◆
webkit security monitor
autonomous cve → commit → rca pipeline
Released January 22, 2024

CVE-2024-23271

CVSS 6.5 severity medium CWE-284 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Overview

Impact:

Description: A malicious website may cause unexpected cross-origin behavior

Researchers: James Lee (@Windowsrcer)

Key insight. Feature-policy enforcement special-cased iframe owners and silently skipped embed/object/frame owners; applying the default policy to any non-iframe owner closes the cross-origin capability gap.

Patch Details

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 409133b0ed61..e0a3e7cb2553 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2020-08-18  Antti Koivisto  <[email protected]>
+
+        The CSS specificity of :host() pseudo-classes is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=202494
+        <rdar://problem/66292568>
+
+        Reviewed by Anders Carlsson.
+
+        * TestExpectations:
+
 2020-08-18  Diego Pino Garcia  <[email protected]>
 
         [GTK] Unreviewed test gardening. Update test baseline after r265749.
diff --git a/LayoutTests/TestExpectations b/LayoutTests/TestExpectations
index e17f48539072..1d87e2921dd0 100644
--- a/LayoutTests/TestExpectations
+++ b/LayoutTests/TestExpectations
@@ -4420,7 +4420,6 @@ webkit.org/b/214461 imported/w3c/web-platform-tests/css/css-pseudo/spelling-erro
 webkit.org/b/214462 imported/w3c/web-platform-tests/css/css-scoping/host-context-specificity-001.html [ ImageOnlyFailure ]
 webkit.org/b/214462 imported/w3c/web-platform-tests/css/css-scoping/host-context-specificity-002.html [ ImageOnlyFailure ]
 webkit.org/b/214462 imported/w3c/web-platform-tests/css/css-scoping/host-context-specificity-003.html [ ImageOnlyFailure ]
-webkit.org/b/214462 imported/w3c/web-platform-tests/css/css-scoping/host-specificity.html [ ImageOnlyFailure ]
 webkit.org/b/214462 imported/w3c/web-platform-tests/css/css-scoping/host-with-default-namespace-001.html [ ImageOnlyFailure ]
 webkit.org/b/214462 imported/w3c/web-platform-tests/css/css-scoping/shadow-directionality-001.tentative.html [ ImageOnlyFailure ]
 webkit.org/b/214462 imported/w3c/web-platform-tests/css/css-scoping/shadow-directionality-002.tentative.html [ ImageOnlyFailure ]
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 3433c7799ce4..383409fd4bc2 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,18 @@
+2020-08-18  Antti Koivisto  <[email protected]>
+
+        The CSS specificity of :host() pseudo-classes is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=202494
+        <rdar://problem/66292568>
+
+        Reviewed by Anders Carlsson.
+
+        https://drafts.csswg.org/css-scoping/#host-selector
+
+        “The specificity of :host() is that of a pseudo-class, plus the specificity of its argument.”
+
+        * css/CSSSelector.cpp:
+        (WebCore::simpleSelectorSpecificityInternal):
+
 2020-08-18  Youenn Fablet  <[email protected]>
 
         Add a JS built-in routine to mark a promise as handled
diff --git a/Source/WebCore/css/CSSSelector.cpp b/Source/WebCore/css/CSSSelector.cpp
index afd9bab0f9e6..c810b21d9c98 100644
--- a/Source/WebCore/css/CSSSelector.cpp
+++ b/Source/WebCore/css/CSSSelector.cpp
@@ -128,6 +128,7 @@ static unsigned simpleSelectorSpecificityInternal(const CSSSelector& simpleSelec
             return 0;
         case CSSSelector::PseudoClassNthChild:
         case CSSSelector::PseudoClassNthLastChild:
+        case CSSSelector::PseudoClassHost:
             return CSSSelector::addSpecificities(static_cast<unsigned>(SelectorSpecificityIncrement::ClassB), simpleSelector.selectorList() ? maxSpecificity(*simpleSelector.selectorList()) : 0);
         default:
             break;

Background

Advisory: Apple Security Advisory

Attribute Value
CVE CVE-2024-23271
Bugzilla 265812
Component WebCore
Bug Class Bypass
Severity medium
Commit 863558a77cbf5d2c…
Advisory Apple Advisory

Terminology

  • Permissions/Feature Policy — A mechanism that gates powerful features (camera, microphone, fullscreen, geolocation, payment) per embedding context, controlled by the embedder’s allow attribute or default rules.
  • Embedding elements — iframe, embed, object and frame can all host nested browsing contexts; policy must apply to all of them, not just iframe.
  • defaultPolicy — The feature policy applied when no allow attribute is present; the fix uses it for non-iframe owners.

