[2] Cross-Process Page Identity Confusion in didPostMessage
Severity: High | Component: WebKit UIProcess | 1ad0d2a
Rated High because the diff exposes a UI-process IPC that resolves a global WebPageProxyIdentifier and dispatches user-script messages into the target page without confirming sender ownership; a compromised renderer thereby injects payloads into another renderer's WKScriptMessageHandler.
WebProcessProxy::didPostMessage() resolved a WebPageProxyIdentifier via the global WebPageProxy::fromIdentifier() and acted on the result without verifying that the page was hosted in the sending WebProcess. Under site isolation, the identifier is a process-agnostic handle; a compromised renderer could supply any page's identifier and have its forged postMessage payload delivered as if it had come from that page.
Source/WebKit/UIProcess/WebProcessProxy.cpp
RefPtr page = WebPageProxy::fromIdentifier(pageID);
if (!page)
return completionHandler(makeUnexpected(String()));
+ MESSAGE_CHECK_COMPLETION(isAssociatedWithPage(pageID), completionHandler(makeUnexpected(String())));
RefPtr controller = WebUserContentControllerProxy::get(identifier);
+ for (Ref remotePage : m_remotePages) {
+ if (remotePage->page() && remotePage->page()->identifier() == pageID)
+ return true;
+ }
+ if (m_pagesPendingClose.contains(pageID))
+ return true;
Patch Details
A MESSAGE_CHECK_COMPLETION(isAssociatedWithPage(pageID), ...) is added immediately after the global lookup. isAssociatedWithPage is extended to consult m_remotePages (cross-origin iframe processes under site isolation) and a new m_pagesPendingClose counted set, populated by a new sendPageCloseMessage helper that wraps every Messages::WebPage::Close send. Call sites in ProvisionalPageProxy, RemotePageProxy, SuspendedPageProxy, and WebPageProxy are migrated to the helper.
Missing sender-authorization on a UI-process IPC handler that resolves a cross-process object handle via a global registry without checking it belongs to the sending process.
Background
WebPageProxy is the UI-process object representing a logical tab; under site isolation, multiple WebContent processes may attach to one page (a main-frame process plus per-site RemotePageProxy for cross-origin iframes). WebProcessProxy tracks which pages each renderer hosts via m_pageMap, m_provisionalPages, m_remotePages, and m_suspendedPages. WebPageProxyIdentifier is a globally unique handle resolved by WebPageProxy::fromIdentifier() regardless of asker. didPostMessage is the UI-process handler for window.webkit.messageHandlers.<name>.postMessage(...) from injected user scripts. MESSAGE_CHECK aborts the message and terminates the sending WebContent on failure.
Analysis
The handler accepted a renderer-supplied WebPageProxyIdentifier, resolved it globally, then dispatched the payload through the resolved page's WebUserContentControllerProxy with no ownership check. A compromised WebContent process could forge WebProcessProxy::DidPostMessage carrying a victim page's identifier and a serialized JS payload; the UI process would deliver it as if it originated from that page.
Aaa Aaa Aaaa Aaaaaaa a Aaaaaaaaaaaa Aaaaaaaa Aaaaaaaaaaaaaaaaaaaaaa Aaaaaa Aaa Aa Aa Aaaaaaaa Aa Aaaaa Aaaaaaaaaaaaaaa Aaa a Aaaaaaa Aaaaaa a Aaaa Aaaa Aaa a Aaaaaaaaaaaa Aaaaaa Aa Aaaaa Aaaaaaaaaaa Aaa Aa Aaaaaaaaa Aaaaaaaaaaaaaaaaaaaaa Aa Aaaaaaa Aaa Aaaa Aaaaa Aaaaaaaaaaaaaaaaaaaaaa Aaaa Aaaaaa Aaa Aaaaaaaaa Aaaaaaaaaaaaaaaa Aaaaaaaaaaa Aaaaaaa a Aaaaaa Aaaaaa Aaa Aaaaaa Aaa Aaa Aaaaaaaaaa Aaaaaaa
Aaaaaaaaaa Aaaaaaaaaaaaa Aaaaaaaaa Aa Aaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaa Aaaaaaaa Aaaa a Aaaaaa Aaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaa Aaaa Aaaaaaaaa Aaaaaa Aaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaa Aa Aaaaaaaaaaa Aaaaa Aaaa Aaa Aaa Aaaaaaaa a Aaaaaaaaaa Aaaaaaaaa Aaaaaaaaaa Aaaaaaaaaaa Aaaaaaaaa Aaaaa Aaaaaaaa Aaa Aaa Aaaaaaaaa Aaaaaaa Aaaa Aaaaaaaa
Aaaa Aaaaaaaaaaaaa Aaaaaaa Aaa Aaaaaaaaaaa Aaaaaaaa Aaa Aa Aaaaaaa Aa Aaaaaaaa Aa Aaaaaaa Aaaaaaa Aaaaaaaaaa Aaaaaaaaa a Aaaaaaa Aaa Aaaaaaaa Aaa Aaaaaaaaaaaaaaaaaaaa Aaaaaa Aaaaa Aaaaaa Aa Aaaaaaa
🔒Explores how a cross-process IPC identifier can be weaponized against the UI process's per-renderer ownership boundaries, and what the realistic primitive looks like for a compromised WebContent process under site isolation.
