AuthBypass
34 commits
Missing or incorrect authorization check — IPC handler trusts client identifier, permission not enforced.
2026-W32 2026-08-08 – 14
2026-W28 2026-07-11 – 17
2026-W27 2026-07-04 – 10
2026-W26 2026-06-27 – 07-03
- [WebKit Process Model] missing MESSAGE_CHECK_URL on error.failingURL() in WebPageProxy::didFailLoadForFrame
- Restrict ability for Network process to load files from temp directory
- Only allow sending to _WKRemoteObjectRegistry of a page in the sending process
- [WebKit Process Model] WebPageProxy::createNewPage missing hasGrantedSandboxExtensionForFile check on NavigationActionData.request httpBody
- Remove blanket storage-root file path allow from blob access enforcement
- Missing validation of frameInfo in WebFrameProxy::getFrameInfo()
- Cherry-pick 95c175bca8d0. rdar://176570738
- [WebKit Process Model | All] isDisallowedTypeForReadBuffer uses case-sensitive isEqualToString: while UIPasteboard resolves type identifiers case-insensitively; readString has no gate
- [SharedWorker] Add MESSAGE_CHECK to establishSharedWorkerContextConnection
- Cherry-pick 343f135c4791. rdar://175672573
- Missing allowsFirstPartyForCookies check in loadPing() IPC may lead to cross-origin cookie access
- Unvalidated replacementPath in NetworkConnectionToWebProcess::registerInternalFileBlobURL() could lead to wrongful file deletion
- Validate several ITP and storage access IPC messages
- Need a process-specific `WebBackForwardListItem::allItems()` instead of the process-global map for better message checking
- [IndexedDB] IDBKeyData validation on CoreIPC should reject invalid key types
- [WebKit Process Model] missing sender-ownership validation in 12 process-global identifier-map lookups
2026-W25 2026-06-20 – 26
2026-W24 2026-06-13 – 19
- Message check security origin during webauthn calls
- GetPasteboardPathnamesForType IPC allows types-only pasteboard access to read file paths
- Gate InstallMockContentFilter IPC behind AllowTestOnlyIPC
2026-W23 2026-06-06 – 12
- Gate AddOriginAccessAllowListEntry IPC behind AllowTestOnlyIPC
2026-W22 2026-05-30 – 06-05
- Compromised web content process unauthorized access to pending MessagePort messages
- Bad IPC from WebProcess could cause UIProcess to crash in WebPermissionControllerProxy::mostReasonableWebPageProxy()
2026-W21 2026-05-23 – 29
- Cross-Process Page Identity Confusion in didPostMessage
- SpeechRecognition ASSERT Instead of MESSAGE_CHECK for Duplicate Client
- CreateModelPlayer Uses ASSERT Instead of MESSAGE_CHECK for Duplicate Identifier
- RELEASE_ASSERT in NetworkConnectionToWebProcess::scheduleResourceLoad() can be abused
- IndexedDB Connection/Transaction Identifier Confusion