From e4afb48bc920df1b3291804ba90fcd2e29532688 Mon Sep 17 00:00:00 2001
From: Adem Derinel <[email protected]>
Date: Fri, 18 Sep 2026 05:57:17 -0700
Subject: [PATCH] [Passwords] Fix UAF in CredentialManager task

When CredentialManagerPendingRequestTask prompts the user to choose
credentials, it passes a callback bound to
Unretained(CredentialManagerImpl). If the Mojo pipe disconnects while
the chooser dialog is open, CredentialManagerImpl drops the task, but
the UI controller retains the stale callback.

A subsequent Get() request with kOptional mediation triggers auto
sign-in, which synchronously closes the old chooser dialog and runs its
callback. That callback deletes the active pending_request_ while its
ProcessForms() method is still executing on the stack, causing a
use-after-free.

Fix this by binding the chooser callback to a WeakPtr on the task, and
guarding against reentrancy when callbacks are cancelled.

TAG=agy
CONV=50e40463-fcb0-472e-9e9a-873e75681685

Fixed: 562242421
Change-Id: Id4f903a9b678da301f1d76984d23cc5afb838abe
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8424659
Reviewed-by: Friedrich Hauser <[email protected]>
Commit-Queue: Adem Derinel <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1700684}
---
diff --git a/components/password_manager/core/browser/credential_manager_pending_request_task.cc b/components/password_manager/core/browser/credential_manager_pending_request_task.cc
index 1ae9e355..989106b8 100644
--- a/components/password_manager/core/browser/credential_manager_pending_request_task.cc
+++ b/components/password_manager/core/browser/credential_manager_pending_request_task.cc
@@ -273,21 +273,24 @@
     return;
   }
 
-  auto split_send_callback = base::SplitOnceCallback(std::move(send_callback_));
   if (!delegate_->client()->PromptUserToChooseCredentials(
           std::move(results), origin_,
-          base::BindOnce(
-              &CredentialManagerPendingRequestTaskDelegate::SendPasswordForm,
-              base::Unretained(delegate_), std::move(split_send_callback.first),
-              mediation_))) {
+          base::BindOnce(&CredentialManagerPendingRequestTask::SendPasswordForm,
+                         weak_ptr_factory_.GetWeakPtr()))) {
     // Since PromptUserToChooseCredentials() does not invoke the callback when
-    // returning false, `repeating_send_callback` has not been run in this
-    // branch yet.
+    // returning false, `send_callback_` has not been run in this branch yet.
     LogCredentialManagerGetResult(
         metrics_util::CredentialManagerGetResult::kNone, mediation_);
-    delegate_->SendCredential(std::move(split_send_callback.second),
-                              CredentialInfo());
+    delegate_->SendCredential(std::move(send_callback_), CredentialInfo());
   }
 }
 
+void CredentialManagerPendingRequestTask::SendPasswordForm(
+    const PasswordForm* form) {
+  // `delegate_->SendPasswordForm()` invokes CredentialManagerImpl::SendCredential(),
+  // which resets `pending_request_` and deletes `this`. Do not access any member
+  // after this call.
+  delegate_->SendPasswordForm(std::move(send_callback_), mediation_, form);
+}
+
 }  // namespace password_manager
diff --git a/components/password_manager/core/browser/credential_manager_pending_request_task.h b/components/password_manager/core/browser/credential_manager_pending_request_task.h
index 1c0aa6c..64cad8cf 100644
--- a/components/password_manager/core/browser/credential_manager_pending_request_task.h
+++ b/components/password_manager/core/browser/credential_manager_pending_request_task.h
@@ -12,6 +12,7 @@
 
 #include "base/functional/callback_forward.h"
 #include "base/memory/raw_ptr.h"
+#include "base/memory/weak_ptr.h"
 #include "components/password_manager/core/browser/form_fetcher.h"
 #include "components/password_manager/core/browser/password_form_digest.h"
 #include "components/password_manager/core/common/credential_manager_types.h"
@@ -74,6 +75,7 @@
   void OnFetchCompleted() override;
 
   void ProcessForms(std::vector<std::unique_ptr<PasswordForm>> results);
+  void SendPasswordForm(const PasswordForm* form);
 
   raw_ptr<CredentialManagerPendingRequestTaskDelegate> delegate_;  // Weak;
   SendCredentialCallback send_callback_;
@@ -82,6 +84,9 @@
   const bool include_passwords_;
   std::set<std::string> federations_;
   std::unique_ptr<FormFetcher> form_fetcher_;
+
+  base::WeakPtrFactory<CredentialManagerPendingRequestTask> weak_ptr_factory_{
+      this};
 };
 
