WebKit: Stealing variables via page navigation in FrameLoader::clear CVE-2017-2515 void FrameLoader::clear(Document* newDocument, bool clearWindowProperties, bool clearScriptObjects, bool clearFrameView) { m_frame.editor().clear(); if (!m_needsClear) return; m_needsClear = false; if (m_frame.document()->pageCacheState() != Document::InPageCache) { ... m_frame.document()->prepareForDestruction(); <<-------- (a) if (hadLivingRenderTree) m_frame.document()->removeFocusedNodeOfSubtree(*m_frame.document()); } ... m_frame.setDocument(nullptr); <<------- (b) ... if (clearWindowProperties) m_frame.script().setDOMWindowForWindowShell(newDocument->domWindow()); <<------- (c) ... } FrameLoader::clear is called when page navigation is made and it does: 1. clear the old document at (b). 2. attach the new window object at (c). If a new page navigation is made at (a), the new window will not attached due to |m_needsClear| check. As a result, the new document's script will be execute on the old window object. PoC will reproduce to steal |secret_key| value from another origin(data:text/html,...). PoC: Click anywhere. This bug is subject to a 90 day disclosure deadline. After 90 days elapse or a patch has been made broadly available, the bug report will become visible to the public. Found by: lokihardt