Root Cause Analysis

This fixes a Permissions/Feature Policy enforcement gap: policy was applied only to iframe owners, not to other embedding elements. isFeaturePolicyAllowedByDocumentAndAllOwners walks from a document up to the top document and, for each ancestor, consults the owner element’s feature policy. Pre-patch it only handled the case where the owner was an HTMLIFrameElement: it did dynamicDowncast<HTMLIFrameElement>(ownerElement) and, only if that succeeded, checked iframe->featurePolicy().allows(type, origin); for any other embedding element (for example embed, object, or frame) the owner branch was skipped, so the powerful-feature gate (camera, microphone, fullscreen, geolocation, payment, etc.) was simply not enforced for documents embedded that way. A page could therefore host cross-origin content in a non-iframe embedder and use gated capabilities that Permissions Policy should deny — unexpected cross-origin behavior. The fix computes isAllowedByFeaturePolicy for BOTH cases: iframe owners use iframe->featurePolicy().allows(…), and any other owner element falls back to FeaturePolicy::defaultPolicy(ownerElement->document()).allows(…), i.e. the default (no allow attribute) rules are applied to embed/frame owners; if neither allows it, the check fails. FeaturePolicy::parse is also changed to take the iframe by pointer (nullable) so it can be called for non-iframe owners, and the failure log message changes from ‘for iframe’ to ‘for element’. The restored invariant is that feature/permissions policy is enforced for every embedding element, not just iframes. The added test exercises getUserMedia inside an embed element.

Attack Path

1. Embed cross-origin content without an iframe

Host cross-origin content via a non-iframe embedder (embed/object/frame) rather than an iframe.

2. Skip the policy gate

isFeaturePolicyAllowedByDocumentAndAllOwners only checked iframe owners, so the embedded document’s ancestor check is bypassed.

3. Use a gated feature

Invoke a permissions-policy-gated capability (camera, microphone, fullscreen, geolocation, payment) that should be denied cross-origin.

4. Obtain cross-origin access

The feature is granted despite policy, yielding unexpected cross-origin behavior / access to powerful features.

Impact Assessment

A Permissions/Feature Policy bypass confined to the WebContent process with no memory corruption: cross-origin content embedded via non-iframe elements escaped the policy gate and could reach features (camera, microphone, fullscreen, etc.) that should be denied. Impact is a privacy/policy-enforcement weakness (unexpected cross-origin capability access) rather than code execution.

Audit Directions

Same function: owner-type handling

Audit isFeaturePolicyAllowedByDocumentAndAllOwners and related ownerElement checks for other dynamicDowncast<HTMLIFrameElement> gates that ignore embed/object/frame owners.

Policy checks keyed on iframe

Grep WebCore for featurePolicy()/allow-attribute logic that assumes an HTMLIFrameElement owner and misses other embedding elements.

Changed Functions

Function File Change Note
isFeaturePolicyAllowedByDocumentAndAllOwners Source/WebCore/html/FeaturePolicy.cpp modified Applies the owner’s feature policy for iframe owners and FeaturePolicy::defaultPolicy(…) for any other embedding element, instead of only checking HTMLIFrameElement owners.
FeaturePolicy::parse Source/WebCore/html/FeaturePolicy.cpp modified Takes the iframe as a nullable pointer so the default policy can be parsed/applied for non-iframe owners.
FeaturePolicy::defaultPolicy / parse (declarations) Source/WebCore/html/FeaturePolicy.h modified Exposes a default-policy path usable for embed/frame owners.

Files Changed

Source Files

  • Source/WebCore/html/FeaturePolicy.cpp
  • Source/WebCore/html/FeaturePolicy.h

Test Files

  • LayoutTests/fullscreen/full-screen-enabled-expected.txt
  • LayoutTests/fullscreen/full-screen-enabled-prefixed-expected.txt
  • LayoutTests/fullscreen/full-screen-iframe-not-allowed-expected.txt
  • LayoutTests/fullscreen/full-screen-iframe-without-allow-attribute-allowed-from-parent-expected.txt
  • LayoutTests/fullscreen/full-screen-restrictions-expected.txt
  • LayoutTests/http/tests/fullscreen/fullscreen-feature-policy-expected.txt
  • LayoutTests/http/tests/gamepad/gamepad-allow-attribute.https-expected.txt
  • LayoutTests/http/tests/media/media-stream/enumerate-devices-iframe-allow-attribute-expected.txt
  • LayoutTests/http/tests/media/media-stream/get-user-media-in-embed-element-expected.txt
  • LayoutTests/http/tests/media/media-stream/get-user-media-in-embed-element.html
  • LayoutTests/http/tests/media/media-stream/resources/get-user-media-embed.html
  • LayoutTests/http/tests/paymentrequest/payment-allow-attribute.https-expected.txt
  • LayoutTests/http/tests/security/sandboxed-iframe-geolocation-getCurrentPosition-expected.txt
  • LayoutTests/http/tests/security/sandboxed-iframe-geolocation-watchPosition-expected.txt
  • LayoutTests/http/tests/ssl/media-stream/get-user-media-different-host-expected.txt
  • LayoutTests/http/tests/ssl/media-stream/get-user-media-nested-expected.txt
  • LayoutTests/http/tests/webrtc/enumerateDevicesInFrames-expected.txt
  • LayoutTests/http/tests/webshare/webshare-allow-attribute-canShare.https-expected.txt
  • LayoutTests/http/tests/webshare/webshare-allow-attribute-share.https-expected.txt
  • LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/iframe-allow-expected.txt
  • LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/iframe-allowfullscreen-expected.txt
  • LayoutTests/imported/w3c/web-platform-tests/mediacapture-streams/MediaStream-feature-policy-none.https-expected.txt
  • LayoutTests/imported/w3c/web-platform-tests/permissions-policy/payment-allowed-by-permissions-policy-attribute-redirect-on-load.https.sub-expected.txt
  • LayoutTests/imported/w3c/web-platform-tests/screen-wake-lock/wakelock-enabled-by-feature-policy-attribute-redirect-on-load.https.sub-expected.txt
  • LayoutTests/imported/w3c/web-platform-tests/web-share/disabled-by-permissions-policy-cross-origin.https.sub-expected.txt
  • LayoutTests/platform/glib/imported/w3c/web-platform-tests/mediacapture-streams/MediaStream-feature-policy-none.https-expected.txt
  • LayoutTests/platform/glib/imported/w3c/web-platform-tests/screen-wake-lock/wakelock-enabled-by-feature-policy-attribute-redirect-on-load.https.sub-expected.txt