 }  // namespace password_manager
diff --git a/chrome/browser/password_manager/credential_manager_browsertest.cc b/chrome/browser/password_manager/credential_manager_browsertest.cc
index 461ca1b..532f5dc 100644
--- a/chrome/browser/password_manager/credential_manager_browsertest.cc
+++ b/chrome/browser/password_manager/credential_manager_browsertest.cc
@@ -1,12 +1,15 @@
 // Copyright 2016 The Chromium Authors
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
+#include <optional>
+
 #include "base/command_line.h"
 #include "base/memory/raw_ptr.h"
 #include "base/strings/strcat.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/test/scoped_feature_list.h"
+#include "base/test/test_future.h"
 #include "chrome/browser/password_manager/chrome_password_manager_client.h"
 #include "chrome/browser/password_manager/password_manager_test_base.h"
 #include "chrome/browser/password_manager/password_manager_test_util.h"
@@ -23,6 +26,8 @@
 #include "components/password_manager/core/browser/password_store/test_password_store.h"
 #include "components/password_manager/core/browser/password_string.h"
 #include "components/password_manager/core/common/password_manager_features.h"
+#include "components/password_manager/core/common/password_manager_pref_names.h"
+#include "components/prefs/pref_service.h"
 #include "content/public/browser/back_forward_cache.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
@@ -34,6 +39,7 @@
 #include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/prerender_test_util.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "net/dns/mock_host_resolver.h"
 
 namespace {
@@ -1259,4 +1265,72 @@
   EXPECT_EQ(avatar_request_counter(), 2u);
 }
 
