Open Bug 1670242 (site-isolation-principal-vetting) Opened 6 years ago Updated 1 day ago

[meta] Harden Site-Isolation by introducing IPC based Principal vetting

Categories

(Core :: DOM: Security, task, P3)

Product:
Core
Component:
DOM: Security
Type:
task

Tracking

()

People

(Reporter: ckerschb, Unassigned)

References

(Depends on 17 open bugs, Blocks 1 open bug)

Details

(Keywords: meta, Whiteboard: [domsecurity-meta])

When we load a document in Fission, we load URL into a specific content process. Within this project we wanna make sure that a URL assigned to a specific content process can only send Principals up to the parent process that match the URL of that content process.

While that obviously does not work in all the cases, because e.g. we create Principals for images loaded into a document which might be cross origin, the TriggeringPricnipal should always match the URL of the content process.

We will need a multitude of sub bugs for this project to realize, because there a multitude of different load scenarios, so let's keep this bug as a meta bug.

Depends on: 1670244
Severity: -- → N/A
Priority: -- → P3
Keywords: meta
Depends on: 1671166
Depends on: 1672648
Depends on: fission-ipc-map
Depends on: 1678310
Alias: site-isolation-principal-vetting
Depends on: 1500946
Depends on: 1690844
Depends on: 1696391
Depends on: 1699389
Depends on: 1700639
Blocks: 1639200
No longer blocks: 1639200
Depends on: 1639200
Depends on: 1701670
Depends on: 1703323
Depends on: 1706407
Depends on: 1758161
Depends on: 1873517
Depends on: 1873518
Depends on: 1873519
Depends on: 1873522
Depends on: 2016925
Depends on: 2018164
Depends on: 2020535
Depends on: 1913782
Depends on: 2020534
Depends on: 2020805
Depends on: 2022253
Depends on: 2022260
Depends on: 2022259
Depends on: 2021969
Depends on: 2014254
Depends on: 2010310
Depends on: 2022394
Depends on: 2022681
No longer depends on: 2020534
Depends on: 2024537
Depends on: 2025176
Depends on: 2025531
Depends on: 2025530
Depends on: 2025183
Depends on: 2029339
Depends on: 2031764
Depends on: 2031769
Depends on: 2031768
Depends on: 2032002
Depends on: 2032190
Depends on: CVE-2026-16375
No longer depends on: 2032002
Depends on: 2032370
Depends on: 2033181
Depends on: 2039244
Depends on: 2038450
See Also: → CVE-2026-75874
Depends on: 1495835
Depends on: 1494459
Depends on: 1494457
Depends on: 1494447
Depends on: 2043810
Depends on: 2035756
Depends on: 2043109
No longer depends on: 2043109
Depends on: 2045721
Depends on: 1501072
Depends on: 2045956
No longer depends on: 2038450
Depends on: 2046769
Duplicate of this bug: 1908771
Depends on: 2051062
Depends on: 2052497
No longer depends on: CVE-2026-16401
Depends on: 2041464
Depends on: 2036154
Depends on: 2054785
Depends on: 2054674
Depends on: 2054667
Assignee: ckerschb → nobody
Status: ASSIGNED → NEW
Depends on: 2054671
Depends on: 2023216
Depends on: 2089478
Depends on: 1167039
You need to log in before you can comment on or make changes to this bug.