[18] WebPaymentCoordinatorProxy_ShowPaymentUI handles arbitrary untyped image data
Severity: Low | Component: WebKit Apple Pay Installments IPC | c945958
Rated Low because the observable effect is removal of an unused IPC field — no bug-class incident is shown to have triggered, and the security value is purely attack-surface reduction (an unused base64 → NSData → PassKit pipeline removed before any concrete vulnerability surfaced).
Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in
Source/WebCore/Modules/applepay/PaymentInstallmentConfiguration.mm
Patch Details
merchandisingImageData is marked [NotSerialized] in WebCoreArgumentCoders.serialization.in; the struct switches to [CreateUsing=fromInstallmentConfiguration] factory construction. A new ApplePayInstallmentConfigurationWebCore.cpp defines fromInstallmentConfiguration, reconstructing the struct on the receiving side with an empty placeholder string. PaymentInstallmentConfiguration.mm drops the WebContent-side base64 decode into NSData passed to [PKPaymentInstallmentConfiguration setMerchandisingImageData:] and the read-back round-trip; SPI entries are removed from PassKitInstallmentsSPI.h and AllowedSPI-legacy.toml. The web-facing dictionary field is retained as a no-op for API compatibility.
Unsanitized untyped data crossing a sandbox IPC boundary into a privileged image/data sink that no longer needs the input.
Background
ApplePayInstallmentConfiguration is the WebIDL dictionary describing an Apple Pay installments offer; created in WebContent from JS and passed to the UIProcess to render the payment sheet. PassKit (PKPaymentInstallmentConfiguration) renders the native payment sheet UI at higher privilege than WebContent. WebKit IPC serialization is field-by-field via WebCoreArgumentCoders.serialization.in; [NotSerialized] excludes a field from the wire format, [CreateUsing=...] directs the generator to construct via a static factory.
Analysis
Pre-fix, an attacker with WebContent access could send arbitrary base64 bytes that the UIProcess decoded into NSData and handed to PassKit's setMerchandisingImageData:. The commit message confirms the field was never actually consumed by Apple Pay. The pattern — a feature property defined in WebIDL, serialized over IPC, decoded in the UIProcess, but never consumed end-to-end — is recurring attack surface, especially when data is opaque (base64 blobs, untyped NSData, free-form strings handed to platform frameworks). The fix is also a worked example of how WebKit's serializer generator constrains struct layout; because the script could not synthesise a partial aggregate initializer, the team introduced [CreateUsing=...] rather than reorder the C++ struct.