PatchGap
Chrome · Extensions › Platform>Extensions

CVE-2025-0446

Logic Error in Extensions (Platform>Extensions)
Low watch CVSS 4.3 chrome Logic Error 📄 Reporter bug report 🔧 Commit mapped 🧬 Security UI spoofable via occlusion late-binding timing or geometry

Overview

Low
Severity
4.3
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInappropriate implementation in Extensions
DescriptionInappropriate implementation in Extensions
ComponentExtensions
Sub-componentPlatform>Extensions
Bug ClassLogic Error
Action tierwatch — logic/policy bug — security-relevant, no memory-unsafety
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.
Tracker359949844
Fix commite0674d25b198 (chromium/src) +12/-0
CWECWE-451
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CISA KEVNot listed
CreditedHafiizh
Reported2024-08-15 · bounty $1000 (per vendor advisory)
Fix landed2024-11-08 (public git)
Disclosed2025-01-14
Patch gap67 days — fix public in source before the advisory

Background

`extensions::SecurityDialogTracker`
A singleton that records which views::Widget instances are security-sensitive dialogs so the extension UI can avoid painting over them.
Extension bubble
The views::BubbleDialogDelegateView that a browser-action or page-action extension renders, which is normally z-ordered above other browser dialogs.
FedCM account selection dialog
The WebID identity-provider account chooser rendered by AccountSelectionBubbleView and AccountSelectionModalView, used to authorize federated sign-in.
PWA install dialog
The PWAConfirmationBubbleView prompt that asks the user to confirm installing a Progressive Web App.

Root Cause Analysis

When a FedCM account selection dialog or a PWA installation dialog was shown, its backing views::Widget was never registered with extensions::SecurityDialogTracker, so the tracker treated these prompts as ordinary, non-sensitive UI. Because the tracker is what suppresses extension bubbles from rendering above security-sensitive surfaces, an extension bubble could be painted on top of one of these dialogs and overlap or spoof its trusted contents. The security invariant that user-consequential confirmation dialogs must be occlusion-protected from extension-controlled UI was therefore violated for these two dialog families.

The fix restores the invariant by calling extensions::SecurityDialogTracker::GetInstance()->AddSecurityDialog() on each dialog’s widget at construction/show time, in PWAConfirmationBubbleView, AccountSelectionBubbleView, and AccountSelectionModalView. Once registered, the extension bubble logic refuses to draw above these widgets, so a malicious extension can no longer overlay them.

The fix works because it plugs the specific dialogs into the pre-existing occlusion-protection mechanism rather than changing the mechanism itself.

Key insight
The core mistake was that two high-stakes confirmation dialogs were simply never enrolled in the existing extensions::SecurityDialogTracker protection, leaving them occludable by extension UI; the fix addresses it by registering each dialog’s views::Widget via AddSecurityDialog().

Attack Path

  1. Install malicious extension A user installs an extension that has an action bubble it can display at will over the current browser window.
  2. Trigger a sensitive dialog The attacker (or a cooperating site) causes a FedCM account chooser or a PWA install prompt to appear, e.g. by initiating federated sign-in or an app install.
  3. Overlay the extension bubble The extension renders its bubble, which is z-ordered above the unprotected dialog because the dialog was never marked security-sensitive.
  4. Spoof or misdirect The overlay hides or alters portions of the trusted prompt, tricking the user into clicking a button (e.g. confirming sign-in or install) they did not intend.
  5. Consent captured The user’s misdirected interaction grants federated identity or installs an app, completing the deception.

Impact Assessment

An attacker with an installed extension gains the ability to visually spoof or occlude trusted browser confirmation dialogs, causing users to unknowingly approve federated sign-ins or PWA installations. The attack occurs in the browser-process UI layer and requires the victim to have installed the malicious extension and to encounter one of the affected dialogs. The gain is user deception and unintended consent rather than direct memory corruption, consistent with the LogicError / inappropriate-implementation classification.

Changed Functions

FunctionChangeNotes
if
chrome/browser/ui/views/webid/account_selection_bubble_view.cc
 modified

Files Changed

  • chrome/browser/ui/views/web_apps/pwa_confirmation_bubble_view.cc
  • chrome/browser/ui/views/webid/account_selection_bubble_view.cc
  • chrome/browser/ui/views/webid/account_selection_modal_view.cc

Audit Directions

  • Unregistered consequential dialogs
    Enumerate other confirmation, permission, or authentication dialogs (e.g. payment, permission prompts, download confirmations) and verify each calls SecurityDialogTracker::AddSecurityDialog() on its views::Widget.
  • New dialog widget creation sites
    Audit every views::DialogDelegate::CreateDialogWidget and bubble construction path introduced later to ensure security-sensitive prompts are enrolled at creation time, not left to default z-ordering.
  • Occlusion of trusted UI by extensions
    Review any UI surface that extension-controlled bubbles, popups, or windows can be z-ordered above, checking whether that surface conveys a trust decision that could be spoofed.

Patch

view commit
From e0674d25b198c5240d276c9cb823bad1a67604d0 Mon Sep 17 00:00:00 2001
From: Keren Zhu <[email protected]>
Date: Fri, 08 Nov 2024 19:22:50 +0000
Subject: [PATCH] Mark some dialogs as security-sensitive for extension

This CL marks the FedCM account selection dialog and the PWAs
installation dialog as security-sensitive for extensions. This
effectively prevents the extension bubble from rendering above these
dialogs, so that a malicious extension cannot trick users into
interacting with them.

