← WebKit — 2026-W39
d0321d4e6eec17a325ca9fe4665525dd5e0df5c3 [Site Isolation] Transcoded images chosen in a cross-site iframe's open panel go to the main frame's process
severity low
class AuthorizationError
confidence 0.4
signal score 6.05
Source/WebKit/UIProcess
Primitive: open-panel file sandbox extensions/approved-URLs granted to the wrong (main-frame) process under site isolation
Triage note: didChooseFilesForOpenPanelWithImageTranscoding now threads the actual requesting WebProcessProxy instead of legacyMainFrameProcess(), so addPreviouslyApprovedFileURL, ExtendSandboxForFilesFromOpenPanel and AllowFilesAccessFromWebProcess target the process that opened the panel. Fixes file-access grant going to the wrong process with site isolation; correctness/authorization, but no concrete attacker-reachable exploit shown.
Triage note: didChooseFilesForOpenPanelWithImageTranscoding now threads the actual requesting WebProcessProxy instead of legacyMainFrameProcess(), so addPreviouslyApprovedFileURL, ExtendSandboxForFilesFromOpenPanel and AllowFilesAccessFromWebProcess target the process that opened the panel. Fixes file-access grant going to the wrong process with site isolation; correctness/authorization, but no concrete attacker-reachable exploit shown.
Structural signals: uaf_lifetime (+4.75), surgical (+1.3)
Commit message
[Site Isolation] Transcoded images chosen in a cross-site iframe's open panel go to the main frame's process
https://bugs.webkit.org/show_bug.cgi?id=324916
rdar://188138794
Reviewed by Alex Christensen.
On macOS, when a file chosen in an open panel is an image type the input does not accept, WebPageProxy
transcodes it before handing it to the page. That path granted file access to, and sent the files to, the
main frame's process. Under Site Isolation, an input in a cross-site iframe lives in another process, so
the iframe never received its files. That process also kept its open panel listener, so its file inputs
could not open another panel.
Pass the process that opened the panel into didChooseFilesForOpenPanelWithImageTranscoding and use it, as
the path without transcoding already does.
Test: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::didChooseFilesForOpenPanelWithImageTranscoding):
(WebKit::WebPageProxy::didChooseFilesForOpenPanel):
* Source/WebKit/UIProcess/WebPageProxy.h:
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:
(TestWebKitAPI::TEST(SiteIsolation, OpenPanelTranscodedImageReachesCrossOriginIframe)):
Canonical link: https://commits.webkit.org/321925@main
Before / after
Loading diff…
On This Page