CVE-2025-13635
Overview
Background
- Download bubble
- the toolbar UI that lists recent downloads. Its row views (
download_bubble_row_view.cc) let the user open a downloaded file by clicking or pressing Enter. - `InputEventActivationProtector`
- a views helper (
input_protector_) whoseIsPossiblyUnintendedInteractionreturns true for input that arrives too soon after a UI element appears (500 ms here, per the commit message), so the input is ignored. - `allow_key_events`
- a parameter of
IsPossiblyUnintendedInteraction. When it istrue, key events skip the timing protection and only mouse or gesture events are filtered. - Enterjacking
- a clickjacking variant in which a page gets the user to press Enter (or other keys) repeatedly, so a keypress lands on a browser dialog or bubble that just appeared and confirms an action the user did not intend.
Root Cause Analysis
The download bubble row view guarded its activation handlers with input_protector_->IsPossiblyUnintendedInteraction(event, /*allow_key_events=*/true).
As a result, mouse clicks within the protection window were ignored, but keyboard activation (for example Enter) was always accepted. Because activating a row can open the downloaded file or call bubble_controller_->ProcessDownloadButtonPress, a keystroke arriving just after the bubble appeared could trigger that action. This breaks the invariant that every input must pass the “too soon after showing” check.
The patch changes both call sites to /*allow_key_events=*/false, so key events now get the same 500 ms delay as clicks, which tightens the check. The commit message explicitly calls this a partial mitigation, because 500 ms may not catch every unintended keypress.
allow_key_events=false, so keyboard activations in the protection window are dropped like clicks.Attack Path
- Prime the user to press keys An attacker page persuades the user to press or hold Enter (or similar keys), for example through a game or a fake prompt.
- Trigger a download While the user is pressing keys, the page starts a download, which causes the download bubble to show.
- Keypress reaches the bubble row
Before the patch,
IsPossiblyUnintendedInteraction(event, true)did not filter key events, so a keystroke arriving immediately after the bubble appeared reached the row’s activation handler. - Unintended open of the download
The handler continues to open or act on the downloaded item, or calls
ProcessDownloadButtonPress, without the user meaning to. Whether that then runs attacker content depends on file type and OS handling (inferred).
Impact Assessment
Files Changed
chrome/browser/ui/views/download/bubble/download_bubble_row_view.cc
Audit Directions
- `allow_key_events=true` on security-sensitive confirmationsSearch for
IsPossiblyUnintendedInteraction(..., /*allow_key_events=*/true)and similar opt-outs on permission prompts, dangerous-download warnings, extension install dialogs, and other bubbles that can be raised from web content. - Focus-stealing surfaces raised by web actionsFind UI that a page can make appear (downloads, permission chips, file pickers, payment sheets) and that takes default focus with an Enter-activatable default action.
- Fixed-delay protectionsAs the commit notes, 500 ms is not a complete defence. Look for designs that require a fresh keydown after the UI appears, or a deliberate focus change, rather than relying only on elapsed time.
Patch
From 8be46d66315fc47df5634d7cface5b62d7673b26 Mon Sep 17 00:00:00 2001 From: Lily Chen <[email protected]> Date: Tue, 14 Oct 2025 13:12:42 -0700 Subject: [PATCH] Protect download bubble from unintended key events This change considers key events when protecting the download bubble row view from unintended user input. Clicking (or pressing Enter) on the download bubble row view may result in opening a downloaded file. The existing InputEventActivationProtector prevents clicks too soon after showing the download bubble (500 ms). After this change, key events are subject to the delay as well. This is only a partial mitigation for a number of variants of "enterjacking" on the download bubble, because the 500 ms delay may not be sufficient to catch all unintended keypresses. Bug: 392375329, 405727341, 421348748, 421877606 Change-Id: Ia6252f397966dd1d5cb539bf5c58f348effebadc Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7041986 Reviewed-by: Daniel Rubery <[email protected]> Auto-Submit: Lily Chen <[email protected]> Commit-Queue: Lily Chen <[email protected]> Cr-Commit-Position: refs/heads/main@{#1529740} --- diff --git a/chrome/browser/ui/views/download/bubble/download_bubble_row_view.cc b/chrome/browser/ui/views/download/bubble/download_bubble_row_view.cc index c4548ce..1e53672 100644 --- a/chrome/browser/ui/views/download/bubble/download_bubble_row_view.cc +++ b/chrome/browser/ui/views/download/bubble/download_bubble_row_view.cc @@ -638,7 +638,7 @@ return; } if (input_protector_->IsPossiblyUnintendedInteraction( - event, /*allow_key_events=*/true)) { + event, /*allow_key_events=*/false)) { return; } if (info_->has_subpage()) { @@ -657,7 +657,7 @@ const ui::Event& event) { if (!bubble_controller_ || !info_->model() || input_protector_->IsPossiblyUnintendedInteraction( - event, /*allow_key_events=*/true)) { + event, /*allow_key_events=*/false)) { return; } bubble_controller_->ProcessDownloadButtonPress(info_->model()->GetWeakPtr(),
Original Bug Report
clickjacking (enterjacking) download notification when a window.alert() is closed
Security Bug
VULNERABILITY DETAILS when opening a window alert() and at the same time the popup window is downloading a file and window.alert() is closed the focus changes to the file that has been downloaded (download notification) this causes the file to be opened
VERSION Chrome Version: Version 136.0.7084.0 (Official Build) canary (64-bit) Operating System: Windows OS
REPRODUCTION CASE
- open enterjack3.html
- do enter 3-4 times fastly
CREDIT INFORMATION Externally reported security bugs may appear in Chrome release notes. If this bug is included, how would you like to be credited? Reporter credit: [goes here]