From b1345c4031e1d65b30006df5382bf7e32c03f749 Mon Sep 17 00:00:00 2001 From: mlmrx Date: Mon, 31 Aug 2026 17:14:13 -0700 Subject: [PATCH 1/2] Document Permissions Policy as a security mitigation --- index.bs | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/index.bs b/index.bs index b95748d..127914a 100644 --- a/index.bs +++ b/index.bs @@ -1804,6 +1804,22 @@ respective private browsing modes are safely exposed to [=agents=] and that thes

Mitigations

+

Disabling WebMCP with Permissions Policy

+ +**What:** Disable access to WebMCP APIs in documents where WebMCP is not an intended capability. + +**Threats addressed:** Unintended tool registration or invocation by scripts executing in those +documents, including scripts introduced by injection vulnerabilities or compromised dependencies. + +**How:** Site authors can deliver a Permissions-Policy: tools=() response header. The +empty allowlist makes the {{tools}} [=policy-controlled feature=] unavailable to the document and its +descendants; see [[#permissions-policy]]. This defensive use is not limited to cross-origin +scenarios: same-origin scripts executing in the document are blocked as well. Because the +[=user agent=] enforces the policy before WebMCP API operations run, scripts cannot bypass it by +changing JavaScript load order or replacing page-level guards. This provides defense in depth; it +does not mitigate the underlying script compromise or prevent scripts from using other web +capabilities. +

Restricting maximum input lengths

**What:** Restrict the maximum amount of characters From d8f474138565c9435044855d9a29a7529b51f3b6 Mon Sep 17 00:00:00 2001 From: mlmrx Date: Thu, 10 Sep 2026 03:05:07 -0700 Subject: [PATCH 2/2] Address Permissions Policy review feedback --- index.bs | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/index.bs b/index.bs index 127914a..a9a2af2 100644 --- a/index.bs +++ b/index.bs @@ -1813,12 +1813,9 @@ documents, including scripts introduced by injection vulnerabilities or compromi **How:** Site authors can deliver a Permissions-Policy: tools=() response header. The empty allowlist makes the {{tools}} [=policy-controlled feature=] unavailable to the document and its -descendants; see [[#permissions-policy]]. This defensive use is not limited to cross-origin -scenarios: same-origin scripts executing in the document are blocked as well. Because the -[=user agent=] enforces the policy before WebMCP API operations run, scripts cannot bypass it by -changing JavaScript load order or replacing page-level guards. This provides defense in depth; it -does not mitigate the underlying script compromise or prevent scripts from using other web -capabilities. +descendants; see [[#permissions-policy]]. This defense applies to every descendant frame, including +both same-origin and cross-origin ones. The [=user agent=] enforces this before script runs on the +page, protecting against malicious scripts or dependencies from using WebMCP APIs.

Restricting maximum input lengths