RupinMittal

WebCore security specialist

139 commits (11mo)

8 security fixes

4 hardening

Summary

Primarily works the WebKit/WebCore process-boundary layer — Site Isolation plumbing, IPC message handling in NetworkConnectionToWebProcess and WebResourceLoader, and a steady stream of StabilityTracer crash fixes for invalid-message terminations. The security work is tightly clustered rather than scattered: nearly every flagged fix is a missing `allowsFirstPartyForCookies` check on an IPC entry point (loadPing, WillSendRequest reply, startDownload/convertMainResourceLoadToDownload), with an unvalidated `replacementPath` in `registerInternalFileBlobURL()` alongside it — the same class of bug found repeatedly in adjacent handlers. Systematic-variant candidate: enumerate the remaining NetworkConnectionToWebProcess IPC handlers that take a frame/page identifier or a filesystem path and check which ones still skip origin validation.

Components

WebCore

40%

WebKit

38%

Site Isolation

10%

Platform

WTF

Security Fix History

Hardening Commits

Recent Commits

2026-08-15 [Navigation API] navigation-back-cross-document-preventDefault.html is failing
2026-08-14 [Navigation API] Enable precommit handler by default
2026-08-14 [Navigation API] precommitHandler-traverse.html is failing
2026-08-14 [Navigation API] traverseTo-detach-between-navigate-and-navigatesuccess.html is failing
2026-08-13 [Navigation API] Implement NavigationTransition's to property
2026-08-13 [Navigation API] Implement Precommit Handler
2026-08-12 [Navigation API] SourceElement is the element responsible for the navigation, not the deepest element that was clicked
2026-08-12 [Navigation API] Make NavigationInterceptHandler RefCounted instead of ThreadSafeRefCounted
2026-07-23 StabilityTracer: Crash in WebKit::WebPageProxy::activityStateDidChange
2026-07-20 Random page crashes due to invalid IPC message WebResourceLoader_WillSendRequestReply 2026-W29
2026-07-09 Clean up ENABLE_COOKIE_STORE_API_BY_DEFAULT
2026-07-09 Enable IndexedDBGetAllRecordsAndGetAllOptionsEnabled in Stable
2026-07-07 Web content process gets terminated after loading various sites (invalid message 'NetworkConnectionToWebProcess_LoadImag
2026-07-02 Check httpNavigationWithHTTPSOnlyError without constructing a new one
2026-06-30 Missing allowsFirstPartyForCookies check in loadPing() IPC may lead to cross-origin cookie access ·
2026-06-30 Unvalidated replacementPath in NetworkConnectionToWebProcess::registerInternalFileBlobURL() could lead to wrongful file ·
2026-06-29 WebResourceLoader::WillSendRequest reply may lead to cross-origin cookie access ·
2026-06-19 [Page Loading] WiFi captive popup stuck at blank screen
2026-06-16 StabilityTracer: Crash in WebKit::RemoteAudioVideoRendererProxyManager::ref
2026-06-14 Fix uninitialized member in DOMTimer
2026-06-12 [Site Isolation] Make UserGestureIndicator not require the mainFrameDocument
2026-06-12 [Site Isolation] 2x resourceLoadStatistics/omit-document-referrer* tests are failing
2026-06-11 StabilityTracer: com.apple.WebKit.WebContent at com.apple.WebCore: WebCore::dispatchEventsOnWindowAndFocusedElement
2026-06-11 StabilityTracer: MobileSafari at Received an invalid message 'WebLockRegistryProxy_ClientIsGoingAway'
2026-06-10 [Navigation API] Resync Navigation API WPT tests
2026-06-10 [Site Isolation] REGRESSION(314640@main): [ iOS Debug ] 32x site-isolation (layout-tests) are constant crashes
2026-06-10 [Site Isolation] Make key events attribute user interaction to the top frame's origin
2026-06-10 [Site Isolation] Make logs show if site isolation shared process is enabled
2026-06-05 [Site Isolation] 2x resourceLoadStatistics/exemptDomains* tests are failing
2026-06-05 [Navigation API] [iOS] signal-abort-window-stop-in-onnavigate.html is a flaky timeout
2026-06-05 Cherry pick 305413.913@safari-7624-branch (58357344684a)
2026-06-05 [Site Isolation] Webpage is constantly reloaded "invalid message RemoteMediaSessionManagerProxy_RemoteAudioConfiguration
2026-06-04 Add cookie access validation to startDownload() and convertMainResourceLoadToDownload() to prevent CSRF 2026-W22
2026-06-04 WebCookieJar contains duplicate shouldBlockCookies() call
2026-06-03 Log ProcessTerminationReason as a string when WebProcess is terminated
2026-05-31 [Site Isolation] WebPageProxy::scheduleFullEditorStateUpdate() should send to the correct web process
