overlappping transient activations
https://bugs.webkit.org/show_bug.cgi?id=316816
rdar://177442177
Reviewed by Charlie Wolfe and Abrar Rahman Protyasha.
We should require a transient activation before focusing an existing named
window, to avoid popunders.
The original change consumed the activation. Consuming it is wrong on main:
311026@main made window.open() consume user activation only when it creates a
new browsing context, per "the rules for choosing a navigable", and consuming
here regresses
imported/w3c/web-platform-tests/html/browsers/windows/consume-user-activation/window-open.html.
Requiring the activation without consuming it blocks the popunder just the
same, because the popup's window never has a transient activation of its own:
activation propagates only to ancestor frames and same-origin descendants
within a frame tree, never across top-level windows.
Test: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/VerifyUserGestureFromUIProcess.mm
* Source/WebCore/loader/FrameLoader.cpp:
(WebCore::createWindow):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/VerifyUserGestureFromUIProcess.mm:
(TestWebKitAPI::TEST(VerifyUserGesture, PopunderPreventedViaDualEventListeners)):
Originally-landed-as: [email protected] (2057f457fb75). rdar://184745106
Canonical link: https://commits.webkit.org/320881@main
Before / after
Loading diff…
On This Page