[12] [WebCore] Re-validate same-origin after CSP sandbox application in view transitions

Severity: High | Component: WebCore View Transitions | cc6b337

Rated High because the diff adds a second origin check at Document::reveal() time so the view-transition pipeline does not consume captured snapshots when the new document's effective origin became opaque due to CSP sandbox; pre-fix, captured ImageBuffers and element names from the outgoing document leaked into a sandbox-opaque document.

Document::reveal re-validates same-origin between the source document's origin and the new document's post-CSP securityOrigin() before installing ViewTransitionParams.

Source/WebCore/dom/Document.cpp

TOCTOU between URL-origin-based admission and post-CSP final origin: cross-document view transition snapshots installed into a CSP sandbox opaque-origin document.

Patch Details

Document::reveal adds a final same-origin check using the post-CSP securityOrigin(). The admission gate at navigation start (URL-derived origin) is unchanged.

Background

Cross-document view transitions snapshot element images and geometry from an outgoing document and replay them in the incoming document. The pipeline is gated on same-origin between the documents. Per the HTML spec, Content-Security-Policy: sandbox without allow-same-origin replaces the document's effective origin with an opaque origin after CSP processing.

Analysis

The pre-fix pipeline performed its same-origin check once, at navigation initiation in DocumentLoader::navigationCanTriggerCrossDocumentViewTransition — using the URL-derived origin of the response. CSP processing runs after this; by the time resolveInboundCrossDocumentViewTransition ran during Document::reveal(), securityOrigin() was opaque, but the pipeline never re-validated.

The stale admission decision caused OrderedNamedElementsMap namedElements, initialLargeViewportSize, initialPageZoom, and captured ImageBuffer snapshots from the previous page to flow into a document that, per CSP semantics, must be treated as a foreign opaque origin. The exploit primitive is cross-origin pixel and element-metadata read.

This weakens the same-origin invariant on view transition snapshot transfer specifically in the presence of CSP sandbox.

Audit directions

• Other admission gates that compute origin from the URL before CSP/sandbox application. Anywhere a navigation-time check is consumed at later document lifecycle points, re-validation against securityOrigin() is required.
• ViewTransitionParams consumers. Every site that reads the params should check current origin parity, not rely solely on the install-time check.
• Other HTML spec features that consume cross-document state (Document Picture-in-Picture, BFCache restoration animations) for the same TOCTOU.