← WebKit — 2026-W38
2df02878fefcbd666fb0a2812c851a9558b0d805 Replace history when navigating an initial about:blank subframe
severity medium
class Spoofing
confidence 0.45
signal score 9.37
Source/WebCore/loader
Primitive: subframe initial about:blank navigation creating a new back/forward item
Triage note: NavigationScheduler::mustLockBackForwardList now returns Yes for a child frame whose documentLoader isInitialAboutBlank. Locks the back/forward list for initial about:blank subframes, a history-manipulation/spoofing-relevant correctness fix, but no memory-safety primitive and modest confidence it is a security fix versus history correctness.
Triage note: NavigationScheduler::mustLockBackForwardList now returns Yes for a child frame whose documentLoader isInitialAboutBlank. Locks the back/forward list for initial about:blank subframes, a history-manipulation/spoofing-relevant correctness fix, but no memory-safety primitive and modest confidence it is a security fix versus history correctness.
Structural signals: smartptr_member_added (+4.87), null_guard (+1.2), area:Source/WebCore/loader (+2.0), surgical (+1.3)
Commit message
Replace history when navigating an initial about:blank subframe
https://bugs.webkit.org/show_bug.cgi?id=324079
rdar://187298226
Reviewed by Rupin Mittal.
Per the HTML navigation spec, history handling must be "replace" when the target's active document
is still the initial about:blank document.
https://html.spec.whatwg.org/multipage/browsing-the-web.html#navigate
FrameLoader::continueLoadURLIntoChildFrame() already does this for a frame's initial src load, but
NavigationScheduler otherwise relies on the "onload has not been dispatched yet" heuristic.
Make NavigationScheduler::mustLockBackForwardList() lock the back/forward list whenever the target
is a subframe whose document loader is still for the initial about:blank document, independent of
onload.
* LayoutTests/contentfiltering/block-after-add-data-expected.txt:
* LayoutTests/contentfiltering/block-after-add-data-then-allow-unblock-expected.txt:
* LayoutTests/contentfiltering/block-after-add-data-then-deny-unblock-expected.txt:
* LayoutTests/contentfiltering/block-after-finished-adding-data-expected.txt:
* LayoutTests/contentfiltering/block-after-finished-adding-data-then-allow-unblock-expected.txt:
* LayoutTests/contentfiltering/block-after-finished-adding-data-then-deny-unblock-expected.txt:
* LayoutTests/contentfiltering/block-after-response-expected.txt:
* LayoutTests/contentfiltering/block-after-response-then-allow-unblock-expected.txt:
* LayoutTests/contentfiltering/block-after-response-then-deny-unblock-expected.txt:
* LayoutTests/contentfiltering/block-after-will-send-request-expected.txt:
* LayoutTests/contentfiltering/block-after-will-send-request-then-allow-unblock-expected.txt:
* LayoutTests/contentfiltering/block-after-will-send-request-then-deny-unblock-expected.txt:
* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/initial-empty-document/iframe-nosrc-expected.txt:
* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/initial-empty-document/iframe-src-204-fragment-expected.txt:
* Source/WebCore/loader/NavigationScheduler.cpp:
(WebCore::NavigationScheduler::mustLockBackForwardList):
Canonical link: https://commits.webkit.org/321285@main
Before / after
Loading diff…
On This Page