[14] [WebKit] Add MessagePort entanglement check to takeAllMessagesForPort IPC

Severity: High | Component: WebKit Network process | da44cdb

Rated High because the diff adds a MESSAGE_CHECK_COMPLETION that rejects TakeAllMessagesForPort IPCs naming a port not in m_processEntangledPorts; pre-fix, any WebContent process could harvest pending messages destined for a port owned by an unrelated process, given the port identifier.

NetworkConnectionToWebProcess::takeAllMessagesForPort checks the supplied MessagePortIdentifier against m_processEntangledPorts and routes mismatches to the kill-the-sender path.

Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp

IPC authorization bypass: a compromised renderer harvested queued cross-process MessagePort messages using a forged identifier.

Patch Details

The IPC entry point now checks port ownership before consulting the global registry. The completion handler returns empty/false on rejection.

Background

The Network process is the trusted broker for cross-process MessagePort delivery. When a port is transferred between WebContent processes (e.g., via a SharedWorker handoff), pending messages queue in the Network process until the receiver drains them via TakeAllMessagesForPort. m_processEntangledPorts tracks which ports this connection legitimately owns.

Analysis

Pre-fix, the Network process accepted any MessagePortIdentifier (a pair of ProcessIdentifier + PortIdentifier, both uint64_ts) and forwarded it to the global registry. A compromised or hostile WebContent process that obtained or guessed an identifier could issue the IPC and harvest the queue.

Audit directions