WebKit Navigation API `NavigateEvent.sourceElement` Cross-Origin DOM Leak (CVE-2026-43735)

Metadata

Affected Target

Summary

CVE-2026-43735 is a WebKit Navigation API bug where, when a parent page uses a named <a target="iframeName"> link to trigger a fragment navigation inside a cross-origin <iframe>, the NavigateEvent.sourceElement delivered to the iframe’s navigate event listener is the parent page’s own <a> element rather than being nulled out for cross-origin navigations. Because sourceElement.ownerDocument is the entire parent document, the cross-origin iframe can read and modify the parent page’s DOM (and even inject/execute script in the parent’s origin), fully bypassing the same-origin policy.

Vulnerability Details

Root Cause

In Navigation::innerDispatchNavigateEvent, WebKit did not perform an origin check before attaching a sourceElement to the dispatched NavigateEvent when the navigation was initiated by a target-scoped link click from a different origin (i.e., a parent page navigating a cross-origin iframe it embeds). The event’s sourceElement therefore referenced the actual DOM node (<a>) from the parent document, giving the iframe’s script full access to sourceElement.ownerDocument — the parent document — instead of null.

Attack Vector

1. Victim (origin A) page embeds an attacker’s iframe (origin B) and defines a link <a target="targetFrame" href=".../#updated"> pointing to the iframe.
2. The iframe (origin B) registers a navigate event listener via the Navigation API and signals readiness to the parent via postMessage.
3. The parent page programmatically clicks the link, causing a fragment navigation (#updated) inside the cross-origin iframe.
4. The iframe’s navigate event handler receives a NavigateEvent whose event.sourceElement is the parent’s <a> element (vulnerable versions) rather than null.
5. The iframe reads sourceElement.ownerDocument.querySelector(...) to exfiltrate parent-page DOM content (e.g. account email, account ID) and can equally mutate the parent DOM or inject a <script> element to execute arbitrary JavaScript in the parent’s origin.

Impact

A cross-origin iframe can read and modify the embedding page’s DOM and execute script in the embedding page’s origin — a full same-origin-policy bypass. This can lead to theft of sensitive on-page data (PII, account identifiers, tokens rendered in the DOM), UI/DOM manipulation for phishing, or session/account takeover if combined with further script injection into the parent origin.

Environment / Lab Setup

Target:   Safari / WebKit < 26.5.2
Attacker: Cross-origin iframe host (attacker.html) embedded by a victim page (victim.html)

Proof of Concept

PoC Script

See victim.html (parent/victim page) and attacker.html (cross-origin iframe) in this folder.

victim.html renders a fake account panel (#profile-email, #account-panel[data-account-id]) and clicks a link that navigates the embedded cross-origin iframe. attacker.html’s navigate event handler inspects event.sourceElement; on vulnerable builds it successfully reads alice@example.test / ACCOUNT_314159 out of the parent document and reports [LEAK] ... back via postMessage. On patched builds (>= 26.5.2) sourceElement is null and the page reports [PATCHED].

Detection & Indicators of Compromise

Signs of compromise:

• Third-party embedded iframes exfiltrating data that should only be available to the embedding page’s own origin.
• Unexpected DOM mutations or injected <script> elements in a page originating from an embedded cross-origin iframe’s Navigation API handler.

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/dem0ns/CVE-2026-43735 on 2026-07-05.