RESOLVED FIXED310760
document.open() should not alias the caller's security origin 
https://bugs.webkit.org/show_bug.cgi?id=310760
Summary document.open() should not alias the caller's security origin
Ahmad Saleem
Reported 2026-03-25 18:18:09 PDT
ssia - aligning with specification - https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#document-open-steps - step 12
Attachments
Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2026-03-25 18:18:17 PDT
<rdar://problem/173369038>
Ahmad Saleem
Comment 2 2026-03-25 18:20:53 PDT
Pull request: https://github.com/WebKit/WebKit/pull/61363
EWS
Comment 3 2026-04-03 17:12:26 PDT
Committed 310543@main (cbbbc03ee0ea): <https://commits.webkit.org/310543@main> Reviewed commits have been landed. Closing PR #61363 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.