[2] WebPasteboardProxy missing frame-ancestry check under Site Isolation

Under Site Isolation, a copy operation that named someone else's frame could pull a cross-site iframe's DOM straight onto the pasteboard.

Severity: High | Component: WebKit UI-process WebPasteboardProxy (Cocoa) | 69aa562

Rated High because the diff adds the missing subtree-membership check on attacker-supplied frame identifiers that a compromised WebContent process could name in a pasteboard IPC, where the pre-fix path could collect an unrelated cross-site frame's serialized DOM; escalation to a sandbox escape is not implied — the impact is a cross-site information disclosure gated on addressing the target FrameIdentifier and reading the pasteboard back.

WebPasteboardProxy performed no subtree checks on the remote frame IDs it was given, so it could cause content from an unrelated cross-site remote frame to be written to the pasteboard. The fix adds message checks ensuring every remote frame ID used within WebPasteboardProxy is a descendant of the root frame ID being copied.

Source/WebKit/UIProcess/Cocoa/WebPasteboardProxyCocoa.mm

+// Only allow exploring frames that descend from the provided root frame.
+static bool validateFrameIdentifiers(FrameIdentifier rootFrameIdentifier, const HashMap<FrameIdentifier, Ref<WebCore::LegacyWebArchive>>& localFrameArchives, const Vector<FrameIdentifier>& remoteFrameIdentifiers)
+{
+    auto isInSubtree = [&](WebFrameProxy& frame) {
+        for (RefPtr ancestor = &frame; ancestor; ancestor = ancestor->parentFrame()) {
+            if (ancestor->frameID() == rootFrameIdentifier)
+                return true;
+        }
+        return false;
+    };
+    auto isAllowed = [&](FrameIdentifier identifier) {
+        if (identifier == rootFrameIdentifier)
+            return true;
+        RefPtr frame = WebFrameProxy::webFrame(identifier);
+        return !frame || isInSubtree(*frame);
+    };
+    for (auto& [frameIdentifier, archive] : localFrameArchives) {
+        if (!isAllowed(frameIdentifier))
+            return false;
+        Ref protectedArchive = archive;
+        if (auto archiveFrameIdentifier = protectedArchive->frameIdentifier(); archiveFrameIdentifier && !isAllowed(*archiveFrameIdentifier))
+            return false;
+        for (auto subframeIdentifier : protectedArchive->subframeIdentifiers()) {
+            if (!isAllowed(subframeIdentifier))
+                return false;
+        }
+    }
+    for (auto identifier : remoteFrameIdentifiers) {
+        if (!isAllowed(identifier))
+            return false;
+    }
+    return true;
+}
+    // writeWebContentToPasteboard
+    MESSAGE_CHECK(validateFrameIdentifiers(*rootFrameIdentifier, content.localFrameArchives, content.remoteFrameIdentifiers), connection);
+    // writeWebArchiveToPasteBoard
+    MESSAGE_CHECK_COMPLETION(validateFrameIdentifiers(rootFrameIdentifier, localFrameArchives, remoteFrameIdentifiers), connection, completionHandler(WriteWebArchiveToPasteBoardResult::FailureDueToInvalidFrameIdentifiers, 0));

LayoutTests/http/tests/ipc/resources/write-web-archive-frame-ancestry-check-iframe.html

+    // Forge a WriteWebArchiveToPasteBoard IPC that names an out-of-process frame ID (the parent
+    // frame) as a remote subframe. This should fail with the FailureDueToInvalidFrameIdentifiers error.
+    let r = IPC.sendSyncMessage('UI', 0, IPC.messages.WebPasteboardProxy_WriteWebArchiveToPasteBoard.name, 1000, [
+        S(pbName), FrameID(myFrameID), u64(0n), u64(1n), FrameID(parentFrameID),
+    ]);

Patch Details

A new static helper validateFrameIdentifiers(rootFrameIdentifier, localFrameArchives, remoteFrameIdentifiers) walks each supplied frame identifier and confirms it is a subtree descendant of the root frame being copied. isAllowed() returns true for the root frame itself or — via WebFrameProxy::webFrame(identifier) and the isInSubtree lambda that walks parentFrame() up to the root — for any frame whose ancestry chain reaches rootFrameIdentifier; an unknown (null) frame is also allowed. The helper validates every key in content.localFrameArchives, each archive's own frameIdentifier() and subframeIdentifiers(), and every remoteFrameIdentifiers entry. writeWebContentToPasteboard gains a MESSAGE_CHECK, and writeWebArchiveToPasteBoard a MESSAGE_CHECK_COMPLETION. The WriteWebArchiveToPasteBoard reply type is widened from a bare int64_t changeCount to (WriteWebArchiveToPasteBoardResult result, int64_t changeCount) — a new enum class (Success / FailureDueToInvalidFrameIdentifiers / FailureOther) — so the WebProcess and test can observe rejection.

