Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: The Chrome automation extension uses Math.random() to generate request IDs for accessibility actions. A compromised renderer can observe these IDs via Mojo, predict future IDs, and forge accessibility events to hijack action callbacks intended for other origins or the desktop tree.

Affected files:

• extensions/renderer/resources/automation/automation_node.js

Estimated timestamp from git blame: Unknown (Google3 checkout)

Summary

A potential vulnerability in the Chrome automation API allows a compromised renderer to perform cross-tree callback hijacking. The automation extension uses Math.random() to generate requestID values for tracking the results of accessibility actions. These IDs are sent to renderers via Mojo IPC. Because Math.random() is mathematically predictable, a compromised renderer can recover the PRNG state and predict future request IDs. Combined with a globally shared callback map that lacks origin verification, an attacker can intercept and resolve callbacks intended for other accessibility trees (e.g., the desktop tree or other tabs).

Technical Details

1. Insecure ID Generation: In extensions/renderer/resources/automation/automation_node.js, the addActionResultCallback function generates request IDs using Math.random():

// Line 1970
requestID = Math.floor(Math.random() * INT32_MAX);

V8’s Math.random() implementation is a non-cryptographic PRNG. Its internal state can be reconstructed after observing a small number of consecutive outputs.

2. Information Leak via Mojo: Request IDs are passed to renderer processes through the RenderAccessibility Mojo interface (third_party/blink/public/mojom/render_accessibility.mojom), for example, via the request_id parameter in HitTest or within AXActionData for PerformAction. A compromised renderer can observe these values and recover the extension V8 context’s PRNG state.

3. Cross-Tree Hijacking: The actionRequestIDToCallback map in automation_node.js (line 1760) is shared globally across all accessibility tree instances. When a forged accessibility event arrives with a predicted actionRequestID, the onActionResult handler (line 2002) performs a lookup in this global map using only the requestID as the key. There is no check to ensure that the event originated from the same tree that initiated the request.

Potential Attack Scenario

(Note: These are suggested steps; our tooling has not executed a live proof of concept.)

1. An attacker compromises a renderer process hosting their website.
2. The user has an accessibility extension active (e.g., ChromeVox on ChromeOS).
3. The extension performs normal actions on the compromised renderer’s accessibility tree, exposing several request_id values via Mojo.
4. The attacker uses these values to reconstruct the extension’s V8 Math.random() state and predicts the next sequence of requestIDs.
5. The extension performs a sensitive action (e.g., a hit test) on a privileged tree (like the desktop or another tab).
6. The attacker forges an ax.mojom.AXUpdatesAndEvents Mojo message containing an ax.mojom.AXEvent with the predicted action_request_id and a targetID from their own controlled tree.
7. The event is routed through the browser to the extension, which looks up the predicted ID in the global actionRequestIDToCallback map.
8. The extension invokes the victim callback with the attacker’s spoofed node, allowing the attacker to spoof UI content or intercept screen reader interactions.

Recommendation

Request IDs should be generated using a cryptographically secure PRNG. Replace Math.random() with crypto.getRandomValues() in automation_node.js:

const buf = new Uint32Array(1);
crypto.getRandomValues(buf);
requestID = buf[0] & 0x7FFFFFFF;

Evaluated with Chrome root at commit: 65b3256311f3ab6fb9870eaa522de7e6dd2663bb

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

• If you are familiar with the severity guidelines, you may adjust the severity.
• If this is a false positive, and there’s no work to be done, please close as WAI.
• If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.