beidson
WebKit security specialist
Summary
Works primarily in the WebKit layer — process model plumbing for site isolation, IPC message handling between WebContent, Network, and UI processes, and WKWebView/WKContentWorld API surface, with supporting changes in WebCore and Platform. The security fixes form a tight cluster around compromised-WebContent-process threat modeling: MessagePort confusion and unauthorized access to pending port messages in the Network Process, back/forward list message spoofing to obtain arbitrary file URL access, and cross-origin iframe capability abuse (app badge spoofing from `window` contexts, ServiceWorker notification suppression). Systematic-variant candidate: process-global maps and identifier lookups reachable from WebContent IPC — the `WebBackForwardListItem::allItems()` change shows the pattern of a shared registry keyed without process scoping, and the recurring site-isolation work (WKURLSchemeHandler process confusion, cross-site policy inheritance on iframe navigations) suggests policy and handler routing across isolated frames is still settling.
Components
Security Fix History
- 2026-07-02 Guard against MessagePort confusion in the Network Process ·
- 2026-07-02 Compromised WebContent process can gain arbitrary file URL access by spoofing back/forward list messages ·
- 2026-07-01 Build fix after 249edf86a9f55 ·
- 2026-06-30 Need a process-specific `WebBackForwardListItem::allItems()` instead of the process-global map for better message checki ·
- 2026-06-08 Cross origin iframes should not be able to set the app badge. ·
- 2026-06-04 MessagePorts a WebContent process already has should be invalidated if the Networking process disconnects 2026-W22
- 2026-06-03 rdar://172395438 2026-W22
- 2026-06-03 Compromised web content process unauthorized access to pending MessagePort messages 2026-W22
- 2026-06-03 App Badge origin spoofing from `window` contexts 2026-W22
- 2026-05-25 Don't let ServiceWorkers handling push events call showNotification but then immediately close that notification
Hardening Commits
Recent Commits
- 2026-08-06 [Site Isolation] Some website policies applied to main frame navigations don't apply to cross site iframes
- 2026-08-05 Excessive CoreIPCNSURLRequest logging from CoreMedia generated NSURLRequests
- 2026-08-01 (Site isolation) Fix WKURLSchemeHandler process confusion
- 2026-07-29 Queue multiple JS dialog requests in the UI process (possible with site isolation enabled)
- 2026-07-28 Add tests verifying cross-origin iframe window.alert() behavior
- 2026-07-22 Rename WKJSHandle.frame to WKJSHandle.sourceFrame
- 2026-07-09 Small updates to new JavaScript APIs
- 2026-07-07 Null check pageClient() inside WebPageProxy::didAttachToRunningProcess
- 2026-07-07 Clean up some issues with AsyncReplyHandlerWithDispatcher
- 2026-07-07 Small updates to various new APIs
- 2026-07-02 Guard against MessagePort confusion in the Network Process ·
- 2026-07-02 Compromised WebContent process can gain arbitrary file URL access by spoofing back/forward list messages ·
- 2026-07-01 Build fix after 249edf86a9f55 ·
- 2026-06-30 Need a process-specific `WebBackForwardListItem::allItems()` instead of the process-global map for better message checki ·
- 2026-06-25 App-provided NSURLRequest properties are lost