Regression Test

The fix ships this proof-of-concept / regression test:

diff --git a/LayoutTests/fullscreen/full-screen-enabled-expected.txt b/LayoutTests/fullscreen/full-screen-enabled-expected.txt
index f5c5c513be41..d11846de8955 100644
--- a/LayoutTests/fullscreen/full-screen-enabled-expected.txt
+++ b/LayoutTests/fullscreen/full-screen-enabled-expected.txt
@@ -1,4 +1,4 @@
-CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for iframe with origin '' and allow attribute 'fullscreen 'none''.
+CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for element with origin '' and allow attribute 'fullscreen 'none''.
 This tests the fullscreenEnabled property laid out in section 4 of the W3C Full Screen API
 EXPECTED (iframe.contentDocument.webkitFullscreenEnabled == 'true') OK
 EXPECTED (iframe2.contentDocument.webkitFullscreenEnabled == 'false') OK
diff --git a/LayoutTests/fullscreen/full-screen-enabled-prefixed-expected.txt b/LayoutTests/fullscreen/full-screen-enabled-prefixed-expected.txt
index f5c5c513be41..d11846de8955 100644
--- a/LayoutTests/fullscreen/full-screen-enabled-prefixed-expected.txt
+++ b/LayoutTests/fullscreen/full-screen-enabled-prefixed-expected.txt
@@ -1,4 +1,4 @@
-CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for iframe with origin '' and allow attribute 'fullscreen 'none''.
+CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for element with origin '' and allow attribute 'fullscreen 'none''.
 This tests the fullscreenEnabled property laid out in section 4 of the W3C Full Screen API
 EXPECTED (iframe.contentDocument.webkitFullscreenEnabled == 'true') OK
 EXPECTED (iframe2.contentDocument.webkitFullscreenEnabled == 'false') OK
diff --git a/LayoutTests/fullscreen/full-screen-iframe-not-allowed-expected.txt b/LayoutTests/fullscreen/full-screen-iframe-not-allowed-expected.txt
index c7137c15184c..f56670d5caf5 100644
--- a/LayoutTests/fullscreen/full-screen-iframe-not-allowed-expected.txt
+++ b/LayoutTests/fullscreen/full-screen-iframe-not-allowed-expected.txt
@@ -1,4 +1,4 @@
-CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for iframe with origin '' and allow attribute 'fullscreen 'none''.
+CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for element with origin '' and allow attribute 'fullscreen 'none''.
 Test for bug 56264: Handle entering full screen security restrictions
 
 To test manually, click the "Go full screen" button - the page should not enter full screen mode.
diff --git a/LayoutTests/fullscreen/full-screen-iframe-without-allow-attribute-allowed-from-parent-expected.txt b/LayoutTests/fullscreen/full-screen-iframe-without-allow-attribute-allowed-from-parent-expected.txt
index 9e2a4371735f..8f9baf48350d 100644
--- a/LayoutTests/fullscreen/full-screen-iframe-without-allow-attribute-allowed-from-parent-expected.txt
+++ b/LayoutTests/fullscreen/full-screen-iframe-without-allow-attribute-allowed-from-parent-expected.txt
@@ -1,4 +1,4 @@
-CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for iframe with origin 'null' and allow attribute ''.
+CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for element with origin 'null' and allow attribute ''.
 Test entering full screen security restrictions. An iframe without an allow attribute is still permitted to fullscreen if the request comes from the containing document.
 
