[7] [WebCore] Validate SameSite initiator in FrameLoader::load

Severity: High | Component: WebCore FrameLoader | 093f346

Rated High because the diff adds the initiator argument to addSameSiteInfoToRequestIfNeeded in FrameLoader::load; without it, every navigation request was classified same-site (isSameSiteUnspecified=false, isSameSite=true) and attached the destination's SameSite=Strict cookies regardless of the cross-site initiator.

FrameLoader::load now calls the initiator-aware addSameSiteInfoToRequestIfNeeded(loader->request(), initiator), allowing the downstream updateRequestAndAddExtraFields to recompute the SameSite disposition correctly.

Source/WebCore/loader/FrameLoader.cpp

SameSite cookie policy bypass: the omitted-initiator overload unconditionally marks the request same-site and "specified", suppressing later cross-site recomputation.

Patch Details

A single call-site widens the argument list. The helper's two-arg form already classifies correctly when the initiator is supplied; the one-arg overload's defaults are what produced the bypass.

Background

SameSite cookie attribution is computed at request preparation: isSameSite decides whether SameSite=Strict / SameSite=Lax cookies are attached. The disposition can be unspecified, in which case downstream layers compute it from the initiator; if specified, downstream takes the field as-is.

Analysis

Pre-fix, the one-arg form of addSameSiteInfoToRequestIfNeeded set isSameSite=true and isSameSiteUnspecified=false. updateRequestAndAddExtraFields only performs the proper initiator-aware recomputation when isSameSiteUnspecified is true; with disposition already specified, recomputation was suppressed. A navigation initiated from attacker.example to victim.example was classified same-site, and the network layer attached victim.example's SameSite=Strict cookies to the outgoing request.

The pre-condition for the attack is any top-level navigation whose initiator differs from the destination. The bypass is the standard CSRF window that SameSite=Strict is designed to close. The fix is the minimum: thread the initiator through so the downstream computation runs.

This weakens SameSite enforcement at the FrameLoader layer, defeating the cookie-attachment defenses for cross-site top-level navigations.

Audit directions

• All callers of addSameSiteInfoToRequestIfNeeded for one-arg invocations; each is a latent bypass with the same shape.
• isSameSiteUnspecified writers across WebCore. Any path that flips the flag to "specified" without first computing the disposition correctly defeats the downstream recompute step.
• Other initiator-aware preparation helpers (Referrer-Policy, Origin header) for the same initiator-omitted-overload pattern.