@@ -101,7 +101,7 @@
         },
         {
             "id": "AccessibilityProperties",
-            "description": "A structure holding accessibility properties.",
+            "description": "A structure holding accessibility properties, either forwarded to the DOM Element from its backing Accessibility Node, and/or some local properties (e.g., ignored) that may clarify other characteristics, such as why a backing Accessibility Node is not available for this DOM Element.",
             "type": "object",
             "properties": [
                 { "name": "activeDescendantNodeId", "$ref": "NodeId", "optional": true, "description": "<code>DOMNode</code> id of the accessibility object referenced by aria-activedescendant." },
 
@@ -901,13 +901,13 @@ class AXCoreObject : public RefCountedAndCanMakeWeakPtr<AXCoreObject> {
 
     // Helpers that run on any platform and return children and parents, calling the cross frame functions if needed
     // to walk between LocalFrames.
-    AccessibilityChildrenVector crossFrameUnignoredChildren();
+    WEBCORE_EXPORT AccessibilityChildrenVector crossFrameUnignoredChildren();
     size_t crossFrameUnignoredChildrenCount();
     // Whether this object hosts a cross-frame subtree that crossFrameUnignoredChildren() hoists.
     // Returns std::nullopt when the implementation can not cheaply determine (i.e. from a cache)
     // whether a cross-frame child is present.
     virtual std::optional<bool> cachedHasCrossFrameChild();
-    AXCoreObject* crossFrameParentObjectUnignored() const;
+    WEBCORE_EXPORT AXCoreObject* crossFrameParentObjectUnignored() const;
     AccessibilityChildrenVector crossFrameChildrenIncludingIgnored(bool updateChildrenIfNeeded = true);
     bool crossFrameIsAncestorOfObject(const AXCoreObject&) const;
     bool crossFrameIsDescendantOfObject(const AXCoreObject&) const;
 
@@ -606,6 +606,8 @@ set(WebKit_SERIALIZATION_IN_FILES
 
     Shared/Authentication/AuthenticationChallengeDisposition.serialization.in
 
+    Shared/Automation/ComputedAccessibilityProperties.serialization.in
+
     Shared/Databases/IndexedDB/WebIDBResult.serialization.in
 
     Shared/Extensions/WebExtensionActionClickBehavior.serialization.in
 
@@ -249,6 +249,7 @@ $(PROJECT_DIR)/Shared/ApplePay/ApplePayPaymentSetupFeatures.serialization.in
 $(PROJECT_DIR)/Shared/ApplePay/PaymentSetupConfiguration.serialization.in
 $(PROJECT_DIR)/Shared/ApplePay/WebPaymentCoordinatorProxy.messages.in
 $(PROJECT_DIR)/Shared/Authentication/AuthenticationChallengeDisposition.serialization.in
+$(PROJECT_DIR)/Shared/Automation/ComputedAccessibilityProperties.serialization.in
 $(PROJECT_DIR)/Shared/AuxiliaryProcess.messages.in
 $(PROJECT_DIR)/Shared/AuxiliaryProcessCreationParameters.serialization.in
 $(PROJECT_DIR)/Shared/BackgroundFetchChange.serialization.in
 
@@ -705,6 +705,7 @@ SERIALIZATION_DESCRIPTION_FILES = \
 	Shared/AlternativeTextClient.serialization.in \
 	Shared/AppPrivacyReportTestingData.serialization.in \
 	Shared/Authentication/AuthenticationChallengeDisposition.serialization.in \
+	Shared/Automation/ComputedAccessibilityProperties.serialization.in \
 	Shared/BackgroundFetchChange.serialization.in \
 	Shared/BackgroundFetchState.serialization.in \
 	Shared/CacheModel.serialization.in \
 
