EIP-2026-103706
PRE-CVEWebKit - Universal XSS in HTMLFrameElementBase::isURLAllowed
Title source: legacyExploitation Summary
EIP tracks 1 public exploit for EIP-2026-103706. PoCs published by Google Security Research.
AI-analyzed exploit summary The writeup details a vulnerability in WebKit's frame handling where an integer overflow in the `m_connectedFrameCount` field allows an attacker to bypass frame detachment checks, leading to a UXSS (Universal Cross-Site Scripting) condition. The root cause is the lack of validation for empty URLs in `isURLAllowed`, enabling the creation of 1024 frames to trigger the overflow.
Description
WebKit - Universal XSS in HTMLFrameElementBase::isURLAllowed
Exploits (1)
The writeup details a vulnerability in WebKit's frame handling where an integer overflow in the `m_connectedFrameCount` field allows an attacker to bypass frame detachment checks, leading to a UXSS (Universal Cross-Site Scripting) condition. The root cause is the lack of validation for empty URLs in `isURLAllowed`, enabling the creation of 1024 frames to trigger the overflow.