fix: attribute pointer lock, keyboard lock and paste checks to the requesting frame - #53664
Merged
Merged
Conversation
…questing frame
* pointerLock / keyboardLock permission requests are made for the frame that
owns the requesting widget instead of always the primary main frame, so
setPermissionRequestHandler sees the iframe's requestingUrl / isMainFrame
* the deprecated sync clipboard read (execCommand('paste')) is allowed on
transient user activation of the requesting frame, matching Chrome, instead
of any recent interaction anywhere in the WebContents; otherwise the
clipboard permission check decides as before
* docs: drop the "always appear to originate from the main frame" caveat
* specs for both
MarshallOfSound
added
semver/patch
MarshallOfSound
enabled auto-merge (squash)
September 7, 2026 09:08
codebytere
approved these changes
Sep 7, 2026
|
Release Notes Persisted
|
Contributor
|
I was unable to backport this PR to "43-x-y" cleanly; |
Contributor
|
I was unable to backport this PR to "42-x-y" cleanly; |
trop
Bot
added
needs-manual-bp/43-x-y
needs-manual-bp/42-x-y
and removed
target/43-x-y
This was referenced Sep 7, 2026
Contributor
|
I have automatically backported this PR to "45-x-y", please check out #53692 |
Contributor
|
I have automatically backported this PR to "44-x-y", please check out #53693 |
trop
Bot
added
in-flight/44-x-y
and removed
target/45-x-y
Contributor
|
@MarshallOfSound has manually backported this PR to "43-x-y", please check out #53701 |
Contributor
|
@MarshallOfSound has manually backported this PR to "42-x-y", please check out #53702 |
trop
Bot
added
in-flight/42-x-y
merged/45-x-y
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
pointerLock/keyboardLockpermission requests are made for the frame that called the API rather than always the primary main frame, sosetPermissionRequestHandlersees that frame'srequestingUrl/isMainFrame.document.execCommand('paste')is allowed on transient user activation of the requesting frame (as in Chrome) instead of any recent interaction in the WebContents; otherwise theclipboard-readcheck decides as before.Notes:
pointerLockandkeyboardLockpermission requests now report the requesting frame, andexecCommand('paste')requires user activation in the frame that calls it.