Chrome · Permissions
CVE-2025-12906
Logic Error in Permissions
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
third_party/blink/renderer/core/html/resources/permission.cssthird_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-ref.htmlthird_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-tentative.html
Patch
From 6ab0f046554dcc728e6e875de79578ae95bb3e5f Mon Sep 17 00:00:00 2001 From: Thomas Nguyen <[email protected]> Date: Wed, 02 Jul 2025 08:41:08 -0700 Subject: [PATCH] [PEPC] Reset CSS inherited style for permission's internal text element. This ensures that the permission's internal text will not inherit text style from its parent. Bug: 428455319 Change-Id: I8d4b61efe010fd4ea24913afaaafba8b9105a80f Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6696007 Commit-Queue: Thomas Nguyen <[email protected]> Reviewed-by: Joey Arhar <[email protected]> Cr-Commit-Position: refs/heads/main@{#1481641} --- diff --git a/third_party/blink/renderer/core/html/resources/permission.css b/third_party/blink/renderer/core/html/resources/permission.css index 6505655..d82a9fa 100644 --- a/third_party/blink/renderer/core/html/resources/permission.css +++ b/third_party/blink/renderer/core/html/resources/permission.css @@ -31,6 +31,8 @@ } permission::-internal-permission-text { + text-emphasis: initial !important; + text-shadow: initial !important; align-items: center; display: flex; font-family: Arial, Helvetica, sans-serif; diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-ref.html b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-ref.html new file mode 100644 index 0000000..6714e31 --- /dev/null +++ b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-ref.html @@ -0,0 +1,9 @@ +<!DOCTYPE html> +<meta charset=utf-8> +<link rel="help" href="https://github.com/WICG/PEPC/blob/main/explainer.md#locking-the-pepc-style"> +<body> + <div> + <permission type="camera"></permission> + </div> +</body> +</html> \ No newline at end of file diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-tentative.html b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-tentative.html new file mode 100644 index 0000000..f1a8d3b6 --- /dev/null +++ b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-tentative.html @@ -0,0 +1,19 @@ +<!DOCTYPE html> +<meta charset=utf-8> +<link rel="match" href="inherited-css-ref.html"> +<link rel="help" href="https://github.com/WICG/PEPC/blob/main/explainer.md#locking-the-pepc-style"> +<!-- The permission element not inherit css properties from the parent div. +--> +<body> + <style> + div { + text-emphasis: "x"; + text-emphasis-position: over right; + text-shadow: 1px 1px 2px black; + } + </style> + <div> + <permission type="camera"></permission> + </div> +</body> +</html> \ No newline at end of file
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-ref.html b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-ref.html
new file mode 100644
index 0000000..6714e31
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-ref.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<link rel="help" href="https://github.com/WICG/PEPC/blob/main/explainer.md#locking-the-pepc-style">
+<body>
+ <div>
+ <permission type="camera"></permission>
+ </div>
+</body>
+</html>
\ No newline at end of file
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-tentative.html b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-tentative.html
new file mode 100644
index 0000000..f1a8d3b6
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-tentative.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<link rel="match" href="inherited-css-ref.html">
+<link rel="help" href="https://github.com/WICG/PEPC/blob/main/explainer.md#locking-the-pepc-style">
+<!-- The permission element not inherit css properties from the parent div.
+-->
+<body>
+ <style>
+ div {
+ text-emphasis: "x";
+ text-emphasis-position: over right;
+ text-shadow: 1px 1px 2px black;
+ }
+ </style>
+ <div>
+ <permission type="camera"></permission>
+ </div>
+</body>
+</html>
\ No newline at end of file
Loading diff…
Original Bug Report
reported by [email protected]
Permission element inner div with style text-emphasis:꧁; and text-emphasis-position: over right; can be abused if no element in the parent chain has any text-emphasis:꧁; and text-emphasis-position: over right; are set.
This bug is similar to https://issues.chromium.org/issues/398803201, https://issues.chromium.org/issues/423670839
when text-emphasis:꧁; and text-emphasis-position: over right; are embedded in a tag above the <permission> tag, for example a div or something else, this affects the <permission> tag, thus covering the text in the <permission> tag. if style text-emphasis:꧁; and text-emphasis-position: over right; embedded directly in the <permission> tag are not affected. The impact is that sites can potentially trick users to trigger permission prompts even if the permission is currently in a DENY state for that origin. (It does not however bypass the permission prompt in any way)
references for some css that can and cannot be embedded in the <permission> tag: https://developer.chrome.com/blog/permission-element-origin-trial?hl=en
References
On This Page