Bug 295336

Summary:

Cross-origin XMLHttpRequest triggers additional extension permissions request

Product:

WebKit

Reporter:

Jeff Johnson <opendarwin>

Component:

WebKit Extensions

Assignee:

Nobody <webkit-unassigned>

Status:

NEW

Severity:

Normal

CC:

annevk, timothy, webkit-bug-importer

Priority:

Keywords:

InRadar

Version:

Safari 18

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Sample Safari extension	none
Screenshot	none
Screenshot	none
Screenshot	none
iOS screenshot	none
iOS screenshot	none

Jeff Johnson

Reported 2025-07-02 08:54:35 PDT

Created attachment 475748 [details] Sample Safari extension Steps to reproduce: 1. Download and unzip the attached sample Safari extension in Resources.zip 2. Enable the extension in Safari 3. In Terminal, cd Downloads/Resources 4. /usr/bin/python3 -m http.server 5. Open http://localhost:8000 in Safari See the attached screenshots showing the permission requests. This happens in the main frame and also in iframes, and even if the extension has no website permissions already. If you first grant the extension permission to access localhost:8000, there are still permission requests for example.org and example.com. I've seen this bug occur on iOS as well as macOS, though I haven't able to reproduce it until now. The bug also occurs in Safari web apps.

Attachments
Sample Safari extension (203.55 KB, application/zip) 2025-07-02 08:54 PDT, Jeff Johnson	no flags	Details
Screenshot (611.34 KB, image/png) 2025-07-02 08:54 PDT, Jeff Johnson	no flags	Details
Screenshot (143.99 KB, image/png) 2025-07-02 08:55 PDT, Jeff Johnson	no flags	Details
Screenshot (588.71 KB, image/png) 2025-07-02 08:55 PDT, Jeff Johnson	no flags	Details
iOS screenshot (348.52 KB, image/png) 2025-07-02 08:55 PDT, Jeff Johnson	no flags	Details
iOS screenshot (98.66 KB, image/png) 2025-07-02 08:56 PDT, Jeff Johnson	no flags	Details
View All Add attachment proposed patch, testcase, etc.