2026-05-31 [Site Isolation] Release assert added in 314054@main could cause unexpected crashes
2026-05-28 [Site Isolation] Disallow turning on shared process for site isolation if site isolation is off
2026-05-27 Reduce includes in RemoteMediaSessionManager
2026-05-26 Remove unused member variable m_webInspectorPreferenceObserver from WebProcessPool
2026-05-26 [Site Isolation] Safari crashed after typing random characters in the smart search field and searching
2026-05-26 Missing piece of moving NetworkProcessProxy ownership from WebProcessPool to WebsiteDataStore
2026-05-26 Update WebNotificationManagerProxy to reflect that it's not a message receiver
2026-05-26 Reduce includes in WebProcessPool
2026-05-25 Unreviewed, build fix after 313814@main
2026-05-24 Build fix: RELEASE_LOG_FAULT_WITH_PAYLOAD cannot pass in a CString to WTFReportError
2026-05-19 StabilityTracer: Crash in IPC::MessageReceiverMap::invalidate()
2026-05-14 [Site Isolation] [ iOS ] http/tests/site-isolation/cross-site-window-open-uses-different-process.html is a constant text
2026-05-12 Reduce includes in APIHTTPCookieStorage
2026-05-12 Reduce includes in SettingsBase
2026-05-12 StabilityTracer: Crash in ResourceLoader::willSendRequestInternal()
2026-05-06 Multiple files include CookieStorage.h but don't use it
2026-05-02 Cannot delete partitioned cookies with WKHTTPCookieStore::deleteCookie
2026-05-01 StabilityTracer: Crash in WorkerConsoleClient::messageWithTypeAndLevel
2026-04-29 [Navigation API] intercept() wrongly succeeds for cross-subdomain navigations CVE-2026-20643
2026-04-28 Create WKRBSAssertion subclass of RBSAssertion to prevent missing invalidate calls
2026-04-27 [Site Isolation] Rename focusedLocalFrame to localFocusedFrame
2026-04-27 [Site Isolation] Make typing work on iOS
2026-04-23 [Site Isolation] Make WebPage::scheduleFullEditorStateUpdate() work for cross-site iframes
2026-04-22 [Navigation API] Reduce includes in Navigation.h and .cpp
2026-04-22 Remove unused forward declarations from DocumentLoader.h
2026-04-21 StabilityTracer: NanoMail at RunningBoardServices: -[RBSAssertion dealloc]
2026-04-17 Download Prompt Origin Spoofing via Back-Forward Navigation
2026-04-16 [Site Isolation] De-duplicate logic to generate MixedContent error message
2026-04-15 [Site Isolation] Main frame onload event does not fire if iframe load is blocked
2026-04-15 [IndexedDB API] Remove unused enum VersionNullness
2026-04-14 [Mixed Content] MixedContentChecker::shouldBlockRequest() doesn't need the document
2026-04-14 [IndexedDB API] Remove unused function IDBDatabaseIdentifier::isRelatedToOrigin()
2026-04-14 Unreviewed build fix after 311208@main
2026-04-14 StabilityTracer: Crash in NetworkProcess::findPendingDownloadLocation
2026-04-09 [IndexedDB API] Removed unused CursorDirectionMaximum and CursorTypeMaximum
2026-04-09 Remove unused function HistoryItem::childItemWithDocumentSequenceNumber
2026-04-09 [Navigation API] replaceState() on traversed entry changes NavigationHistoryEntry.key
2026-04-09 [IndexedDB API] Consolidate the parsing logic in getAll* functions
2026-04-04 [IndexedDB API] Remove unused function IDBResultData::getResultRef()
2026-04-03 REGRESSION(309560@main): Newly added TestWebKitAPI.NavigationAPI.* tests timing out
2026-04-03 [IndexedDB API] Many get* tests are wrongly marked as failing
2026-04-02 [IndexedDB API] Enable getAllRecords() and IDBGetAllOptions in Preview
2026-04-02 [IndexedDB API] SQLiteMemoryIDBBackingStore is never used
2026-04-02 [IndexedDB API] Remove unused function IDBKeyRange::isOnlyKey()
2026-04-02 [IndexedDB API] Implement IDBObjectStore::getAllRecords()
2026-04-01 [IndexedDB API] Implement IDBIndex::getAllRecords()
2026-04-01 [Indexed DB] Support IDBGetAllOptions in IDBObjectStore::getAll() and getAllKeys()
2026-03-28 [IndexedDB API] Support IDBGetAllOptions in IDBIndex::getAll()
2026-03-27 [IndexedDB API] Support IDBGetAllOptions in IDBIndex::getAllKeys()
2026-03-25 [IndexedDB API] Add IDL and stub for IDBObjectStore::getAllRecords()
2026-03-24 [IndexedDB API] Add IDL and stub for IDBIndex::getAllRecords()
2026-03-24 [IndexedDB API] Removed unused function IDBGetAllResult::allBlobFilePaths()
2026-03-23 [Cookie Store API] Allow setting a cookie with a mixed case domain passed in
2026-03-23 [Cookie Store API] Add support for setting maxAge