 To test manually, press any key - the page should enter full screen mode.
diff --git a/LayoutTests/fullscreen/full-screen-restrictions-expected.txt b/LayoutTests/fullscreen/full-screen-restrictions-expected.txt
index ef97931fc518..a60bd8a7536e 100644
--- a/LayoutTests/fullscreen/full-screen-restrictions-expected.txt
+++ b/LayoutTests/fullscreen/full-screen-restrictions-expected.txt
@@ -1,4 +1,4 @@
-CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for iframe with origin '' and allow attribute 'fullscreen 'none''.
+CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for element with origin '' and allow attribute 'fullscreen 'none''.
 This tests the restrictions to entering full screen mode laid out in section 4.1 of the W3C Full Screen API
 "The context object is not in a document."
 EVENT(webkitfullscreenerror)
diff --git a/LayoutTests/http/tests/fullscreen/fullscreen-feature-policy-expected.txt b/LayoutTests/http/tests/fullscreen/fullscreen-feature-policy-expected.txt
index a051075c8158..b0625abd2f2d 100644
--- a/LayoutTests/http/tests/fullscreen/fullscreen-feature-policy-expected.txt
+++ b/LayoutTests/http/tests/fullscreen/fullscreen-feature-policy-expected.txt
@@ -1,14 +1,14 @@
-CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for iframe with origin 'http://localhost:8000' and allow attribute ''.
-CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for iframe with origin 'http://localhost:8000' and allow attribute 'fullscreen 'none''.
-CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for iframe with origin 'http://127.0.0.1:8000' and allow attribute 'fullscreen 'none''.
-CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for iframe with origin 'http://localhost:8000' and allow attribute 'fullscreen 'self''.
-CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for iframe with origin 'http://127.0.0.1:8000' and allow attribute 'fullscreen http://localhost:8000'.
-CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for iframe with origin 'http://localhost:8000' and allow attribute 'fullscreen 'none''.
-CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for iframe with origin 'http://127.0.0.1:8000' and allow attribute 'fullscreen 'none''.
-CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for iframe with origin 'http://localhost:8000' and allow attribute 'fullscreen 'self''.
-CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for iframe with origin 'http://localhost:8000' and allow attribute 'fullscreen 'none''.
-CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for iframe with origin 'http://127.0.0.1:8000' and allow attribute 'fullscreen 'none''.
-CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for iframe with origin 'http://localhost:8000' and allow attribute 'fullscreen 'self''.
+CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for element with origin 'http://localhost:8000' and allow attribute ''.
+CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for element with origin 'http://localhost:8000' and allow attribute 'fullscreen 'none''.
+CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for element with origin 'http://127.0.0.1:8000' and allow attribute 'fullscreen 'none''.
+CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for element with origin 'http://localhost:8000' and allow attribute 'fullscreen 'self''.
+CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for element with origin 'http://127.0.0.1:8000' and allow attribute 'fullscreen http://localhost:8000'.
+CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for element with origin 'http://localhost:8000' and allow attribute 'fullscreen 'none''.
+CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for element with origin 'http://127.0.0.1:8000' and allow attribute 'fullscreen 'none''.
+CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for element with origin 'http://localhost:8000' and allow attribute 'fullscreen 'self''.
+CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for element with origin 'http://localhost:8000' and allow attribute 'fullscreen 'none''.
+CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for element with origin 'http://127.0.0.1:8000' and allow attribute 'fullscreen 'none''.
+CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for element with origin 'http://localhost:8000' and allow attribute 'fullscreen 'self''.
 PASS iframe with src="http://loc..." should have document.webkitFullscreenEnabled === false.
 PASS iframe with src="../resourc..." should have document.webkitFullscreenEnabled === true.
 PASS iframe with allow="fullscreen", src="http://loc..." should have document.webkitFullscreenEnabled === true.
diff --git a/LayoutTests/http/tests/gamepad/gamepad-allow-attribute.https-expected.txt b/LayoutTests/http/tests/gamepad/gamepad-allow-attribute.https-expected.txt
index 0a0f351b44f7..77d21402b2fc 100644
--- a/LayoutTests/http/tests/gamepad/gamepad-allow-attribute.https-expected.txt
+++ b/LayoutTests/http/tests/gamepad/gamepad-allow-attribute.https-expected.txt
@@ -1,7 +1,7 @@
