Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: a37a6505759f8bb5f420ccc45828d1f62ae4b8c4
https://github.com/WebKit/WebKit/commit/a37a6505759f8bb5f420ccc45828d1f62ae4b8c4
Author: Pascoe <[email protected]>
Date: 2026-09-10 (Thu, 10 Sep 2026)
Changed paths:
M Source/WebCore/loader/FrameLoader.cpp
M
Tools/TestWebKitAPI/Tests/WebKit/WKWebView/VerifyUserGestureFromUIProcess.mm
Log Message:
-----------
Popunder bypass via overlappping transient activations
https://bugs.webkit.org/show_bug.cgi?id=316816
rdar://177442177
Reviewed by Charlie Wolfe and Abrar Rahman Protyasha.
We should require a transient activation before focusing an existing named
window, to avoid popunders.
The original change consumed the activation. Consuming it is wrong on main:
311026@main made window.open() consume user activation only when it creates a
new browsing context, per "the rules for choosing a navigable", and consuming
here regresses
imported/w3c/web-platform-tests/html/browsers/windows/consume-user-activation/window-open.html.
Requiring the activation without consuming it blocks the popunder just the
same, because the popup's window never has a transient activation of its own:
activation propagates only to ancestor frames and same-origin descendants
within a frame tree, never across top-level windows.
Test:
Tools/TestWebKitAPI/Tests/WebKit/WKWebView/VerifyUserGestureFromUIProcess.mm
* Source/WebCore/loader/FrameLoader.cpp:
(WebCore::createWindow):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/VerifyUserGestureFromUIProcess.mm:
(TestWebKitAPI::TEST(VerifyUserGesture,
PopunderPreventedViaDualEventListeners)):
Originally-landed-as: [email protected] (2057f457fb75).
rdar://184745106
Canonical link: https://commits.webkit.org/320881@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