+// Regression test for crbug.com/562242421: A disconnected CredentialManager
+// pipe with an active account chooser must not leave a stale callback in
+// ManagePasswordsUIController that deletes a subsequent auto-signin request
+// during ProcessForms().
+IN_PROC_BROWSER_TEST_F(CredentialManagerBrowserTest,
+                       AutoSigninAfterDisconnectWithPendingChooserDoesNotUAF) {
+  scoped_refptr<password_manager::TestPasswordStore> password_store =
+      GetDefaultPasswordStore(browser()->GetProfile());
+
+  NavigateToFile("/password/simple_password.html");
+  GURL url = WebContents()->GetLastCommittedURL();
+
+  password_manager::PasswordForm form;
+  form.signon_realm = url::Origin::Create(url).GetURL().spec();
+  form.url = url::Origin::Create(url).GetURL();
+  form.username_value = u"user1";
+  form.password_value = PasswordString(u"abcdef");
+  form.skip_zero_click = false;
+  password_store->AddLogin(password_manager::FromPasswordForm(form));
+  WaitForPasswordStore();
+
+  browser()->GetProfile()->GetPrefs()->SetBoolean(
+      password_manager::prefs::kWasAutoSignInFirstRunExperienceShown, true);
+
+  ChromePasswordManagerClient* client =
+      ChromePasswordManagerClient::FromWebContents(WebContents());
+  ASSERT_TRUE(client);
+
+  // 1. Bind first CredentialManager pipe and call Get(kRequired) to open the
+  // account chooser.
+  mojo::Remote<blink::mojom::CredentialManager> remote1;
+  client->GetContentCredentialManager()->BindRequest(
+      WebContents()->GetPrimaryMainFrame(),
+      remote1.BindNewPipeAndPassReceiver());
+  remote1->Get(password_manager::CredentialMediationRequirement::kRequired,
+               /*include_passwords=*/true,
+               /*federations=*/{}, base::DoNothing());
+
+  BubbleObserver(WebContents()).WaitForAccountChooser();
+  EXPECT_TRUE(IsShowingAccountChooser());
+
+  // 2. Disconnect the Mojo pipe while the account chooser is showing.
+  remote1.reset();
+  base::RunLoop().RunUntilIdle();
+
+  // 3. Bind a new CredentialManager pipe and call Get(kOptional), triggering
+  // auto sign-in and NotifyUserAutoSignin(), which destroys the old chooser.
+  mojo::Remote<blink::mojom::CredentialManager> remote2;
+  client->GetContentCredentialManager()->BindRequest(
+      WebContents()->GetPrimaryMainFrame(),
+      remote2.BindNewPipeAndPassReceiver());
+
+  base::test::TestFuture<password_manager::CredentialManagerError,
+                         std::optional<password_manager::CredentialInfo>>
+      future;
+  remote2->Get(password_manager::CredentialMediationRequirement::kOptional,
+               /*include_passwords=*/true,
+               /*federations=*/{},
+               future.GetCallback<
+                   password_manager::CredentialManagerError,
+                   const std::optional<password_manager::CredentialInfo>&>());
+
+  ASSERT_TRUE(future.Wait());
+  EXPECT_EQ(password_manager::CredentialManagerError::SUCCESS, future.Get<0>());
+  ASSERT_TRUE(future.Get<1>().has_value());
+  EXPECT_EQ(u"user1", future.Get<1>()->id);
+}
+
 }  // namespace
diff --git a/components/password_manager/core/browser/credential_manager_impl_unittest.cc b/components/password_manager/core/browser/credential_manager_impl_unittest.cc
index c7627444..aa12007 100644
--- a/components/password_manager/core/browser/credential_manager_impl_unittest.cc
+++ b/components/password_manager/core/browser/credential_manager_impl_unittest.cc
@@ -184,10 +184,14 @@
       const url::Origin& origin,
       CredentialsCallback callback) override {
     EXPECT_FALSE(local_forms.empty());
-    const PasswordForm* form = local_forms[0].get();
-    base::SequencedTaskRunner::GetCurrentDefault()->PostTask(
-        FROM_HERE, base::BindOnce(std::move(callback),
-                                  base::Owned(new PasswordForm(*form))));
+    if (should_store_callback_) {
+      stored_choose_callback_ = std::move(callback);
+    } else {
+      const PasswordForm* form = local_forms[0].get();
+      base::SequencedTaskRunner::GetCurrentDefault()->PostTask(
+          FROM_HERE, base::BindOnce(std::move(callback),
+                                    base::Owned(new PasswordForm(*form))));
+    }
     PromptUserToChooseCredentialsPtr(
         base::ToVector(local_forms, &std::unique_ptr<PasswordForm>::get),
         origin, base::DoNothing());
@@ -198,9 +202,21 @@
       std::vector<std::unique_ptr<PasswordForm>> local_forms,
       const url::Origin& origin) override {
     EXPECT_FALSE(local_forms.empty());
+    if (stored_choose_callback_) {
+      // Simulate ManagePasswordsUIController::OnAutoSignin calling
+      // DestroyPopups() -> TransitionToState(), which synchronously runs the
+      // stale chooser callback before reading `origin`.
+      std::move(stored_choose_callback_).Run(nullptr);
+      url::Origin origin_copy = origin;
+      EXPECT_FALSE(origin_copy.opaque());
+    }
     NotifyUserAutoSigninPtr();
   }
 
+  // Captures the CredentialsCallback instead of posting it asynchronously to
+  // simulate an open chooser dialog.
+  void capture_callback() { should_store_callback_ = true; }
+
   void set_zero_click_enabled(bool zero_click_enabled) {
     auto_sign_in_enabled_ = zero_click_enabled;
   }
@@ -221,6 +237,8 @@
   NiceMock<MockPasswordManager> password_manager_;
   GURL last_committed_url_{kTestWebOrigin};
   bool auto_sign_in_enabled_ = true;
+  bool should_store_callback_ = false;
+  CredentialsCallback stored_choose_callback_;
 };
 
 // Callbacks from CredentialManagerImpl methods
@@ -2138,4 +2156,58 @@
   EXPECT_FALSE(called);
 }
 