-CONSOLE MESSAGE: Feature policy 'Gamepad' check failed for iframe with origin 'https://localhost:8443' and allow attribute 'gamepad 'none''.
-CONSOLE MESSAGE: Feature policy 'Gamepad' check failed for iframe with origin 'https://127.0.0.1:8443' and allow attribute 'gamepad 'none''.
-CONSOLE MESSAGE: Feature policy 'Gamepad' check failed for iframe with origin 'https://localhost:8443' and allow attribute 'gamepad 'self''.
-CONSOLE MESSAGE: Feature policy 'Gamepad' check failed for iframe with origin 'https://127.0.0.1:8443' and allow attribute 'gamepad https://localhost:8443'.
+CONSOLE MESSAGE: Feature policy 'Gamepad' check failed for element with origin 'https://localhost:8443' and allow attribute 'gamepad 'none''.
+CONSOLE MESSAGE: Feature policy 'Gamepad' check failed for element with origin 'https://127.0.0.1:8443' and allow attribute 'gamepad 'none''.
+CONSOLE MESSAGE: Feature policy 'Gamepad' check failed for element with origin 'https://localhost:8443' and allow attribute 'gamepad 'self''.
+CONSOLE MESSAGE: Feature policy 'Gamepad' check failed for element with origin 'https://127.0.0.1:8443' and allow attribute 'gamepad https://localhost:8443'.
 PASS iframe src: "https://localhost:8443/gamepad/resources/gamepad-postmessage.html" with allow="" is allowed to call getGamepads().
 PASS iframe src: "https://127.0.0.1:8443/gamepad/resources/gamepad-postmessage.html" with allow="" is allowed to call getGamepads().
 PASS iframe src: "https://localhost:8443/gamepad/resources/gamepad-postmessage.html" with allow="gamepad" is allowed to call getGamepads().
diff --git a/LayoutTests/http/tests/media/media-stream/enumerate-devices-iframe-allow-attribute-expected.txt b/LayoutTests/http/tests/media/media-stream/enumerate-devices-iframe-allow-attribute-expected.txt
index 959cafcc3c82..c7705e321bbb 100644
--- a/LayoutTests/http/tests/media/media-stream/enumerate-devices-iframe-allow-attribute-expected.txt
+++ b/LayoutTests/http/tests/media/media-stream/enumerate-devices-iframe-allow-attribute-expected.txt
@@ -1,21 +1,21 @@
-CONSOLE MESSAGE: Feature policy 'Camera' check failed for iframe with origin 'http://localhost:8000' and allow attribute ''.
-CONSOLE MESSAGE: Feature policy 'Microphone' check failed for iframe with origin 'http://localhost:8000' and allow attribute ''.
+CONSOLE MESSAGE: Feature policy 'Camera' check failed for element with origin 'http://localhost:8000' and allow attribute ''.
+CONSOLE MESSAGE: Feature policy 'Microphone' check failed for element with origin 'http://localhost:8000' and allow attribute ''.
 CONSOLE MESSAGE: Not allowed to call enumerateDevices.
-CONSOLE MESSAGE: Feature policy 'Camera' check failed for iframe with origin 'http://localhost:8000' and allow attribute ''.
-CONSOLE MESSAGE: Feature policy 'Microphone' check failed for iframe with origin 'http://localhost:8000' and allow attribute ''.
+CONSOLE MESSAGE: Feature policy 'Camera' check failed for element with origin 'http://localhost:8000' and allow attribute ''.
+CONSOLE MESSAGE: Feature policy 'Microphone' check failed for element with origin 'http://localhost:8000' and allow attribute ''.
 CONSOLE MESSAGE: Not allowed to call enumerateDevices.
-CONSOLE MESSAGE: Feature policy 'Microphone' check failed for iframe with origin 'http://localhost:8000' and allow attribute ''.
+CONSOLE MESSAGE: Feature policy 'Microphone' check failed for element with origin 'http://localhost:8000' and allow attribute ''.
 CONSOLE MESSAGE: Not allowed to call getUserMedia.
-CONSOLE MESSAGE: Feature policy 'Camera' check failed for iframe with origin 'http://localhost:8000' and allow attribute ''.
+CONSOLE MESSAGE: Feature policy 'Camera' check failed for element with origin 'http://localhost:8000' and allow attribute ''.
 CONSOLE MESSAGE: Not allowed to call getUserMedia.
-CONSOLE MESSAGE: Feature policy 'Camera' check failed for iframe with origin 'http://localhost:8000' and allow attribute ''.
-CONSOLE MESSAGE: Feature policy 'Microphone' check failed for iframe with origin 'http://localhost:8000' and allow attribute ''.
+CONSOLE MESSAGE: Feature policy 'Camera' check failed for element with origin 'http://localhost:8000' and allow attribute ''.
+CONSOLE MESSAGE: Feature policy 'Microphone' check failed for element with origin 'http://localhost:8000' and allow attribute ''.
 CONSOLE MESSAGE: Not allowed to call enumerateDevices.
-CONSOLE MESSAGE: Feature policy 'Camera' check failed for iframe with origin 'http://localhost:8000' and allow attribute 'microphone'.
+CONSOLE MESSAGE: Feature policy 'Camera' check failed for element with origin 'http://localhost:8000' and allow attribute 'microphone'.
 CONSOLE MESSAGE: Not allowed to call getUserMedia.
-CONSOLE MESSAGE: Feature policy 'Microphone' check failed for iframe with origin 'http://localhost:8000' and allow attribute 'camera'.
+CONSOLE MESSAGE: Feature policy 'Microphone' check failed for element with origin 'http://localhost:8000' and allow attribute 'camera'.
 CONSOLE MESSAGE: Not allowed to call getUserMedia.
-CONSOLE MESSAGE: Feature policy 'Camera' check failed for iframe with origin 'http://localhost:8000' and allow attribute 'microphone;speaker-selection'.
