Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 26556dce7408f596727c3ed63f6eb0bd15c49bbb
https://github.com/WebKit/WebKit/commit/26556dce7408f596727c3ed63f6eb0bd15c49bbb
Author: Marcos Caceres <[email protected]>
Date: 2026-10-05 (Mon, 05 Oct 2026)
Changed paths:
A LayoutTests/ipc/digital-credentials-chooser-frame-check-expected.txt
A LayoutTests/ipc/digital-credentials-chooser-frame-check.html
M LayoutTests/platform/glib/TestExpectations
M Source/WebKit/UIProcess/WebPageProxy.cpp
Log Message:
-----------
Digital Credentials: derive request origins from trusted UI-process state
https://bugs.webkit.org/show_bug.cgi?id=319453
rdar://problem/182265208
Reviewed by Chris Dumez.
WebPageProxy::showDigitalCredentialsChooser presented the credential chooser
using the WebContent-supplied origins in requestData, which a compromised
WebContent process controls.
Resolve the requesting frame from the IPC frame identifier, reject the request
if it names no frame in this page, and message-check that the IPC came from
that frame's process. Derive the top-level and requesting origins from the UI
process's trusted frame state and sanitize requestData with them before
presenting the chooser, so a compromised process can no longer forge the
origins the chooser relies on.
Originally-landed-as: 316606.155@safari-7625-branch (bb4d1e92ad74).
rdar://187506830
Canonical link: https://commits.webkit.org/322721@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