+// Regression test for crbug.com/562242421: When a Get() request with kRequired
+// opens the account chooser, and the Mojo pipe disconnects before the chooser
+// is answered, ResetAfterDisconnecting() drops the pending request while the
+// chooser callback survives in the UI controller. If a subsequent Get() request
+// with kOptional triggers auto sign-in, NotifyUserAutoSignin() closes the old
+// chooser and runs its stale callback. That stale callback must not delete the
+// active `pending_request_` while ProcessForms() is still executing on the
+// stack.
+TEST_P(CredentialManagerImplTest,
+       AutoSigninAfterDisconnectWithPendingChooserDoesNotUAF) {
+  client_->set_zero_click_enabled(true);
+  client_->set_first_run_seen(true);
+  client_->capture_callback();
+  form_.skip_zero_click = false;
+  store_->AddLogin(password_manager::FromPasswordForm(form_));
+
+  EXPECT_CALL(*client_, PromptUserToChooseCredentialsPtr);
+  EXPECT_CALL(*client_, NotifyUserAutoSigninPtr);
+
+  // 1. First Get() request with kRequired opens the account chooser and stores
+  // the callback in the UI controller.
+  bool called1 = false;
+  CredentialManagerError error1 = CredentialManagerError::UNKNOWN;
+  std::optional<CredentialInfo> credential1;
+  CallGet(
+      CredentialMediationRequirement::kRequired, /*include_passwords=*/true,
+      /*federations=*/{},
+      base::BindOnce(&GetCredentialCallback, &called1, &error1, &credential1));
+  RunAllPendingTasks();
+  EXPECT_FALSE(called1);
+
+  // 2. The renderer disconnects the Mojo pipe.
+  cm_service_impl_->ResetAfterDisconnecting();
+
+  // 3. A new pipe calls Get() with kOptional, which chooses auto sign-in and
+  // calls NotifyUserAutoSignin(), synchronously closing the old chooser and
+  // running its stale callback.
+  bool called2 = false;
+  CredentialManagerError error2 = CredentialManagerError::UNKNOWN;
+  std::optional<CredentialInfo> credential2;
+  CallGet(
+      CredentialMediationRequirement::kOptional, /*include_passwords=*/true,
+      /*federations=*/{},
+      base::BindOnce(&GetCredentialCallback, &called2, &error2, &credential2));
+  RunAllPendingTasks();
+
+  EXPECT_FALSE(called1);
+  EXPECT_TRUE(called2);
+  EXPECT_EQ(CredentialManagerError::SUCCESS, error2);
+  ASSERT_TRUE(credential2.has_value());
+  EXPECT_EQ(CredentialType::CREDENTIAL_TYPE_PASSWORD, credential2->type);
+  EXPECT_EQ(form_.username_value, credential2->id);
+}
+
 }  // namespace password_manager

diff --git a/chrome/browser/password_manager/credential_manager_browsertest.cc b/chrome/browser/password_manager/credential_manager_browsertest.cc
index 461ca1b..532f5dc 100644
--- a/chrome/browser/password_manager/credential_manager_browsertest.cc
+++ b/chrome/browser/password_manager/credential_manager_browsertest.cc
@@ -1,12 +1,15 @@
 // Copyright 2016 The Chromium Authors
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
+#include <optional>
+
 #include "base/command_line.h"
 #include "base/memory/raw_ptr.h"
 #include "base/strings/strcat.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/test/scoped_feature_list.h"
+#include "base/test/test_future.h"
 #include "chrome/browser/password_manager/chrome_password_manager_client.h"
 #include "chrome/browser/password_manager/password_manager_test_base.h"
 #include "chrome/browser/password_manager/password_manager_test_util.h"
@@ -23,6 +26,8 @@
 #include "components/password_manager/core/browser/password_store/test_password_store.h"
 #include "components/password_manager/core/browser/password_string.h"
 #include "components/password_manager/core/common/password_manager_features.h"
+#include "components/password_manager/core/common/password_manager_pref_names.h"
+#include "components/prefs/pref_service.h"
 #include "content/public/browser/back_forward_cache.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
@@ -34,6 +39,7 @@
 #include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/prerender_test_util.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "net/dns/mock_host_resolver.h"
 
 namespace {
@@ -1259,4 +1265,72 @@
   EXPECT_EQ(avatar_request_counter(), 2u);
 }
 