+CONSOLE MESSAGE: Feature policy 'Camera' check failed for element with origin 'http://localhost:8000' and allow attribute 'microphone;speaker-selection'.
 CONSOLE MESSAGE: Not allowed to call getUserMedia.
diff --git a/LayoutTests/http/tests/media/media-stream/get-user-media-in-embed-element-expected.txt b/LayoutTests/http/tests/media/media-stream/get-user-media-in-embed-element-expected.txt
new file mode 100644
index 000000000000..2cfc4821ab98
--- /dev/null
+++ b/LayoutTests/http/tests/media/media-stream/get-user-media-in-embed-element-expected.txt
@@ -0,0 +1,7 @@
+CONSOLE MESSAGE: Feature policy 'Camera' check failed for element with origin 'http://localhost:8000' and allow attribute ''.
+CONSOLE MESSAGE: Not allowed to call getUserMedia.
+
+
+PASS Same origin embed should get access to camera
+PASS Cross origin embed should not get access to camera
+
diff --git a/LayoutTests/http/tests/media/media-stream/get-user-media-in-embed-element.html b/LayoutTests/http/tests/media/media-stream/get-user-media-in-embed-element.html
new file mode 100644
index 000000000000..82212184f76e
--- /dev/null
+++ b/LayoutTests/http/tests/media/media-stream/get-user-media-in-embed-element.html
@@ -0,0 +1,22 @@
+<!doctype html>
+<html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<body>
+    <div id="testDiv"></div>
+
+    <script>
+promise_test(async t => {
+    testDiv.innerHTML = '<embed id="embedElement" src="resources/get-user-media-embed.html"></embed>';
+    const result = await new Promise(resolve => window.onmessage = e => resolve(e.data));
+    assert_equals(result, "OK");
+}, "Same origin embed should get access to camera");
+
+promise_test(async t => {
+    testDiv.innerHTML = '<embed id="embedElement" src="http://localhost:8000/media/media-stream/resources/get-user-media-embed.html"></embed>';
+    const result = await new Promise(resolve => window.onmessage = e => resolve(e.data));
+    assert_equals(result, "KO");
+}, "Cross origin embed should not get access to camera");
+    </script>
+</body>
+</html>
diff --git a/LayoutTests/http/tests/media/media-stream/resources/get-user-media-embed.html b/LayoutTests/http/tests/media/media-stream/resources/get-user-media-embed.html
new file mode 100644
index 000000000000..343fea34fe46
--- /dev/null
+++ b/LayoutTests/http/tests/media/media-stream/resources/get-user-media-embed.html
@@ -0,0 +1,9 @@
+<script>
+onload = () => {
+    navigator.mediaDevices.getUserMedia({ video: true }).then(() => {
+        parent.postMessage("OK", "*");
+    }, () => {
+        parent.postMessage("KO", "*");
+    });
+}
+</script>
diff --git a/LayoutTests/http/tests/paymentrequest/payment-allow-attribute.https-expected.txt b/LayoutTests/http/tests/paymentrequest/payment-allow-attribute.https-expected.txt
index 6e201738d888..e0969831057a 100644
--- a/LayoutTests/http/tests/paymentrequest/payment-allow-attribute.https-expected.txt
+++ b/LayoutTests/http/tests/paymentrequest/payment-allow-attribute.https-expected.txt
@@ -1,8 +1,8 @@
-CONSOLE MESSAGE: Feature policy 'Payment' check failed for iframe with origin 'https://localhost:8443' and allow attribute ''.
-CONSOLE MESSAGE: Feature policy 'Payment' check failed for iframe with origin 'https://localhost:8443' and allow attribute 'payment 'none''.
-CONSOLE MESSAGE: Feature policy 'Payment' check failed for iframe with origin 'https://127.0.0.1:8443' and allow attribute 'payment 'none''.
-CONSOLE MESSAGE: Feature policy 'Payment' check failed for iframe with origin 'https://localhost:8443' and allow attribute 'payment 'self''.
-CONSOLE MESSAGE: Feature policy 'Payment' check failed for iframe with origin 'https://127.0.0.1:8443' and allow attribute 'payment https://localhost:8443'.
+CONSOLE MESSAGE: Feature policy 'Payment' check failed for element with origin 'https://localhost:8443' and allow attribute ''.
+CONSOLE MESSAGE: Feature policy 'Payment' check failed for element with origin 'https://localhost:8443' and allow attribute 'payment 'none''.
+CONSOLE MESSAGE: Feature policy 'Payment' check failed for element with origin 'https://127.0.0.1:8443' and allow attribute 'payment 'none''.
+CONSOLE MESSAGE: Feature policy 'Payment' check failed for element with origin 'https://localhost:8443' and allow attribute 'payment 'self''.
+CONSOLE MESSAGE: Feature policy 'Payment' check failed for element with origin 'https://127.0.0.1:8443' and allow attribute 'payment https://localhost:8443'.
 PASS iframe src: "https://localhost:8443/paymentrequest/resources/payment-postmessage.html" with allow="" MUST NOT create a PaymentRequest. SecurityError Third-party iframes are not allowed to request payments unless explicitly allowed via Feature-Policy (payment)
 PASS iframe src: "https://127.0.0.1:8443/paymentrequest/resources/payment-postmessage.html" with allow="" is allowed to create a PaymentRequest.
 PASS iframe src: "https://localhost:8443/paymentrequest/resources/payment-postmessage.html" with allow="payment" is allowed to create a PaymentRequest.
