← WebKit — 2026-W39

dfaf47f5fc32144022168314298a7f2ca6707102  [Site Isolation] [iOS] Pointer events from touch input have incorrect screen coordinates

not a security fix confidence 0.2 signal score 10.12 Source/WebCore/dom
Classified as not security-relevant.
Triage note: Adds MouseEvent::screenLocationForTouchAtIndex to map an iOS touch location up through remote ancestor frames (convertToRootViewAcrossIsolatedFrames) so screenX/screenY for touch-driven Mouse/PointerEvents in a cross-origin iframe are in the top-level root view. Coordinate correctness under site isolation (the PointerEvent change also uses view.copyRef() to avoid a use-after-move given unspecified arg eval order, but that is in the newly added code). No attacker-reachable memory-safety/security bug.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Structural signals: smartptr_member_added (+4.87), null_guard (+1.95), area:Source/WebCore/dom (+2.0), surgical (+1.3)

Before / after

Loading diff…
On This Page