+// Regression test for crbug.com/562242421: A disconnected CredentialManager
+// pipe with an active account chooser must not leave a stale callback in
+// ManagePasswordsUIController that deletes a subsequent auto-signin request
+// during ProcessForms().
+IN_PROC_BROWSER_TEST_F(CredentialManagerBrowserTest,
+                       AutoSigninAfterDisconnectWithPendingChooserDoesNotUAF) {
+  scoped_refptr<password_manager::TestPasswordStore> password_store =
+      GetDefaultPasswordStore(browser()->GetProfile());
+
+  NavigateToFile("/password/simple_password.html");
+  GURL url = WebContents()->GetLastCommittedURL();
+
+  password_manager::PasswordForm form;
+  form.signon_realm = url::Origin::Create(url).GetURL().spec();
+  form.url = url::Origin::Create(url).GetURL();
+  form.username_value = u"user1";
+  form.password_value = PasswordString(u"abcdef");
+  form.skip_zero_click = false;
+  password_store->AddLogin(password_manager::FromPasswordForm(form));
+  WaitForPasswordStore();
+
+  browser()->GetProfile()->GetPrefs()->SetBoolean(
+      password_manager::prefs::kWasAutoSignInFirstRunExperienceShown, true);
+
+  ChromePasswordManagerClient* client =
+      ChromePasswordManagerClient::FromWebContents(WebContents());
+  ASSERT_TRUE(client);
+
+  // 1. Bind first CredentialManager pipe and call Get(kRequired) to open the
+  // account chooser.
+  mojo::Remote<blink::mojom::CredentialManager> remote1;
+  client->GetContentCredentialManager()->BindRequest(
+      WebContents()->GetPrimaryMainFrame(),
+      remote1.BindNewPipeAndPassReceiver());
+  remote1->Get(password_manager::CredentialMediationRequirement::kRequired,
+               /*include_passwords=*/true,
+               /*federations=*/{}, base::DoNothing());
+
+  BubbleObserver(WebContents()).WaitForAccountChooser();
+  EXPECT_TRUE(IsShowingAccountChooser());
+
+  // 2. Disconnect the Mojo pipe while the account chooser is showing.
+  remote1.reset();
+  base::RunLoop().RunUntilIdle();
+
+  // 3. Bind a new CredentialManager pipe and call Get(kOptional), triggering
+  // auto sign-in and NotifyUserAutoSignin(), which destroys the old chooser.
+  mojo::Remote<blink::mojom::CredentialManager> remote2;
+  client->GetContentCredentialManager()->BindRequest(
+      WebContents()->GetPrimaryMainFrame(),
+      remote2.BindNewPipeAndPassReceiver());
+
+  base::test::TestFuture<password_manager::CredentialManagerError,
+                         std::optional<password_manager::CredentialInfo>>
+      future;
+  remote2->Get(password_manager::CredentialMediationRequirement::kOptional,
+               /*include_passwords=*/true,
+               /*federations=*/{},
+               future.GetCallback<
+                   password_manager::CredentialManagerError,
+                   const std::optional<password_manager::CredentialInfo>&>());
+
+  ASSERT_TRUE(future.Wait());
+  EXPECT_EQ(password_manager::CredentialManagerError::SUCCESS, future.Get<0>());
+  ASSERT_TRUE(future.Get<1>().has_value());
+  EXPECT_EQ(u"user1", future.Get<1>()->id);
+}
+
 }  // namespace
diff --git a/components/password_manager/core/browser/credential_manager_impl_unittest.cc b/components/password_manager/core/browser/credential_manager_impl_unittest.cc
index c7627444..aa12007 100644
--- a/components/password_manager/core/browser/credential_manager_impl_unittest.cc
+++ b/components/password_manager/core/browser/credential_manager_impl_unittest.cc
@@ -184,10 +184,14 @@
       const url::Origin& origin,
       CredentialsCallback callback) override {
     EXPECT_FALSE(local_forms.empty());
-    const PasswordForm* form = local_forms[0].get();
-    base::SequencedTaskRunner::GetCurrentDefault()->PostTask(
-        FROM_HERE, base::BindOnce(std::move(callback),
-                                  base::Owned(new PasswordForm(*form))));
+    if (should_store_callback_) {
+      stored_choose_callback_ = std::move(callback);
+    } else {
+      const PasswordForm* form = local_forms[0].get();
+      base::SequencedTaskRunner::GetCurrentDefault()->PostTask(
+          FROM_HERE, base::BindOnce(std::move(callback),
+                                    base::Owned(new PasswordForm(*form))));
+    }
     PromptUserToChooseCredentialsPtr(
         base::ToVector(local_forms, &std::unique_ptr<PasswordForm>::get),
         origin, base::DoNothing());
@@ -198,9 +202,21 @@
       std::vector<std::unique_ptr<PasswordForm>> local_forms,
       const url::Origin& origin) override {
     EXPECT_FALSE(local_forms.empty());
+    if (stored_choose_callback_) {
+      // Simulate ManagePasswordsUIController::OnAutoSignin calling
+      // DestroyPopups() -> TransitionToState(), which synchronously runs the
+      // stale chooser callback before reading `origin`.
+      std::move(stored_choose_callback_).Run(nullptr);
+      url::Origin origin_copy = origin;
+      EXPECT_FALSE(origin_copy.opaque());
+    }
     NotifyUserAutoSigninPtr();
   }
 