@@ -437,6 +437,7 @@ def serialized_identifiers():
     # FIXME: This can be derived from *.serialization.in files.
     return [
         'IPC::AsyncReplyID',
+        'WebCore::AXID',
         'WebCore::AgentClusterIdentifier',
         'WebCore::AttributedStringTextListID',
         'WebCore::AttributedStringTextTableBlockID',
@@ -620,6 +621,7 @@ def types_that_cannot_be_forward_declared():
         'PlatformXR::TransientInputHitTestSource',
         'PlatformXR::VisibilityState',
         'String',
+        'WebCore::AXID',
         'WebCore::BackForwardFrameItemIdentifier',
         'WebCore::BackForwardItemIdentifier',
         'WebCore::ColorSpace',
@@ -1388,6 +1390,7 @@ def headers_for_type(type, for_implementation_file=False):
         'WTF::UUID': ['<wtf/UUID.h>'],
         'WallTime': ['<wtf/WallTime.h>'],
         'WebCore::AXDebugInfo': ['<WebCore/AXObjectTypes.h>'],
+        'WebCore::AXID': ['<WebCore/AXID.h>'],
         'WebCore::ActivityStateForCPUSampling': ['<WebCore/ActivityState.h>'],
         'WebCore::AccessibilityMode': ['<WebCore/AXObjectTypes.h>'],
         'WebCore::AccessibilityRemoteToken': ['<WebCore/AccessibilityRemoteToken.h>'],
 
@@ -512,6 +512,7 @@ Vector<ASCIILiteral> serializedIdentifiers()
 {
     return {
         "IPC::AsyncReplyID"_s,
+        "WebCore::AXID"_s,
         "WebCore::AgentClusterIdentifier"_s,
         "WebCore::AttributedStringTextListID"_s,
         "WebCore::AttributedStringTextTableBlockID"_s,
 
