◆
webkit security monitor
autonomous cve → commit → rca pipeline

CVE-2026-43721

Overview

Advisory: Apple Security Advisory

Impact:

Description: A malicious website may be able to silently hijack clipboard data

Researchers: Idan Masas

Attribute Value
CVE CVE-2026-43721
Bugzilla 313478
Component WebCore
Bug Class LogicError
Severity medium
Commit d8576e6cceeb0595…
Advisory Apple Advisory

Root Cause Analysis

This issue was addressed through improved state management.

Files Changed

Source Files

  • Source/WebCore/dom/DocumentStorageAccess.cpp
  • Source/WebCore/dom/DocumentStorageAccess.h
  • Source/WebCore/page/ChromeClient.h
  • Source/WebKit/NetworkProcess/Classifier/WebResourceLoadStatisticsStore.cpp
  • Source/WebKit/NetworkProcess/Classifier/WebResourceLoadStatisticsStore.h
  • Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
  • Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.h
  • Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.messages.in
  • Source/WebKit/Scripts/webkit/messages.py
  • Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in
  • Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp
  • Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.h
  • Source/WebKit/WebProcess/WebPage/WebPage.cpp
  • Source/WebKit/WebProcess/WebPage/WebPage.h

Test Files

  • LayoutTests/http/tests/storageAccess/request-storage-access-rejected-without-gesture-should-not-activate-expected.txt
  • LayoutTests/http/tests/storageAccess/request-storage-access-rejected-without-gesture-should-not-activate.html
  • LayoutTests/http/tests/storageAccess/resources/request-storage-access-without-gesture-check-activation-iframe.html