+  // Captures the CredentialsCallback instead of posting it asynchronously to
+  // simulate an open chooser dialog.
+  void capture_callback() { should_store_callback_ = true; }
+
   void set_zero_click_enabled(bool zero_click_enabled) {
     auto_sign_in_enabled_ = zero_click_enabled;
   }
@@ -221,6 +237,8 @@
   NiceMock<MockPasswordManager> password_manager_;
   GURL last_committed_url_{kTestWebOrigin};
   bool auto_sign_in_enabled_ = true;
+  bool should_store_callback_ = false;
+  CredentialsCallback stored_choose_callback_;
 };
 
 // Callbacks from CredentialManagerImpl methods
@@ -2138,4 +2156,58 @@
   EXPECT_FALSE(called);
 }
 
+// Regression test for crbug.com/562242421: When a Get() request with kRequired
+// opens the account chooser, and the Mojo pipe disconnects before the chooser
+// is answered, ResetAfterDisconnecting() drops the pending request while the
+// chooser callback survives in the UI controller. If a subsequent Get() request
+// with kOptional triggers auto sign-in, NotifyUserAutoSignin() closes the old
+// chooser and runs its stale callback. That stale callback must not delete the
+// active `pending_request_` while ProcessForms() is still executing on the
+// stack.
+TEST_P(CredentialManagerImplTest,
+       AutoSigninAfterDisconnectWithPendingChooserDoesNotUAF) {
+  client_->set_zero_click_enabled(true);
+  client_->set_first_run_seen(true);
+  client_->capture_callback();
+  form_.skip_zero_click = false;
+  store_->AddLogin(password_manager::FromPasswordForm(form_));
+
+  EXPECT_CALL(*client_, PromptUserToChooseCredentialsPtr);
+  EXPECT_CALL(*client_, NotifyUserAutoSigninPtr);
+
+  // 1. First Get() request with kRequired opens the account chooser and stores
+  // the callback in the UI controller.
+  bool called1 = false;
+  CredentialManagerError error1 = CredentialManagerError::UNKNOWN;
+  std::optional<CredentialInfo> credential1;
+  CallGet(
+      CredentialMediationRequirement::kRequired, /*include_passwords=*/true,
+      /*federations=*/{},
+      base::BindOnce(&GetCredentialCallback, &called1, &error1, &credential1));
+  RunAllPendingTasks();
+  EXPECT_FALSE(called1);
+
+  // 2. The renderer disconnects the Mojo pipe.
+  cm_service_impl_->ResetAfterDisconnecting();
+
+  // 3. A new pipe calls Get() with kOptional, which chooses auto sign-in and
+  // calls NotifyUserAutoSignin(), synchronously closing the old chooser and
+  // running its stale callback.
+  bool called2 = false;
+  CredentialManagerError error2 = CredentialManagerError::UNKNOWN;
+  std::optional<CredentialInfo> credential2;
+  CallGet(
+      CredentialMediationRequirement::kOptional, /*include_passwords=*/true,
+      /*federations=*/{},
+      base::BindOnce(&GetCredentialCallback, &called2, &error2, &credential2));
+  RunAllPendingTasks();
+
+  EXPECT_FALSE(called1);
+  EXPECT_TRUE(called2);
+  EXPECT_EQ(CredentialManagerError::SUCCESS, error2);
+  ASSERT_TRUE(credential2.has_value());
+  EXPECT_EQ(CredentialType::CREDENTIAL_TYPE_PASSWORD, credential2->type);
+  EXPECT_EQ(form_.username_value, credential2->id);
+}
+
 }  // namespace password_manager