CrossOrigin
32 commits
Same-origin policy bypass, cross-origin data disclosure, CSP bypass, cookie/storage leak.
2026-W33 2026-08-15 – 21
2026-W32 2026-08-08 – 14
- When captured as a video frame, canvas has to be tainted if cross-origin image are drawn into it
- about:blank inherits cross-origin policy container due to empty document URL
2026-W29 2026-07-18 – 24
2026-W26 2026-06-27 – 07-03
- Cross-Origin Iframe Can Read Clipboard via Top-Level User Interaction in Safari
- [cocoa] _setAllowOnlyPartitionedCookies may not be set on WebSocket requests
- Remove treatAsSameOriginNavigation from NavigationActionData IPC
- [WebKit Networking] continueWillSendRequest m_redirectionForCurrentNavigation early-return reaches Cache::storeRedirect with unrestored cachePartition
- Fire async load event to prevent guessing a cross-origin iframe's URL
- WebGPU importExternalTexture origin-clean bypass in Safari
- [CoreIPC] [NP] CoreIPCNSURLRequest bodyParts Forwarded to CFNetwork Leads to Arbitrary File Exfiltration
- WebResourceLoader::WillSendRequest reply may lead to cross-origin cookie access
2026-W25 2026-06-20 – 26
2026-W24 2026-06-13 – 19
2026-W23 2026-06-06 – 12
- Inherit creating document's CSP for SharedWorkers loaded from headerless URLs
- Fix CSP policy loss in blob: URL inheritance when page sends multiple CSP headers
- Fix CSP 'self' source matching for opaque-origin documents
- Cross origin iframes should not be able to set the app badge.
2026-W22 2026-05-30 – 06-05
- WebKit NetworkProcess: CORS bypass via unvalidated SetCORSDisablingPatterns IPC
- CSP sandbox does not prevent cross-document view transition state transfer
- Add cookie access validation to startDownload() and convertMainResourceLoadToDownload() to prevent CSRF
- rdar://172395438
- App Badge origin spoofing from `window` contexts
- Initiator-omitted samesite classification can lead to SameSite=Strict cookie cross-site leakage
2026-W21 2026-05-23 – 29
- setRawCookie: cookie.domain unvalidated + commentURL crashes NetworkProcess
- Don't log interaction from temporary gesture on storage access rejection
- Audio from SpeechSynthesis may leak to the next page on cross-origin navigation
- didSameDocumentNavigationForFrame accepts arbitrary URL, enabling address bar spoofing
2026-W20 2026-05-16 – 22
- Block third-party cookies for requests from about:blank popups
- Align ContentSecurityPolicySource::pathMatches() with CSP3 spec path matching algorithm