diff --git a/LayoutTests/http/tests/security/sandboxed-iframe-geolocation-getCurrentPosition-expected.txt b/LayoutTests/http/tests/security/sandboxed-iframe-geolocation-getCurrentPosition-expected.txt
index c44e098b6e38..8e287455f4e5 100644
--- a/LayoutTests/http/tests/security/sandboxed-iframe-geolocation-getCurrentPosition-expected.txt
+++ b/LayoutTests/http/tests/security/sandboxed-iframe-geolocation-getCurrentPosition-expected.txt
@@ -1,4 +1,4 @@
-CONSOLE MESSAGE: Feature policy 'Geolocation' check failed for iframe with origin 'null' and allow attribute ''.
+CONSOLE MESSAGE: Feature policy 'Geolocation' check failed for element with origin 'null' and allow attribute ''.
 Tests that navigator.geolocation.getCurrentPosition() returns error PERMISSION_DENIED when called from a document in a sandboxed iframe.
diff --git a/LayoutTests/http/tests/security/sandboxed-iframe-geolocation-watchPosition-expected.txt b/LayoutTests/http/tests/security/sandboxed-iframe-geolocation-watchPosition-expected.txt
index 5983d6d5e82d..6681fe160293 100644
--- a/LayoutTests/http/tests/security/sandboxed-iframe-geolocation-watchPosition-expected.txt
+++ b/LayoutTests/http/tests/security/sandboxed-iframe-geolocation-watchPosition-expected.txt
@@ -1,4 +1,4 @@
-CONSOLE MESSAGE: Feature policy 'Geolocation' check failed for iframe with origin 'null' and allow attribute ''.
+CONSOLE MESSAGE: Feature policy 'Geolocation' check failed for element with origin 'null' and allow attribute ''.
 Tests that navigator.geolocation.watchPosition() returns error PERMISSION_DENIED when called from a document in a sandboxed iframe.
diff --git a/LayoutTests/http/tests/ssl/media-stream/get-user-media-different-host-expected.txt b/LayoutTests/http/tests/ssl/media-stream/get-user-media-different-host-expected.txt
index 68917f7a0334..a734a5524fc7 100644
--- a/LayoutTests/http/tests/ssl/media-stream/get-user-media-different-host-expected.txt
+++ b/LayoutTests/http/tests/ssl/media-stream/get-user-media-different-host-expected.txt
@@ -1,4 +1,4 @@
-CONSOLE MESSAGE: Feature policy 'Microphone' check failed for iframe with origin 'https://localhost:8443' and allow attribute ''.
+CONSOLE MESSAGE: Feature policy 'Microphone' check failed for element with origin 'https://localhost:8443' and allow attribute ''.
 CONSOLE MESSAGE: Not allowed to call getUserMedia.
 Tests that getUserMedia fails when the top level document and iframe do not have the same domain.
diff --git a/LayoutTests/http/tests/ssl/media-stream/get-user-media-nested-expected.txt b/LayoutTests/http/tests/ssl/media-stream/get-user-media-nested-expected.txt
index 9682a789de5a..49fe9e80d423 100644
--- a/LayoutTests/http/tests/ssl/media-stream/get-user-media-nested-expected.txt
+++ b/LayoutTests/http/tests/ssl/media-stream/get-user-media-nested-expected.txt
@@ -1,4 +1,4 @@
-CONSOLE MESSAGE: Feature policy 'Microphone' check failed for iframe with origin 'https://localhost:8443' and allow attribute ''.
+CONSOLE MESSAGE: Feature policy 'Microphone' check failed for element with origin 'https://localhost:8443' and allow attribute ''.
 CONSOLE MESSAGE: Not allowed to call getUserMedia.
 Tests that getUserMedia fails when the top level document and iframe do not have the same domain.
diff --git a/LayoutTests/http/tests/webrtc/enumerateDevicesInFrames-expected.txt b/LayoutTests/http/tests/webrtc/enumerateDevicesInFrames-expected.txt
index 7960fd0fd199..00a93737e2fb 100644
--- a/LayoutTests/http/tests/webrtc/enumerateDevicesInFrames-expected.txt
+++ b/LayoutTests/http/tests/webrtc/enumerateDevicesInFrames-expected.txt
@@ -1,5 +1,5 @@
-CONSOLE MESSAGE: Feature policy 'Camera' check failed for iframe with origin 'http://127.0.0.1:8000' and allow attribute 'microphone:'none'; camera:'none''.
-CONSOLE MESSAGE: Feature policy 'Microphone' check failed for iframe with origin 'http://127.0.0.1:8000' and allow attribute 'microphone:'none'; camera:'none''.
+CONSOLE MESSAGE: Feature policy 'Camera' check failed for element with origin 'http://127.0.0.1:8000' and allow attribute 'microphone:'none'; camera:'none''.
+CONSOLE MESSAGE: Feature policy 'Microphone' check failed for element with origin 'http://127.0.0.1:8000' and allow attribute 'microphone:'none'; camera:'none''.
 CONSOLE MESSAGE: Not allowed to call enumerateDevices.
diff --git a/LayoutTests/http/tests/webshare/webshare-allow-attribute-canShare.https-expected.txt b/LayoutTests/http/tests/webshare/webshare-allow-attribute-canShare.https-expected.txt
index 41df73a40b69..f2abeedf18f0 100644
--- a/LayoutTests/http/tests/webshare/webshare-allow-attribute-canShare.https-expected.txt
+++ b/LayoutTests/http/tests/webshare/webshare-allow-attribute-canShare.https-expected.txt
@@ -1,8 +1,8 @@
-CONSOLE MESSAGE: Feature policy 'WebShare' check failed for iframe with origin 'https://localhost:8443' and allow attribute ''.
-CONSOLE MESSAGE: Feature policy 'WebShare' check failed for iframe with origin 'https://localhost:8443' and allow attribute 'web-share 'none''.
-CONSOLE MESSAGE: Feature policy 'WebShare' check failed for iframe with origin 'https://127.0.0.1:8443' and allow attribute 'web-share 'none''.
