CVE-2026-28958

Overview

Advisory: Apple Security Advisory

Impact:

Description: An app may be able to access sensitive user data

Researchers: Cantina

Root Cause Analysis

FrameLoader::load called addSameSiteInfoToRequestIfNeeded before checking if the initiator should inherit the security origin from its owner. This caused SameSite=Strict cookies to be sent on cross-site navigations initiated by iframes. Fix: Passes initiator.ptr() only when shouldInheritSecurityOriginFromOwner is false.

Attack Path

1. Step 1

Attacker embeds a malicious iframe on attacker.com.

2. Step 2

Iframe initiates a navigation to victim.com.

3. Step 3

FrameLoader adds SameSite info before verifying origin inheritance.

4. Step 4

SameSite=Strict cookies for victim.com are incorrectly included.

5. Step 5

CSRF or session hijacking via forged cross-site request.

Files Changed

Source Files

• Source/WebCore/loader/MixedContentChecker.cpp

Patch Preview

diff --git a/Source/WebCore/loader/MixedContentChecker.cpp b/Source/WebCore/loader/MixedContentChecker.cpp
index bd42f3d7c2bd..f7c90310966e 100644
--- a/Source/WebCore/loader/MixedContentChecker.cpp
+++ b/Source/WebCore/loader/MixedContentChecker.cpp
@@ -131,10 +131,6 @@ bool MixedContentChecker::canModifyRequest(const URL& url, FetchOptions::Destina
 
 bool MixedContentChecker::shouldBlockRequest(Frame& frame, const URL& url, IsUpgradable isUpgradable)
 {
-    RefPtr<Document> document;
-    if (auto* localFrame = dynamicDowncast<LocalFrame>(frame))
-        document = localFrame->document();
-
 #if ENABLE(CONTENT_FILTERING) && HAVE(WEBCONTENTRESTRICTIONS)
     if (url == ContentFilter::blockedPageURL())
         return false;