AuthBypass
43 commits
Missing or incorrect authorization check — IPC handler trusts client identifier, permission not enforced.
2026-W40 2026-10-03 – 09
2026-W39 2026-09-26 – 10-02
2026-W38 2026-09-19 – 25
2026-W36 2026-09-05 – 11
- Validate transient user activation in UIProcess for async clipboard reads
2026-W35 2026-08-29 – 09-04
- Validate several ITP and storage access IPC messages
2026-W34 2026-08-22 – 28
- RemoteRenderingBackend can still allocateImageBuffer() with RenderingMode::DisplayList
- BroadcastChannel cross-origin spoof
- Incomplete replacementPath validation in NetworkConnectionToWebProcess::registerInternalFileBlobURL
2026-W32 2026-08-08 – 14
2026-W28 2026-07-11 – 17
2026-W27 2026-07-04 – 10
2026-W26 2026-06-27 – 07-03
- [WebKit Process Model] missing MESSAGE_CHECK_URL on error.failingURL() in WebPageProxy::didFailLoadForFrame
- Restrict ability for Network process to load files from temp directory
- Only allow sending to _WKRemoteObjectRegistry of a page in the sending process
- [WebKit Process Model] WebPageProxy::createNewPage missing hasGrantedSandboxExtensionForFile check on NavigationActionData.request httpBody
- Remove blanket storage-root file path allow from blob access enforcement
- Missing validation of frameInfo in WebFrameProxy::getFrameInfo()
- Cherry-pick 95c175bca8d0. rdar://176570738
- [WebKit Process Model | All] isDisallowedTypeForReadBuffer uses case-sensitive isEqualToString: while UIPasteboard resolves type identifiers case-insensitively; readString has no gate
- Gate CacheStorageRepresentation IPC behind AllowTestOnlyIPC
- [SharedWorker] Add MESSAGE_CHECK to establishSharedWorkerContextConnection
- Cherry-pick 343f135c4791. rdar://175672573
- Missing allowsFirstPartyForCookies check in loadPing() IPC may lead to cross-origin cookie access
- Unvalidated replacementPath in NetworkConnectionToWebProcess::registerInternalFileBlobURL() could lead to wrongful file deletion
- Validate several ITP and storage access IPC messages
- Need a process-specific `WebBackForwardListItem::allItems()` instead of the process-global map for better message checking
- [IndexedDB] IDBKeyData validation on CoreIPC should reject invalid key types
- [WebKit Process Model] missing sender-ownership validation in 12 process-global identifier-map lookups
2026-W25 2026-06-20 – 26
2026-W24 2026-06-13 – 19
- Message check security origin during webauthn calls
- GetPasteboardPathnamesForType IPC allows types-only pasteboard access to read file paths
- Gate InstallMockContentFilter IPC behind AllowTestOnlyIPC
2026-W23 2026-06-06 – 12
- Gate AddOriginAccessAllowListEntry IPC behind AllowTestOnlyIPC
2026-W22 2026-05-30 – 06-05
- Compromised web content process unauthorized access to pending MessagePort messages
- Bad IPC from WebProcess could cause UIProcess to crash in WebPermissionControllerProxy::mostReasonableWebPageProxy()
2026-W21 2026-05-23 – 29
- Cross-Process Page Identity Confusion in didPostMessage
- SpeechRecognition ASSERT Instead of MESSAGE_CHECK for Duplicate Client
- CreateModelPlayer Uses ASSERT Instead of MESSAGE_CHECK for Duplicate Identifier
- RELEASE_ASSERT in NetworkConnectionToWebProcess::scheduleResourceLoad() can be abused
- IndexedDB Connection/Transaction Identifier Confusion