312552 2026-04-17 00:28:41 -0700 ParentalControls Filters may accidentally vend an iframe shield instead of a mainframe shield. 2026-04-17 23:00:28 -0700 1 1 1 Unclassified WebKit New Bugs WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 jlee53 jlee53 webkit-bug-importer oldest_to_newest 2201410 0 jlee53 2026-04-17 00:28:41 -0700 ParentalControls Filters may accidentally vend an iframe shield instead of a mainframe shield. We use the criteria that the current mainFrameURL is null to determine whether or not we have an iframe or a mainframe. This worked for the most part because testing was done with URLs that trigger process swaps because the scheme of the blocked page is different. In that situation, we start with a brand new mainFrameURL as the load has not been populated yet. But in the case where the same process is re-used, we still have the residual mainFrameURL and so we vend the iframe shield instead. The code currently assumes that mainFrameURL will always be null on a fresh navigation. This is wrong. Instead, the code is changed to (a) make it clear that the "mainFrameURL" we are populating is explicitly for transitive trust / iFrames by refactoring mainDocumentURL to transitiveTrustMainDocumentURL, (b) we only populate the transitiveTrustMainDocumentURL if we are an iframe and we use existing DocumentLoader/NetworkResourceLoader to determine this. 2201411 1 jlee53 2026-04-17 00:30:15 -0700 I tested that this code works for correctly vending both mainFrame and iFrame shields. 2201415 2 jlee53 2026-04-17 00:34:46 -0700 <rdar://problem/173774144> 2201418 3 jlee53 2026-04-17 00:38:48 -0700 Pull request: https://github.com/WebKit/WebKit/pull/62959 2201781 4 ews-feeder 2026-04-17 23:00:25 -0700 Committed 311515@main (e48835c9f88c): <https://commits.webkit.org/311515@main> Reviewed commits have been landed. Closing PR #62959 and removing active labels.