Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 3d2439c6be9dfd48aeb1244699def19ca0f678ac
https://github.com/WebKit/WebKit/commit/3d2439c6be9dfd48aeb1244699def19ca0f678ac
Author: Zak Ridouh <[email protected]>
Date: 2026-08-04 (Tue, 04 Aug 2026)
Changed paths:
M Source/WebKit/Shared/RemoteLayerTree/RemoteLayerTree.serialization.in
M Source/WebKit/Shared/RemoteLayerTree/RemoteLayerTreeTransaction.h
M Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeHost.h
M Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeHost.mm
M Source/WebKit/UIProcess/RemoteLayerTree/ios/RemoteLayerTreeHostIOS.mm
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/UIProcess/WebPageProxy.h
M Source/WebKit/UIProcess/WebPageProxy.messages.in
M Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeContext.mm
M Source/WebKit/WebProcess/WebPage/WebPage.cpp
Log Message:
-----------
[Site
Isolation] Don't send process-qualified media identifiers in the layer tree or
text recognition
https://bugs.webkit.org/show_bug.cgi?id=320695
rdar://183678033
Reviewed by Charlie Wolfe.
RemoteLayerTreeTransaction's VideoElementData and
WebPageProxy::BeginTextRecognitionForVideoInElementFullScreen both send a
process-qualified PlaybackSessionContextIdentifier from the web process. Under
site isolation both are reachable from a subframe process, so a compromised one
could name a media element belonging to another process and reach that process's
entry in VideoPresentationManagerProxy's context map, or overlay a fullscreen
video it does not own.
Send a bare WebCore::MediaPlayerClientIdentifier in both cases and pair it in
the
UI process with the process identifier of the sending connection, so a foreign
process identifier is unrepresentable rather than checked.
RemoteLayerTreeHost::updateLayerTree already receives the IPC::Connection; it is
now threaded through
createLayer() to makeNode(), which has separate mac and iOS
definitions.
* Source/WebKit/Shared/RemoteLayerTree/RemoteLayerTree.serialization.in:
* Source/WebKit/Shared/RemoteLayerTree/RemoteLayerTreeTransaction.h:
* Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeHost.h:
* Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeHost.mm:
(WebKit::RemoteLayerTreeHost::updateLayerTree):
(WebKit::RemoteLayerTreeHost::createLayer):
(WebKit::RemoteLayerTreeHost::makeNode):
* Source/WebKit/UIProcess/RemoteLayerTree/ios/RemoteLayerTreeHostIOS.mm:
(WebKit::RemoteLayerTreeHost::makeNode):
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::beginTextRecognitionForVideoInElementFullScreen):
* Source/WebKit/UIProcess/WebPageProxy.h:
* Source/WebKit/UIProcess/WebPageProxy.messages.in:
* Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeContext.mm:
(WebKit::RemoteLayerTreeContext::layerDidEnterContext):
*
Source/WebKit/WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::beginTextRecognitionForVideoInElementFullScreen):
Canonical link:
https://flagged.apple.com:443/proxy?t2=Dd4T8D8KO8&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE4NTgxQG1haW4=&emid=04bc61ac-41c1-4c52-9a4f-5e0957259775&c=11
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