Subscribe to read more
Audit directions
a Aaaaaaaaaaaa Aaa Aaaaaaaa Aaaaaaaaa Aaaaaaaaaaaaa Aaaaaaa Aaa Aaaaaa Aaaaaaaaaaaaa Aaaaa Aaaaa Aaaaaaaaaaaaaaaaaaaa Aaa Aaaaaaa Aa Aaaaaaaaaaaaaaaaaaaaa Aaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaa Aaaaa a Aaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaa Aa Aaaaaaaa Aaa Aaaaa Aaaaaaa a Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaa Aaaaaaaaaa Aaaaaaaaa Aaaaaa Aaaaaa Aaaaaa Aaa Aaaaaaaa Aaaaaa Aa Aaaaa Aaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaa Aaaaaaaaaaaaaaaaa Aaaaaaaa Aa Aaa Aa Aaa Aaaaaa Aaaaaaa Aa Aaaaaaaaaaa Aaaaaaaaaaaaaaaa
a Aaaaaaaa Aaaaaaaaaa Aaaaaaa Aaa Aa Aaaaaaa Aaaaaaaaaaaaaaaaaaaaaa Aaa Aa Aa Aaaaaaaa Aaa Aaaa Aaaaaaaaaaaaaaa Aaa Aaaaaaaaaaaaaaaaaaaaa Aaaaa Aaaa Aaaaa Aaaaaaaaaaaaaaaaaaaaaaa Aaaaaa Aa Aaaaaaaaaaaaaaaaa Aaaa Aaaa Aa Aaaaaaaaaaaaaaaaaaaaaaaa Aaa Aaaaaaaaaaa Aaaaaaa Aaa Aaaaaaaa Aaaa a Aaaaaaaaaaaaaa Aaaaaa Aaaaaaaaa Aaaaaa Aa Aaa Aaaaaaaa Aaaaa Aaaaaaaa Aaaa Aaaa
a Aaaaaaaa Aaaaaaa Aaaaaaaaaaaaaaaaaaa Aaaaaaaa Aaa Aaaaaaaa Aaaaaaaaaaaaaaaaaa Aaa Aaaaaaaaaaaaaaaaaaaaa Aaa Aaaaaa Aa Aaaa Aaaaaaaaaaaaaaaaaaaaaa Aaaa Aaaaaa Aa Aaaaaaaaa Aaaaaaaaaaaaaaaaa Aaaaa Aaaaa Aaaaaaaaaa Aaaaaaaa Aaaaaaaa Aaaaaaaaaaaaaaaa Aaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaa Aaaaaaaaaaaa Aaaaaaaaaaaa Aaa Aaa Aaaa Aaaaaa a Aaaa Aaa Aaaaaaaa Aaa Aaaaaaaaaaaa Aaaa Aaaaaaa Aaaaaaaaaa Aaaaa Aaaaa Aaaaaaa Aaa Aaa Aaaaa Aaaaa Aaaaaaaaa
a Aaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaa Aaaaaaaaaaa Aaaaaa Aa Aaa Aaaaaaaa a Aaaaaaaaaaa Aaaaaaaa Aaa Aaaaaaa Aaa Aaaaaaa Aaaaa Aaaaaaa Aaaaaaaaaa Aa Aaaaaaaaaaa Aaaaaa Aa Aaaaaaaaa Aaaaaa Aaaaaaaaaaaa Aaaaa Aa Aaa Aaaaaaa Aaa Aaaaaaaaaaaa Aaaaaaaaaaaaaaa
🔒Four reusable audit patterns identified for confused-deputy bugs in UI-process IPC handlers, including specific helper predicates and lifecycle windows to investigate.
Subscribe to read more