312279 2026-04-14 09:24:30 -0700 Non-extractable X25519 CryptoKey stored in IndexedDB returns null on subsequent read in Safari 2026-04-14 21:31:21 -0700 1 1 1 Unclassified WebKit Website Storage Safari 26 Mac (Apple Silicon) macOS 15 NEW https://bugs.webkit.org/show_bug.cgi?id=177350 P2 Normal --- 1 hi webkit-unassigned sihui_liu oldest_to_newest 2200229 0 479067 hi 2026-04-14 09:24:30 -0700 Created attachment 479067 cryptokey-indexeddb-repro.html STEPS TO REPRODUCE: 1. Open the attached HTML file in Safari 2. Observe console output EXPECTED: - crypto.subtle.generateKey() generates a CryptoKey - key is stored in IndexedDB via put() - key is retrieved via get() - loaded key is the same CryptoKey object ACTUAL: After IndexedDB put/get roundtrip, get() returns null for X25519 non-extractable keys. AES-GCM non-extractable keys appear to work correctly. FREQUENCY: 100% reproducible on tested Safari versions. VERSION: Safari 26.4 (macOS 15.4) See also: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.4 Safari/605.1.15 TEST CASE: See attached cryptokey-indexeddb-repro.html 479067 2026-04-14 09:24:30 -0700 2026-04-14 09:24:30 -0700 cryptokey-indexeddb-repro.html cryptokey-indexeddb-repro.html text/html 1708 hi PCFET0NUWVBFIGh0bWw+CjxodG1sPgo8aGVhZD4KPG1ldGEgY2hhcnNldD0iVVRGLTgiPgo8dGl0 bGU+Q3J5cHRvS2V5IEluZGV4ZWREQiBCdWc8L3RpdGxlPgo8L2hlYWQ+Cjxib2R5Pgo8cHJlIGlk PSJvdXQiPjwvcHJlPgo8c2NyaXB0Pgpjb25zdCBsb2cgPSAobXNnKSA9PiB7CiAgZG9jdW1lbnQu Z2V0RWxlbWVudEJ5SWQoJ291dCcpLnRleHRDb250ZW50ICs9IG1zZyArICdcbic7CiAgY29uc29s ZS5sb2cobXNnKTsKfTsKCmNvbnN0IERCX05BTUUgPSAnVGVzdERCJzsKY29uc3QgU1RPUkUgPSAn a2V5cyc7Cgpjb25zdCBvcGVuREIgPSAoKSA9PiBuZXcgUHJvbWlzZSgocmVzLCByZWopID0+IHsK ICBjb25zdCByZXEgPSBpbmRleGVkREIub3BlbihEQl9OQU1FLCAxKTsKICByZXEub251cGdyYWRl bmVlZGVkID0gKCkgPT4gcmVxLnJlc3VsdC5jcmVhdGVPYmplY3RTdG9yZShTVE9SRSk7CiAgcmVx Lm9uc3VjY2VzcyA9ICgpID0+IHJlcyhyZXEucmVzdWx0KTsKICByZXEub25lcnJvciA9ICgpID0+ IHJlaihyZXEuZXJyb3IpOwp9KTsKCmNvbnN0IHB1dCA9IChkYiwga2V5LCB2YWwpID0+IG5ldyBQ cm9taXNlKChyZXMsIHJlaikgPT4gewogIGNvbnN0IHR4ID0gZGIudHJhbnNhY3Rpb24oU1RPUkUs ICdyZWFkd3JpdGUnKTsKICB0eC5vYmplY3RTdG9yZShTVE9SRSkucHV0KHZhbCwga2V5KTsKICB0 eC5vbmNvbXBsZXRlID0gKCkgPT4gcmVzKCk7CiAgdHgub25lcnJvciA9ICgpID0+IHJlaih0eC5l cnJvcik7Cn0pOwoKY29uc3QgZ2V0ID0gKGRiLCBrZXkpID0+IG5ldyBQcm9taXNlKChyZXMsIHJl aikgPT4gewogIGNvbnN0IHR4ID0gZGIudHJhbnNhY3Rpb24oU1RPUkUsICdyZWFkb25seScpOwog IGNvbnN0IHJlcSA9IHR4Lm9iamVjdFN0b3JlKFNUT1JFKS5nZXQoa2V5KTsKICByZXEub25zdWNj ZXNzID0gKCkgPT4gcmVzKHJlcS5yZXN1bHQpOwogIHJlcS5vbmVycm9yID0gKCkgPT4gcmVqKHJl cS5lcnJvcik7Cn0pOwoKKGFzeW5jICgpID0+IHsKICBsb2coYFVzZXIgQWdlbnQ6ICR7bmF2aWdh dG9yLnVzZXJBZ2VudH1gKTsKICBsb2coJycpOwoKICBjb25zdCBkYiA9IGF3YWl0IG9wZW5EQigp OwoKICAvLyBYMjU1MTkgbm9uLWV4dHJhY3RhYmxlCiAgY29uc3QgeDI1NTE5ID0gYXdhaXQgY3J5 cHRvLnN1YnRsZS5nZW5lcmF0ZUtleSh7IG5hbWU6ICdYMjU1MTknIH0sIGZhbHNlLCBbJ2Rlcml2 ZUJpdHMnXSk7CiAgYXdhaXQgcHV0KGRiLCAneDI1NTE5JywgeDI1NTE5LnByaXZhdGVLZXkpOwog IGNvbnN0IGxvYWRlZFgyNTUxOSA9IGF3YWl0IGdldChkYiwgJ3gyNTUxOScpOwogIGxvZyhgWDI1 NTE5IG5vbi1leHRyYWN0YWJsZTogJHtsb2FkZWRYMjU1MTkgPT09IG51bGwgPyAnTlVMTCAoQlVH KScgOiAnT0snfWApOwoKICAvLyBBRVMtR0NNIG5vbi1leHRyYWN0YWJsZSAgCiAgY29uc3QgYWVz ID0gYXdhaXQgY3J5cHRvLnN1YnRsZS5nZW5lcmF0ZUtleSh7IG5hbWU6ICdBRVMtR0NNJywgbGVu Z3RoOiAyNTYgfSwgZmFsc2UsIFsnZW5jcnlwdCcsICdkZWNyeXB0J10pOwogIGF3YWl0IHB1dChk YiwgJ2FlcycsIGFlcyk7CiAgY29uc3QgbG9hZGVkQWVzID0gYXdhaXQgZ2V0KGRiLCAnYWVzJyk7 CiAgbG9nKGBBRVMtR0NNIG5vbi1leHRyYWN0YWJsZTogJHtsb2FkZWRBZXMgPT09IG51bGwgPyAn TlVMTCAoQlVHKScgOiAnT0snfWApOwp9KSgpOwo8L3NjcmlwdD4KPC9ib2R5Pgo8L2h0bWw+Cg==