-CONSOLE MESSAGE: Feature policy 'WebShare' check failed for iframe with origin 'https://localhost:8443' and allow attribute 'web-share 'self''.
-CONSOLE MESSAGE: Feature policy 'WebShare' check failed for iframe with origin 'https://127.0.0.1:8443' and allow attribute 'web-share https://localhost:8443'.
+CONSOLE MESSAGE: Feature policy 'WebShare' check failed for element with origin 'https://localhost:8443' and allow attribute ''.
+CONSOLE MESSAGE: Feature policy 'WebShare' check failed for element with origin 'https://localhost:8443' and allow attribute 'web-share 'none''.
+CONSOLE MESSAGE: Feature policy 'WebShare' check failed for element with origin 'https://127.0.0.1:8443' and allow attribute 'web-share 'none''.
+CONSOLE MESSAGE: Feature policy 'WebShare' check failed for element with origin 'https://localhost:8443' and allow attribute 'web-share 'self''.
+CONSOLE MESSAGE: Feature policy 'WebShare' check failed for element with origin 'https://127.0.0.1:8443' and allow attribute 'web-share https://localhost:8443'.
 PASS iframe src: "https://localhost:8443/webshare/resources/webshare-postmessage.html" with allow="" MUST NOT be allowed to call canShare().
 PASS iframe src: "https://127.0.0.1:8443/webshare/resources/webshare-postmessage.html" with allow="" is allowed to call canShare().
 PASS iframe src: "https://localhost:8443/webshare/resources/webshare-postmessage.html" with allow="web-share" is allowed to call canShare().
diff --git a/LayoutTests/http/tests/webshare/webshare-allow-attribute-share.https-expected.txt b/LayoutTests/http/tests/webshare/webshare-allow-attribute-share.https-expected.txt
index 00015ad00f5d..fe81a588319e 100644
--- a/LayoutTests/http/tests/webshare/webshare-allow-attribute-share.https-expected.txt
+++ b/LayoutTests/http/tests/webshare/webshare-allow-attribute-share.https-expected.txt
@@ -1,8 +1,8 @@
-CONSOLE MESSAGE: Feature policy 'WebShare' check failed for iframe with origin 'https://localhost:8443' and allow attribute ''.
-CONSOLE MESSAGE: Feature policy 'WebShare' check failed for iframe with origin 'https://localhost:8443' and allow attribute 'web-share 'none''.
-CONSOLE MESSAGE: Feature policy 'WebShare' check failed for iframe with origin 'https://127.0.0.1:8443' and allow attribute 'web-share 'none''.
-CONSOLE MESSAGE: Feature policy 'WebShare' check failed for iframe with origin 'https://localhost:8443' and allow attribute 'web-share 'self''.
-CONSOLE MESSAGE: Feature policy 'WebShare' check failed for iframe with origin 'https://127.0.0.1:8443' and allow attribute 'web-share https://localhost:8443'.
+CONSOLE MESSAGE: Feature policy 'WebShare' check failed for element with origin 'https://localhost:8443' and allow attribute ''.
+CONSOLE MESSAGE: Feature policy 'WebShare' check failed for element with origin 'https://localhost:8443' and allow attribute 'web-share 'none''.
+CONSOLE MESSAGE: Feature policy 'WebShare' check failed for element with origin 'https://127.0.0.1:8443' and allow attribute 'web-share 'none''.
+CONSOLE MESSAGE: Feature policy 'WebShare' check failed for element with origin 'https://localhost:8443' and allow attribute 'web-share 'self''.
+CONSOLE MESSAGE: Feature policy 'WebShare' check failed for element with origin 'https://127.0.0.1:8443' and allow attribute 'web-share https://localhost:8443'.
 PASS iframe src: "https://localhost:8443/webshare/resources/webshare-postmessage.html" with allow="" MUST NOT be allowed to call share(). NotAllowedError Third-party iframes are not allowed to call share() unless explicitly allowed via Feature-Policy (web-share)
 PASS iframe src: "https://127.0.0.1:8443/webshare/resources/webshare-postmessage.html" with allow="" is allowed to call share().
 PASS iframe src: "https://localhost:8443/webshare/resources/webshare-postmessage.html" with allow="web-share" is allowed to call share().
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/iframe-allow-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/iframe-allow-expected.txt
index e94a846045d4..9a47362595cf 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/iframe-allow-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/iframe-allow-expected.txt
@@ -1,4 +1,4 @@
-CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for iframe with origin 'null' and allow attribute ''.
+CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for element with origin 'null' and allow attribute ''.
 
 FAIL iframe-cross-origin-allow assert_false: Feature should be denied when correct allow attribute is added, before reload expected false got true
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/iframe-allowfullscreen-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/iframe-allowfullscreen-expected.txt
index 212875694128..007acd787520 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/iframe-allowfullscreen-expected.txt
+++ b/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/iframe-allowfullscreen-expected.txt
@@ -1,4 +1,4 @@
-CONSOLE MESSAGE: Feature policy 'Fullscreen' check failed for iframe with origin 'null' and allow attribute ''.
... (truncated)