[14] [WebKit] Add MessagePort entanglement check to takeAllMessagesForPort IPC

Severity: High | Component: WebKit Network process | da44cdb

Rated High because the diff adds a MESSAGE_CHECK_COMPLETION that rejects TakeAllMessagesForPort IPCs naming a port not in m_processEntangledPorts; pre-fix, any WebContent process could harvest pending messages destined for a port owned by an unrelated process, given the port identifier.

NetworkConnectionToWebProcess::takeAllMessagesForPort checks the supplied MessagePortIdentifier against m_processEntangledPorts and routes mismatches to the kill-the-sender path.

Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp

+ MESSAGE_CHECK_COMPLETION(m_processEntangledPorts.contains(identifier), completionHandler({ }, false));

m_networkProcess->messagePortChannelRegistry().takeAllMessagesForPort(identifier, WTFMove(completionHandler));

IPC authorization bypass: a compromised renderer harvested queued cross-process MessagePort messages using a forged identifier.

Patch Details

The IPC entry point now checks port ownership before consulting the global registry. The completion handler returns empty/false on rejection.

Background

The Network process is the trusted broker for cross-process MessagePort delivery. When a port is transferred between WebContent processes (e.g., via a SharedWorker handoff), pending messages queue in the Network process until the receiver drains them via TakeAllMessagesForPort. m_processEntangledPorts tracks which ports this connection legitimately owns.

Analysis

Pre-fix, the Network process accepted any MessagePortIdentifier (a pair of ProcessIdentifier + PortIdentifier, both uint64_ts) and forwarded it to the global registry. A compromised or hostile WebContent process that obtained or guessed an identifier could issue the IPC and harvest the queue.

The regression test uses IPC_TESTING_API to:

WebView A   create channel             →  CreateNewMessagePortChannel  →  intercept arg buffer, read port id
WebView A   post 3 messages
WebView C   forge TakeAllMessagesForPort(port id)
           pre-fix: returns 3 messages  ← cross-process IPC harvest
           post-fix: returns 0          ← MESSAGE_CHECK_COMPLETION rejects

The primitive is cross-process information disclosure scoped to MessagePort message contents. This is not memory corruption — it is a logic bug at the IPC trust boundary.

This weakens the per-process ownership invariant on cross-process port queues.

Audit directions

Every NetworkConnectionToWebProcess IPC that consults the global registry without a m_processEntangledPorts-equivalent check. EntangleLocalPortInThisProcessToRemote, port transfer paths, and broadcast notifications are candidates.
MessagePortIdentifier predictability. The ProcessIdentifier+PortIdentifier namespace is per-process; verify guess-resistance assumptions across all consumers.
Other shared-resource IPC brokers (BroadcastChannel, SharedWorker, ServiceWorker registration) for the same pattern.