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <WebCore/AXID.h>
+#include <WebCore/FrameIdentifier.h>
+#include <WebCore/ProcessIdentifier.h>
+#include <optional>
+#include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebKit {
+
+// The value of a tristate ARIA property such as aria-checked or aria-pressed.
+enum class AccessibilityTriState : uint8_t {
+    False,
+    True,
+    Mixed,
+};
+
+// An AXID is only unique within the AXObjectCache that created it, so an accessibility node is
+// identified by the frame whose document owns it together with its AXID.
+struct AccessibilityNodeReference {
+    WebCore::FrameIdentifier frameID;
+    WebCore::AXID axID;
+};
+
+// Computed accessibility properties sent from the WebProcess to the UIProcess for WebDriver.
+// When this is updated, ComputedAccessibilityProperties.serialization.in must be updated as well.
+struct ComputedAccessibilityProperties {
+    // The process that computed these properties. Frames keep their FrameIdentifier across
+    // process swaps, so the process is part of every accessibility node handle.
+    WebCore::ProcessIdentifier processID;
+    AccessibilityNodeReference accessibilityNode;
+    String role;
+    String label;
+    std::optional<AccessibilityTriState> checked;
+    std::optional<AccessibilityTriState> pressed;
+    std::optional<AccessibilityNodeReference> parentAccessibilityNode;
+    Vector<AccessibilityNodeReference> childAccessibilityNodes;
+};
+
+} // namespace WebKit
@@ -0,0 +1,46 @@
+# Copyright (C) 2026 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR
+# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+header: "ComputedAccessibilityProperties.h"
+enum class WebKit::AccessibilityTriState : uint8_t {
+    False,
+    True,
+    Mixed,
+};
+
+header: "ComputedAccessibilityProperties.h"
+[CustomHeader] struct WebKit::AccessibilityNodeReference {
+    WebCore::FrameIdentifier frameID;
+    WebCore::AXID axID;
+};
+
+header: "ComputedAccessibilityProperties.h"
+struct WebKit::ComputedAccessibilityProperties {
+    WebCore::ProcessIdentifier processID;
+    WebKit::AccessibilityNodeReference accessibilityNode;
+    String role;
+    String label;
+    std::optional<WebKit::AccessibilityTriState> checked;
+    std::optional<WebKit::AccessibilityTriState> pressed;
+    std::optional<WebKit::AccessibilityNodeReference> parentAccessibilityNode;
+    Vector<WebKit::AccessibilityNodeReference> childAccessibilityNodes;
+};
@@ -2,6 +2,20 @@
     "domain": "Automation",
     "description": "Automation domain exposes commands for automating user interactions with the browser.",
     "types": [
+        {
+            "id": "AccessibilityProperties",
+            "type": "object",
+            "description": "Snapshot of a DOM node's computed accessibility properties used in WebDriver contexts.",
+            "properties": [
+                { "name": "accessibilityNodeId", "type": "string", "description": "The opaque handle of the accessibility node. The handle identifies the frame that contains the node." },
+                { "name": "role", "type": "string", "description": "The computed role." },
+                { "name": "label", "type": "string", "description": "The computed label." },
+                { "name": "checked", "type": "string", "optional": true, "description": "The checked state (\"true\", \"false\", or \"mixed\"). Omitted if the node does not support a checked state." },
+                { "name": "pressed", "type": "string", "optional": true, "description": "The pressed state (\"true\", \"false\", or \"mixed\"). Omitted if the node is not a toggle button." },
+                { "name": "parent", "type": "string", "optional": true, "description": "The opaque handle of the parent accessibility node, which may be in a different frame hosted by the same process. Omitted if the node has no parent, including when the node is the root of a frame whose parent frame is hosted by a different process." },
+                { "name": "children", "type": "array", "items": { "type": "string" }, "description": "The opaque handles of the unignored child accessibility nodes, which may be in different frames hosted by the same process. A frame hosted by a different process (for example, a cross-origin iframe with site isolation) appears as a single <code>RemoteFrame</code> node with no children." }
+            ]
+        },
         {
             "id": "Point",
             "type": "object",
@@ -736,6 +750,31 @@
             ],
             "async": true
         },
+        {
+            "name": "getAccessibilityPropertiesForElement",
+            "description": "Get computed accessibility properties for the accessibility node backing a DOM element. Use this when starting from an element reference; the returned <code>accessibilityNodeId</code>, <code>parent</code>, and <code>children</code> values can be passed to <code>getAccessibilityPropertiesForAccessibilityNode</code> to walk the accessibility tree, which may contain nodes that have no corresponding DOM element.",
+            "parameters": [
+                { "name": "browsingContextHandle", "$ref": "BrowsingContextHandle", "description": "The handle for the browsing context." },
+                { "name": "frameHandle", "$ref": "FrameHandle", "optional": true, "description": "The handle for the frame that contains the element. The main frame is used if this parameter is empty string or excluded." },
+                { "name": "nodeHandle", "$ref": "NodeHandle", "description": "The handle of the element to get the accessibility properties for." }
+            ],
+            "returns": [
+                { "name": "properties", "$ref": "AccessibilityProperties" }
+            ],
+            "async": true
+        },
+        {
+            "name": "getAccessibilityPropertiesForAccessibilityNode",
+            "description": "Get computed accessibility properties for an accessibility node from WebKit's accessibility tree. Use this to inspect nodes reached via the <code>accessibilityNodeId</code>, <code>parent</code>, or <code>children</code> values returned by either accessibility properties command. Accessibility node handles identify the frame that contains the node, so no frame handle is needed.",
+            "parameters": [
+                { "name": "browsingContextHandle", "$ref": "BrowsingContextHandle", "description": "The handle for the browsing context." },
+                { "name": "accessibilityNodeId", "type": "string", "description": "The accessibility node to get the accessibility properties for. This is an <code>accessibilityNodeId</code>, <code>parent</code>, or <code>children</code> value previously returned by an accessibility properties command." }
+            ],
+            "returns": [
+                { "name": "properties", "$ref": "AccessibilityProperties" }
+            ],
+            "async": true
+        },
         {
             "name": "selectOptionElement",
             "description": "Selects the given option element. In case of container with multiple options enabled, the element selectedness is toggled.",
Original file line number	Diff line number	Diff line change
`@@ -101,7 +101,7 @@`
`101`	`101`	`},`
`102`	`102`	`{`
`103`	`103`	`"id": "AccessibilityProperties",`
`104`		`- "description": "A structure holding accessibility properties.",`
	`104`	`+ "description": "A structure holding accessibility properties, either forwarded to the DOM Element from its backing Accessibility Node, and/or some local properties (e.g., ignored) that may clarify other characteristics, such as why a backing Accessibility Node is not available for this DOM Element.",`
`105`	`105`	`"type": "object",`
`106`	`106`	`"properties": [`
`107`	`107`	`{ "name": "activeDescendantNodeId", "$ref": "NodeId", "optional": true, "description": "<code>DOMNode</code> id of the accessibility object referenced by aria-activedescendant." },`
Original file line number	Diff line number	Diff line change
`@@ -512,6 +512,7 @@ Vector<ASCIILiteral> serializedIdentifiers()`
`512`	`512`	`{`
`513`	`513`	`return {`
`514`	`514`	`"IPC::AsyncReplyID"_s,`
	`515`	`+ "WebCore::AXID"_s,`
`515`	`516`	`"WebCore::AgentClusterIdentifier"_s,`
`516`	`517`	`"WebCore::AttributedStringTextListID"_s,`
`517`	`518`	`"WebCore::AttributedStringTextTableBlockID"_s,`