← WebKit — 2026-W38
1b1d1e50831f4d0529ff51174268e974efd3b93d imported/w3c/web-platform-tests/content-security-policy/inheritance/history.sub.html is a flaky failure
severity medium
class UAF
confidence 0.4
signal score 6.3
Source/WebCore/loader
Primitive: reusing an already-committed provisional DocumentLoader on a failed back/forward cache restore
Triage note: FrameLoader::continueLoadAfterNavigationPolicy, on the BFCache-restore-failed path, now restarts the load with a fresh document loader when provisionalItem and a committed m_provisionalDocumentLoader exist (setProvisionalDocumentLoader(nullptr) + loadDifferentDocumentItem). Fixes a committed-loader state confusion that could be security-relevant, but the diff gives no concrete exploit primitive.
Triage note: FrameLoader::continueLoadAfterNavigationPolicy, on the BFCache-restore-failed path, now restarts the load with a fresh document loader when provisionalItem and a committed m_provisionalDocumentLoader exist (setProvisionalDocumentLoader(nullptr) + loadDifferentDocumentItem). Fixes a committed-loader state confusion that could be security-relevant, but the diff gives no concrete exploit primitive.
Structural signals: smartptr_member_added (+3.0), area:Source/WebCore/loader (+2.0), surgical (+1.3)
Commit message
imported/w3c/web-platform-tests/content-security-policy/inheritance/history.sub.html is a flaky failure
https://bugs.webkit.org/show_bug.cgi?id=324092
rdar://187312421
Reviewed by Rupin Mittal.
loadDifferentDocumentItem() reuses the cached page's DocumentLoader when the target history item is
in the back/forward cache, then checks the navigation policy asynchronously. If the CachedPage is
evicted while that check is in flight continueLoadAfterNavigationPolicy() falls through to a normal
network load still holding that loader. It has already been committed, so commitIfReady() and
commitData() both no-op. The resource loads fine, but no document is ever created, leaving the
navigation hung.
Restart the item with a fresh DocumentLoader instead. The client has already decided this
navigation's policy, so pass PolicyAlreadyDecided::Yes to avoid a second round trip.
This is why imported/w3c/web-platform-tests/content-security-policy/inheritance/history.sub.html was
flaky. Its six concurrent popups push enough pages into the back/forward cache to prune each other's
entries mid-navigation.
* Source/WebCore/loader/FrameLoader.cpp:
(WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
Canonical link: https://commits.webkit.org/321286@main
Before / after
Loading diff…
On This Page