2026-03-20 [Site Isolation] 5x CSP frame-ancestors tests are failing
2026-03-20 [Cookie Store API] Resync WPT tests
2026-03-20 [Site Isolation] Simplify logic in LocalDOMWindow::createWindow and DOMWindow::isInsecureScriptAccess
2026-03-20 [Site Isolation] 6x Security and DOM tests are failing
2026-03-19 [Navigation API] navigation.currentEntry.id doesn't change in private windows after history.replaceState
2026-03-19 [Site Isolation] 2x xss-DENIED-getSVGDocument-*.html tests are failing
2026-03-18 [Site Isolation] xss-DENIED-window-open-parent.html is failing
2026-03-18 [Navigation API] navigation.currentEntry.key doesn't change in private windows
2026-03-18 Remove unused overload of HTMLFrameElementBase::setLocation
2026-03-17 [Navigation API] navigation.back() inside of onnavigate should reject
2026-03-17 [Site Isolation] window-name-after-cross-origin-aux-frame-navigation.html is failing
2026-03-17 [Site Isolation] about-url-host.html is failing
2026-03-13 [Site Isolation] 5x MIME tests are failing
2026-03-13 [Site Isolation] Skip API tests timing out due to backforward cache dependency
2026-03-12 [Site Isolation] mime/html-with-html.html is failing
2026-03-12 StabilityTracer: Crash in callback of async IPC sent by WebKit::NetworkProcess::findPendingDownloadLocation
2026-03-10 [Site Isolation] Unreviewed, update iOS layout test expectations
2026-03-06 [Navigation API] Resync WPT tests
2026-03-06 [Site Isolation] Unreviewed, update MacOS layout test expectations for site isolation
2026-03-05 [Site Isolation] ProcessSwap.NumberOfPrewarmedProcesses is failing
2026-03-05 [Site Isolation] COOP test blob-popup.https.html is crashing
2026-03-04 [Site Isolation] 3 COOP tests in iframe-popup-unsafe-none-to-unsafe-none.https.html are failing
2026-02-26 [Site Isolation] 5 COOP tests in iframe-popup-same-origin-to-unsafe-none.https.html are failing
2026-02-25 [Site Isolation] COOP test iframe-popup-same-origin-allow-popups-to-unsafe-none.https.html?7-8 is failing
2026-02-20 [Site Isolation] 2 COOP tests in iframe-popup-same-origin-allow-popups-to-unsafe-none.https.html are failing
2026-02-10 Deprecate local and session restoration SPI and convert to no-op since API exists
2026-02-07 [Site Isolation] Multiple COOP layout tests are now passing
2026-02-06 Deprecate local and session restoration SPI and convert to no-op since API exists
2026-02-06 [Site Isolation] COOP test iframe-popup-same-origin-to-same-origin.https.html is failing
2026-02-04 [Site Isolation] Cross site iframe fails to window.open the main frame's site
2026-01-23 [Navigation API] Remove unused function canSetIntercept()
2026-01-23 [Navigation API] Fix order of setting interception state in NavigateEvent::intercept()
2026-01-15 Reduce unsafeness in PlatformMediaSessionInterface and MediaSessionCoordinator
2026-01-09 [Site Isolation] REGRESSION(304018@main): Triggers assertions in Site Isolation iOS API tests
2026-01-09 Reduce unsafeness in DOMWindow, Page, PageOverlayController
2026-01-08 Remove unused function weakImplIfExists()
2026-01-07 [Navigation API] StabilityTracer: com.apple.WebKit.WebContent at WebCore: WebCore::Navigation::innerDispatchNavigateEven
2025-12-15 [Cookie Store API] get() and getAll() should share the same code path
2025-12-06 [Site Isolation] Cross-site iframes don't receive DeviceMotionEvents
2025-12-05 [Site Isolation] Cross-site iframes don't receive DeviceOrientationEvents
2025-11-19 StabilityTracer: WebAutomationSession::deleteAllCookies must not send null strings over IPC
2025-11-07 [Navigation API] navigate-204-205-download-then-same-document.html is passing after 302530@main
2025-11-06 [Navigation API] Some IDL files are missing copyright headers
2025-11-06 [Site Isolation] Text in cross-site iframe isn't translated if frame is added after user translates page
2025-11-05 [Navigation API] Fire an abort signal when aborting a NavigateEvent
2025-10-29 StabilityTracer: com.apple.WebKit.WebContent at WebCore::Navigation::initializeForNewWindow
2025-10-25 [Navigation API] navigate-replace-same-document.html is flaky on WPT
2025-10-24 REGRESSION(285577@main): [ macOS iOS wk2 ] imported/w3c/web-platform-tests/navigation-api/navigation-methods/return-valu
2025-10-23 [ macOS Tahoe wk2 Debug x86_64 ] ipc/serialized-type-info.html is a constant text failure

1 / 10

← All Contributors