Same-origin documents in different agent clusters can still access each other

The explainer says that same-origin documents with and without Document-Isolation-Policy lose synchronous access to each other. The spec puts them in different agent clusters, but IsPlatformObjectSameOrigin still only compares origins, so nothing actually prevents that access. It needs to also require the same agent cluster.

Relatedly, create and initialize a Document object reuses the initial about:blank document's Window when the origins are same origin-domain, without obtaining an agent. A document with Document-Isolation-Policy that loads in an iframe whose initial about:blank came from a parent without one therefore ends up in the parent's agent cluster. That reuse should require matching agent cluster keys.

See also whatwg/html#12408.

The same applies to javascript: URLs. Navigate to a javascript: URL (https://html.spec.whatwg.org/#navigate-to-a-javascript:-url) only requires the initiator origin to be same origin-domain with the target's active document's origin. A same-origin document without Document-Isolation-Policy can therefore set frameWindow.location to a javascript: URL and run script inside a document with the policy, even once IsPlatformObjectSameOrigin requires the same agent cluster. That check should also require the initiator to be in the target's agent cluster, which means the navigation needs to know the initiator's agent cluster, not just its origin.

Adding a tentative test for this to html/document-isolation-policy/agent-cluster.tentative.https.html.

@noamr

The navigate event is another way for objects to cross agent clusters. Navigate (https://html.spec.whatwg.org/#navigate) passes sourceElement through to the navigate event without checking it, and navigate to a fragment (https://html.spec.whatwg.org/#navigate-fragid) fires the event regardless of who initiated the navigation. If a document with Document-Isolation-Policy has <a target=x href="…#frag"> aimed at a same-origin frame without the policy, that frame's navigate event gets the link as event.sourceElement. Through ownerDocument it then has the other document's entire DOM. For cross-document navigations this applies to any same origin-domain initiator.

We think the inner navigate event firing algorithm (https://html.spec.whatwg.org/#inner-navigate-event-firing-algorithm) should set sourceElement to null unless the element's node document is in the same agent cluster as the event's relevant global object. That's IsPlatformObjectSameOrigin with the agent cluster requirement from this issue's first comment. With that in place, the event itself shares no objects. So we kept firing it as HTML does, rather than also requiring the same agent cluster to fire it.

This covers fragment navigations, cross-document ones, and form submissions, since they all go through that algorithm. Tests are in web-platform-tests/wpt#63353, as part of html/document-isolation-policy/agent-cluster.tentative.https.html.

cc @noamr @farre

The navigate event is another way for objects to cross agent clusters. Navigate (https://html.spec.whatwg.org/#navigate) passes sourceElement through to the navigate event without checking it, and navigate to a fragment (https://html.spec.whatwg.org/#navigate-fragid) fires the event regardless of who initiated the navigation. If a document with Document-Isolation-Policy has <a target=x href="…#frag"> aimed at a same-origin frame without the policy, that frame's navigate event gets the link as event.sourceElement. Through ownerDocument it then has the other document's entire DOM. For cross-document navigations this applies to any same origin-domain initiator.

We think the inner navigate event firing algorithm (https://html.spec.whatwg.org/#inner-navigate-event-firing-algorithm) should set sourceElement to null unless the element's node document is in the same agent cluster as the event's relevant global object. That's IsPlatformObjectSameOrigin with the agent cluster requirement from this issue's first comment. With that in place, the event itself shares no objects. So we kept firing it as HTML does, rather than also requiring the same agent cluster to fire it.

This covers fragment navigations, cross-document ones, and form submissions, since they all go through that algorithm. Tests are in web-platform-tests/wpt#63353, as part of html/document-isolation-policy/agent-cluster.tentative.https.html.

cc @noamr @farre

This sounds reasonable.

Separate same-origin documents with a different Document-Isolation-Po…

Bug 2079563 [wpt PR 63353] - WebKit export of https://bugs.webkit.org…

I tested Chrome for when a same-origin document on the other side of a Document-Isolation-Policy boundary navigates a frame:

Fragment navigations fire navigate with sourceElement null, as suggested above.
Cross-document navigations (location.href, window.open() with a target name, and form submissions) don't fire navigate at all, the way HTML treats a cross-origin initiator. So formData never crosses.

With this issue's first change, being able to script another document means IsPlatformObjectSameOrigin, including the agent cluster check. So the navigate step that fires the event for cross-document navigations should use IsPlatformObjectSameOrigin instead of only checking same origin-domain. Otherwise a frame without the policy could cancel navigations started by a document with the policy that can't otherwise reach it, and formData would hand over the submitter's File objects. Fragment navigations keep firing for any initiator, with sourceElement nulled as above.

I think that's a reasonable model.

A cross-document navigation from another agent cluster fires navigate

Test what still crosses between same-origin documents with and withou…

A cross-document navigation from another agent cluster fires navigate

Navigation Menu

Repository navigation

Same-origin documents in different agent clusters can still access each other #11

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Same-origin documents in different agent clusters can still access each other #11

Description

Activity

annevk commented on Oct 7, 2026

annevk commented on Oct 7, 2026

noamr commented on Oct 7, 2026

annevk commented on Oct 19, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions