Chrome · Fullscreen
CVE-2025-0440
Logic Error in Fullscreen
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
IN_PROC_BROWSER_TEST_Fchrome/browser/webshare/share_service_browsertest.cc |
modified | |
SafeBrowsingShareServiceBrowserTestchrome/browser/webshare/share_service_browsertest.cc |
modified |
Files Changed
chrome/browser/webshare/share_service_browsertest.ccchrome/browser/webshare/share_service_impl.cc
Patch
From 92bebd7aaa776384c1a62b1814ce8de1ab90ea75 Mon Sep 17 00:00:00 2001 From: Hoch Hochkeppel <[email protected]> Date: Fri, 18 Oct 2024 23:07:16 +0000 Subject: [PATCH] Exit fullscreen on Windows for navigator.share The 'Share' experience on Windows is designed with a windowed experience in mind, and results in unintuitive behaviors when invoked from a fullscreen context. To mitigate any risks from these behaviors, and to ensure the optimal user experience, this change ensures that fullscreen is exited prior to starting the Windows portion of the 'Share' flow. Bug: 40067914 Change-Id: I36af174544f738965e988e8d0fb4b29349cad8c5 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5938489 Reviewed-by: Daniel Murphy <[email protected]> Commit-Queue: Hoch Hochkeppel <[email protected]> Reviewed-by: Amanda Baker <[email protected]> Cr-Commit-Position: refs/heads/main@{#1370877} --- diff --git a/chrome/browser/webshare/share_service_browsertest.cc b/chrome/browser/webshare/share_service_browsertest.cc index 1c4f45a..e6a131f 100644 --- a/chrome/browser/webshare/share_service_browsertest.cc +++ b/chrome/browser/webshare/share_service_browsertest.cc @@ -108,6 +108,27 @@ WebShareMethod::kShare, kRepeats); } +#if BUILDFLAG(IS_WIN) +IN_PROC_BROWSER_TEST_F(ShareServiceBrowserTest, Fullscreen) { + base::HistogramTester histogram_tester; + ASSERT_TRUE(embedded_test_server()->Start()); + ASSERT_TRUE(ui_test_utils::NavigateToURL( + browser(), embedded_test_server()->GetURL("/webshare/index.html"))); + content::WebContents* const web_contents = + browser()->tab_strip_model()->GetActiveWebContents(); + + ui_test_utils::FullscreenWaiter waiter(browser(), {.tab_fullscreen = true}); + EXPECT_TRUE( + content::ExecJs(web_contents, "document.body.requestFullscreen();")); + waiter.Wait(); + ASSERT_TRUE(web_contents->IsFullscreen()); + + EXPECT_EQ("share succeeded", + content::EvalJs(web_contents, "share_text('hello')")); + EXPECT_FALSE(web_contents->IsFullscreen()); +} +#endif // BUILDFLAG(IS_WIN) + class SafeBrowsingShareServiceBrowserTest : public ShareServiceBrowserTest { public: SafeBrowsingShareServiceBrowserTest() diff --git a/chrome/browser/webshare/share_service_impl.cc b/chrome/browser/webshare/share_service_impl.cc index 83195cd7..f174b4bb 100644 --- a/chrome/browser/webshare/share_service_impl.cc +++ b/chrome/browser/webshare/share_service_impl.cc @@ -282,6 +282,12 @@ blink::mojom::ShareError result) { std::move(callback).Run(result); }, std::move(sharing_service_operation), std::move(callback))); #elif BUILDFLAG(IS_WIN) + // Drop fullscreen mode so the Share UI can be easily clicked away from, + // without clicking back into the web contents + base::ScopedClosureRunner fullscreen_block = + web_contents->ForSecurityDropFullscreen( + /*display_id=*/display::kInvalidDisplayId); + auto share_operation = std::make_unique<webshare::ShareOperation>( title, text, share_url, web_contents); auto* const share_operation_ptr = share_operation.get(); @@ -289,10 +295,13 @@ std::move(files), base::BindOnce( [](std::unique_ptr<webshare::ShareOperation> share_operation, - ShareCallback callback, blink::mojom::ShareError result) { + base::ScopedClosureRunner fullscreen_block, ShareCallback callback, + blink::mojom::ShareError result) { + fullscreen_block.RunAndReset(); std::move(callback).Run(result); }, - std::move(share_operation), std::move(callback))); + std::move(share_operation), std::move(fullscreen_block), + std::move(callback))); #else NOTREACHED_IN_MIGRATION(); std::move(callback).Run(blink::mojom::ShareError::INTERNAL_ERROR);
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/chrome/browser/webshare/share_service_browsertest.cc b/chrome/browser/webshare/share_service_browsertest.cc
index 1c4f45a..e6a131f 100644
--- a/chrome/browser/webshare/share_service_browsertest.cc
+++ b/chrome/browser/webshare/share_service_browsertest.cc
@@ -108,6 +108,27 @@
WebShareMethod::kShare, kRepeats);
}
+#if BUILDFLAG(IS_WIN)
+IN_PROC_BROWSER_TEST_F(ShareServiceBrowserTest, Fullscreen) {
+ base::HistogramTester histogram_tester;
+ ASSERT_TRUE(embedded_test_server()->Start());
+ ASSERT_TRUE(ui_test_utils::NavigateToURL(
+ browser(), embedded_test_server()->GetURL("/webshare/index.html")));
+ content::WebContents* const web_contents =
+ browser()->tab_strip_model()->GetActiveWebContents();
+
+ ui_test_utils::FullscreenWaiter waiter(browser(), {.tab_fullscreen = true});
+ EXPECT_TRUE(
+ content::ExecJs(web_contents, "document.body.requestFullscreen();"));
+ waiter.Wait();
+ ASSERT_TRUE(web_contents->IsFullscreen());
+
+ EXPECT_EQ("share succeeded",
+ content::EvalJs(web_contents, "share_text('hello')"));
+ EXPECT_FALSE(web_contents->IsFullscreen());
+}
+#endif // BUILDFLAG(IS_WIN)
+
class SafeBrowsingShareServiceBrowserTest : public ShareServiceBrowserTest {
public:
SafeBrowsingShareServiceBrowserTest()
Loading diff…
Original Bug Report
reported by [email protected]
Security: [Esc] KeyPress Does Not Work in FullScreen While navigator.share Is Active
VULNERABILITY DETAILS
We Can Prevent [Esc] KeyPress in Full Screen Mode Using navigator.share
VERSION
Chrome Version: [115.0.5790.99] + [stable]
Operating System: [Windows 10]
REPRODUCTION CASE
- Open PocIndex.html
- Double Click [Click Me!] button
- Done
CREDIT INFORMATION
Reporter credit: Umar Farooq
References
On This Page