311286 2026-04-01 14:08:06 -0700 [Site Isolation] Console log is intentionally missing the full URL of a RemoteFrame for http/tests/security/block-top-level-navigations-by-sandboxed-iframe-with-propagated-user-gesture.html 2026-04-03 11:12:04 -0700 1 1 1 Unclassified WebKit New Bugs WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 a.tarbinian webkit-unassigned webkit-bug-importer oldest_to_newest 2196001 0 a.tarbinian 2026-04-01 14:08:06 -0700 In http/tests/security/block-top-level-navigations-by-sandboxed-iframe-with-propagated-user-gesture.html, with site isolation enabled the console message logging "Unsafe JavaScript attempt to initiate navigation" will not contain the full URL (including resource path) of RemoteFrames. This is the diff: ``` @@ -1,4 +1,4 @@ -CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate navigation for frame with URL 'http://127.0.0.1:8000/security/block-top-level-navigations-by-sandboxed-iframe-with-propagated-user-gesture.html' from frame with URL 'http://localhost:8000/security/resources/navigate-top-level-frame-to-failure-page-via-message-handler.html'. The frame attempting navigation of the top-level window is sandboxed, but the 'allow-top-navigation' flag is not set. +CONSOLE MESSAGE: Unsafe JavaScript attempt to initiate navigation for frame with URL 'http://127.0.0.1:8000/' from frame with URL 'http://localhost:8000/security/resources/navigate-top-level-frame-to-failure-page-via-message-handler.html'. The frame attempting navigation of the top-level window is sandboxed, but the 'allow-top-navigation' flag is not set. CONSOLE MESSAGE: SecurityError: The operation is insecure. Test blocking of top-level navigations by an iframe with `sandbox=allow-top-navigation-by-user-activation` when the user gesture is propagated from another context. ``` This difference is thanks to https://commits.webkit.org/310093@main where we decided to prevent frames from fetching the full URL path of remote frames in different processes. http/tests/security/block-top-level-navigations-by-sandboxed-iframe-with-propagated-user-gesture.html also has the same inconsistency in behavior with site isolation enabled vs disabled. 2196002 1 webkit-bug-importer 2026-04-01 14:08:13 -0700 <rdar://problem/173883912> 2196008 2 a.tarbinian 2026-04-01 14:30:44 -0700 Pull request: https://github.com/WebKit/WebKit/pull/61851 2196636 3 ews-feeder 2026-04-03 11:12:03 -0700 Committed 310523@main (80a2f83fa96b): <https://commits.webkit.org/310523@main> Reviewed commits have been landed. Closing PR #61851 and removing active labels.