Fixed: 376497151, 359949844
Change-Id: I74448a677523da74d83d1c05d5d5da8e0ee3b29c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5995850
Code-Coverage: [email protected] <[email protected]>
Commit-Queue: Keren Zhu <[email protected]>
Reviewed-by: Allen Bauer <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1380525}
---

diff --git a/chrome/browser/ui/views/web_apps/pwa_confirmation_bubble_view.cc b/chrome/browser/ui/views/web_apps/pwa_confirmation_bubble_view.cc
index 0eb1638..04d932b 100644
--- a/chrome/browser/ui/views/web_apps/pwa_confirmation_bubble_view.cc
+++ b/chrome/browser/ui/views/web_apps/pwa_confirmation_bubble_view.cc
@@ -16,6 +16,7 @@
 #include "chrome/browser/feature_engagement/tracker_factory.h"
 #include "chrome/browser/ui/browser_finder.h"
 #include "chrome/browser/ui/views/chrome_layout_provider.h"
+#include "chrome/browser/ui/views/extensions/security_dialog_tracker.h"
 #include "chrome/browser/ui/views/page_action/page_action_icon_view.h"
 #include "chrome/browser/ui/views/web_apps/web_app_info_image_source.h"
 #include "chrome/browser/ui/views/web_apps/web_app_views_utils.h"
@@ -188,6 +189,11 @@
     ok_button->SetProperty(views::kElementIdentifierKey,
                            PWAConfirmationBubbleView::kInstallButton);
   }
+
+  // Mark PWA install dialogs as security-sensitive for extension.
+  // This prevents extension bubbles from obsecuring a PWA install dialog.
+  extensions::SecurityDialogTracker::GetInstance()->AddSecurityDialog(
+      GetWidget());
 }
 
 bool PWAConfirmationBubbleView::OnCloseRequested(
diff --git a/chrome/browser/ui/views/webid/account_selection_bubble_view.cc b/chrome/browser/ui/views/webid/account_selection_bubble_view.cc
index a041be0..20550b2 100644
--- a/chrome/browser/ui/views/webid/account_selection_bubble_view.cc
+++ b/chrome/browser/ui/views/webid/account_selection_bubble_view.cc
@@ -18,6 +18,7 @@
 #include "chrome/browser/ui/monogram_utils.h"
 #include "chrome/browser/ui/passwords/ui_utils.h"
 #include "chrome/browser/ui/views/controls/hover_button.h"
+#include "chrome/browser/ui/views/extensions/security_dialog_tracker.h"
 #include "chrome/browser/ui/views/webid/account_selection_view_base.h"
 #include "chrome/browser/ui/views/webid/fedcm_account_selection_view_desktop.h"
 #include "chrome/browser/ui/views/webid/webid_utils.h"
@@ -230,6 +231,8 @@
     return;
   }
 
+  extensions::SecurityDialogTracker::GetInstance()->AddSecurityDialog(widget);
+
   // Add the widget observer, if available. It is null in tests.
   if (widget_observer_) {
     widget->AddObserver(widget_observer_);
diff --git a/chrome/browser/ui/views/webid/account_selection_modal_view.cc b/chrome/browser/ui/views/webid/account_selection_modal_view.cc
index 90cc4f9..4e449126 100644
--- a/chrome/browser/ui/views/webid/account_selection_modal_view.cc
+++ b/chrome/browser/ui/views/webid/account_selection_modal_view.cc
@@ -18,6 +18,7 @@
 #include "chrome/browser/net/system_network_context_manager.h"
 #include "chrome/browser/ui/monogram_utils.h"
 #include "chrome/browser/ui/views/controls/hover_button.h"
+#include "chrome/browser/ui/views/extensions/security_dialog_tracker.h"
 #include "chrome/browser/ui/views/webid/account_selection_view_base.h"
 #include "chrome/browser/ui/views/webid/fedcm_account_selection_view_desktop.h"
 #include "chrome/browser/ui/views/webid/webid_utils.h"
@@ -196,6 +197,8 @@
       views::Widget::GetWidgetForNativeWindow(top_level_native_window);
   views::Widget* widget = views::DialogDelegate::CreateDialogWidget(
       this, /*context=*/nullptr, /*parent=*/top_level_widget->GetNativeView());
+  extensions::SecurityDialogTracker::GetInstance()->AddSecurityDialog(widget);
+
   widget->Show();
   UpdateDialogPosition();
Loading diff…

Original Bug Report

reported by [email protected]

Extension popup can render over PWA prompts

VULNERABILITY DETAILS This vulnerability is almost the same as https://issues.chromium.org/issues/40058873 but it occurs on PWA prompt

VERSION Chrome Version: 129.0.6657.0 (Official Build) canary (64-bit) Operating System: Windows 10

REPRODUCTION CASE

  1. Install attached extension: manifest-keyboard.json + bg-keyboard.js + popup.html. Rename the manifest file to manifest.json

  2. Reload manifest-keyboard.json extension using chrome://extensions Press Ctrl+A when requested by the attacker page.

  3. Click the Web page then Press Ctrl+A when requested by the attacker page.

CREDIT INFORMATION Externally reported security bugs may appear in Chrome release notes. If this bug is included, how would you like to be credited? Reporter credit: [goes here]

View on issue tracker
Uploaded PoC files
On This Page