Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports without the security team.

Overview: A compromised renderer can bypass Blink’s validation and send a rank-0 Slice operation with empty parameters to the GPU process. The GPU validation fails to enforce a non-scalar rank constraint, allowing zero-element arrays to be passed to the ONNX Runtime backend, potentially leading to an out-of-bounds access.

Affected files:

• services/webnn/ort/graph_builder_ort.cc
• services/webnn/webnn_context_impl.cc
• services/webnn/webnn_graph_builder_impl.cc
• services/webnn/ort/graph_impl_ort.cc

Estimated timestamp from git blame: 2025-07-02

Description

In WebNN, the Slice operation is expected to operate on tensors and slice along defined dimensions. In the Blink renderer (MLGraphBuilder::slice), if a rank-0 (scalar) input is provided with empty dimensions, it is safely converted to an Identity operation. However, a compromised renderer can bypass this and send a raw mojom::Slice operation to the GPU process with a rank-0 input and an empty ranges array.

The GPU-side validation in ValidateSliceAndInferOutput (services/webnn/public/cpp/graph_validation_utils.cc) attempts to validate the operation. It checks if the backend supports the input data type and rank via context_properties.data_type_limits.slice_input. In the ONNX Runtime (ORT) backend (services/webnn/ort/context_impl_ort.cc), slice_input allows up to kMaxRank (which includes 0). Unlike other operations, WebNNContextImpl::IntersectWithBaseProperties does not restrict slice_input to kNonScalarMaxRank.

Because the input rank is 0, length checks like attributes.starts.size() != input_rank evaluate to 0 != 0 (False). Furthermore, the bounds validation loop (for (uint32_t i = 0; i < input_rank; ++i)) is entirely skipped. The GPU process therefore deems the malformed scalar Slice valid.

The operation is then dispatched to GraphBuilderOrt::AddSliceOperation (services/webnn/ort/graph_builder_ort.cc), which initializes starts, ends, steps, and axes based on the empty ranges array. This results in the creation of ONNX 1D initializer tensors with a shape of [0]. These empty tensors are added to the ONNX model as the Slice parameters.

When the ONNX model is initialized in the ORT Execution Provider (e.g., DirectML), the underlying engine is forced to parse a Slice node parameterized by zero-length arrays. As previously documented by Chrome developers in the same file (see AddReverseOperation workaround: “we map this to an Identity node to prevent ORT EPs from mishandling empty arrays”), ORT Execution Providers mishandle empty configuration arrays. This can lead to the Execution Provider assuming at least one dimension is present, performing unchecked memory operations, and resulting in an out-of-bounds read or write within the highly privileged GPU process.

Potential Steps to Reproduce

1. From a compromised renderer, instantiate a WebNN graph builder.
2. Create a rank-0 scalar input operand.
3. Construct a mojom::Slice operation targeting the rank-0 operand, providing an explicitly empty ranges array.
4. Send the CreateGraph IPC message to the GPU process.
5. The GPU process validates the operation, forwards the empty arrays to the ORT backend, and potentially triggers an OOB access during graph initialization or execution.

Suggested Fix

In services/webnn/webnn_context_impl.cc, update IntersectWithBaseProperties to correctly restrict slice_input to non-scalar ranks by intersecting it with kNonScalarMaxRank. Alternatively, explicitly reject rank-0 inputs or explicitly handle empty range arrays in ValidateSliceAndInferOutput.

Evaluated with Chrome root at commit: ff3d2b74fa39431785bd60e51463b08fcc71ee33

Results so far have been promising, but there can be wrong deductions. If this proves to be a false positive, please close as WAI; data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.