PatchGap
← WebKit — 2026-W38

1577f67ea06b70f3d37704a9c77475fb79cb2040  REGRESSION(305529@main): updateMouseEventTargetAfterWindowAndViewFramesChanged Sends ungated [NSEvent mouseLocation] to web content process

severity medium class InfoDisclosure confidence 0.66 signal score 6.5 Source/WebKit/UIProcess patch-now
view commit ↗
Primitive: global cursor screen location leaked to web content when window unfocused or cursor outside view
Triage note: RC_REMOVE_SEC_ACCEL_3 brackets the fix in updateMouseEventTargetAfterWindowAndViewFramesChanged (mac): old code unconditionally reported [NSEvent mouseLocation]; the #else fix returns early unless the window isKeyWindow and the cursor is within rootViewToScreen(viewSize), gating disclosure of the global cursor position. Real cross-window info leak reachable by web content; RC macro marker weights it.
Structural signals: smartptr_member_added (+3.0), uaf_lifetime (+2.2), surgical (+1.3)

Commit message

REGRESSION(305529@main): updateMouseEventTargetAfterWindowAndViewFramesChanged Sends ungated [NSEvent mouseLocation] to web content process
https://bugs.webkit.org/show_bug.cgi?id=323256
rdar://183491292

Reviewed by Abrar Rahman Protyasha.

 WebPageProxy::updateMouseEventTargetAfterWindowAndViewFramesChanged read the process-global
 [NSEvent mouseLocation] and sent it back to the web content process unconditionally. This
 patch adds a check to ensure the window is the key window and the cursor is within the view
 before retrieving [NSEvent mouseLocation].

  Tests: TestWebKitAPI.MouseEventTests.WindowChangeShouldCauseMouseLeaveEvent
         TestWebKitAPI.MouseEventTests.WindowChangeShouldNotCauseMouseLeaveEvent
         sar3/ipc/update-mouse-event-target-does-not-leak-global-cursor-position.html

  The first two are pre-existing API tests covering the behavior this code was originally written
  for (305529@main) and confirm this change doesn't regress it. The layout test is new and covers
  the fix itself: that the cursor position is not disclosed while it's outside the view.

* LayoutTests/sar3/ipc/update-mouse-event-target-does-not-leak-global-cursor-position-expected.txt: Added.
* LayoutTests/sar3/ipc/update-mouse-event-target-does-not-leak-global-cursor-position.html: Added.
* Source/WebKit/UIProcess/mac/WebPageProxyMac.mm:
(WebKit::WebPageProxy::updateMouseEventTargetAfterWindowAndViewFramesChanged):
(WebKit::WebPageProxy::windowAndViewFramesChanged):
* Source/WebKit/UIProcess/WebPageProxy.h:
* Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm:
(WebKit::WebPageProxy::updateMouseEventTargetAfterWindowAndViewFramesChanged):

Identifier: 316606.732@safari-7625-branch

Before / after

Loading diff…
On This Page