Missing frame-ancestry (subtree-membership) authorization on attacker-supplied frame identifiers crossing an IPC trust boundary in the Site Isolation pasteboard broker.

Background

Site Isolation is WebKit's architecture that places cross-site iframes in separate WebContent processes, where each frame has a process-spanning FrameIdentifier used by the UI process to address frames. WebPasteboardProxy is a UI-process IPC message receiver that brokers pasteboard operations on behalf of WebContent processes. LegacyWebArchive is WebKit's serialized representation of a frame and its subframes (a .webarchive); createOneWebArchiveFromFrames assembles one archive from a root frame plus its local-frame archives and remote (out-of-process) subframe identifiers. WebFrameProxy::webFrame(identifier) resolves a FrameIdentifier to the UI-process proxy for that frame, whose parentFrame() chain expresses the frame tree.

MESSAGE_CHECK / MESSAGE_CHECK_COMPLETION are IPC validation macros that, on failure, treat the message as invalid (terminating the sender or returning an error) — the standard mechanism for enforcing invariants on attacker-controlled IPC input. The IPCTestingAPI is a test-only facility that lets layout tests synthesize raw IPC messages, used here to forge a request naming a non-descendant frame.

Analysis

This is a missing authorization / cross-process capability check on an IPC handler — a Site Isolation boundary bypass. Before the fix, writeWebArchiveToPasteBoard and writeWebContentToPasteboard accepted a rootFrameIdentifier plus an arbitrary set of local-frame-archive keys and remoteFrameIdentifiers straight from an IPC message and passed them to createOneWebArchiveFromFrames without ever confirming those identifiers belonged to the subtree rooted at rootFrameIdentifier.

Under Site Isolation, cross-site subframes live in different WebContent processes but their FrameIdentifiers are globally addressable across the UI process. The UI process's WebPasteboardProxy is the trusted broker that assembles a multi-frame web archive, reaching into other frames' processes to collect their serialized DOM. With no ancestry validation, a WebContent process serializing a copy of its own frame could name a completely unrelated cross-site remote frame as a "remote subframe", causing that frame's content to be collected and written to the pasteboard.

The regression test demonstrates the trigger: an iframe forges the IPC naming its out-of-process parent frame's FrameIdentifier as a remote subframe; pre-fix this was accepted, post-fix it returns FailureDueToInvalidFrameIdentifiers. From a WebContent process, an attacker sends a forged WriteWebArchiveToPasteBoard whose rootFrameIdentifier is its own frame but whose remoteFrameIdentifiers (or a local archive's subframe identifiers) name an unrelated cross-site frame; createOneWebArchiveFromFrames would collect that non-descendant frame's serialized content into the archive written to the pasteboard, which attacker script could then read back — a cross-site content-disclosure primitive gated on knowing the target FrameIdentifier.

This vulnerability weakens the Site Isolation / same-origin trust boundary. The security model assumes a WebContent process can only cause its own frame subtree to be serialized into the pasteboard during a copy; the UI-process broker is supposed to enforce that the named frames belong to the copying frame's subtree. Before the fix that invariant was unenforced, so a malicious WebContent process could exfiltrate another origin's cross-process frame DOM. This is a cross-origin information-disclosure bypass within the existing process model, not a sandbox escape. Note the fix's deliberate softening: an unresolvable identifier (!frame) is treated as permitted rather than rejected, to avoid breaking legitimate already-detached frames.

Note: The enclosing function name for the writeWebContentToPasteboard check, the precise fan-out behavior of createOneWebArchiveFromFrames into other processes, and the test's exact origin layout are inferred from the commit message and code shape rather than fully visible in the diff. The missing-check root cause and the rejection path are directly supported by the patch.

Audit directions

UI-process IPC handlers that aggregate or address frame/document content by attacker-supplied FrameIdentifier without re-validating subtree/ancestry against the authoritative WebFrameProxy tree. Audit other WebPasteboardProxy and WebPageProxy handlers that accept Vector<FrameIdentifier> or HashMap keyed on FrameIdentifier under Site Isolation; verify each resolves identifiers via WebFrameProxy::webFrame and checks parentFrame() ancestry. Start by grepping UIProcess for remoteFrameIdentifiers and FrameIdentifier parameters in .messages.in files.
"Unknown identifier treated as allowed" fail-open defaults in capability checks. Review the return !frame || isInSubtree(*frame) branch in validateFrameIdentifiers and any sibling checks permitting unresolved identifiers — confirm a detached/unknown frame cannot smuggle content. Trace callers of createOneWebArchiveFromFrames to see what happens when a named frame resolves later or in a different process.
Cross-process archive/serialization aggregation that fans out into other WebContent processes. Examine LegacyWebArchive assembly paths (createOneWebArchiveFromFrames, collectFrameWebArchives in WebPlatformStrategies) to verify the set of frames whose DOM is collected is bounded to the initiating frame's subtree in every entry point, not only the two patched here.