Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports without the Chrome Security team.

Overview: The webrtcLoggingPrivate extension API leaks the actual origin of a target tab in a verbose error message when an origin validation check fails. The built-in Hangout Services component extension exposes this API to *.meet.google.com subdomains and relays the error message back to the caller. An attacker with code execution on an allowed subdomain can exploit this to discover the origins of all open tabs, including incognito tabs.

Affected files:

• chrome/browser/extensions/api/webrtc_logging_private/webrtc_logging_private_api.cc
• chrome/browser/resources/hangout_services/thunk.js

Estimated timestamp from git blame: 2020-03-04

Description

A potential information disclosure vulnerability exists in the handling of the webrtcLoggingPrivate extension API. When the API is invoked (e.g., via chrome.webrtcLoggingPrivate.start), the C++ backend function WebrtcLoggingPrivateFunction::RphFromRequest attempts to locate the target tab and verifies its origin against an extension-supplied security_origin.

If the origin check fails, the function generates the following verbose error string (in chrome/browser/extensions/api/webrtc_logging_private/webrtc_logging_private_api.cc lines 175-177):

*error = base::StringPrintf(
    "Invalid security origin. Expected=%s, actual=%s",
    expected_origin.spec().c_str(), security_origin.c_str());

This error string inadvertently embeds the victim tab’s actual origin (expected_origin).

The built-in Hangout Services component extension (ID: nkeimhogjdpnpccoofpliimaahmaaome) is configured to be externally_connectable by https://*.meet.google.com/*. Its background script (thunk.js) proxies messages to the webrtcLoggingPrivate API and explicitly returns the resulting chrome.runtime.lastError back to the external caller.

Furthermore, when RphFromRequest calls ExtensionTabUtil::GetTabById (line 161), it hardcodes the include_incognito parameter to true. Consequently, if a user has at least one incognito window open, the search scope includes incognito tabs, allowing their origins to be leaked as well.

Once an attacker discovers the true origin of a tab, they can resend the request with the correct origin. This bypasses the security check and allows the attacker to invoke unauthorized WebRTC logging on the victim’s tab.

Suggested Attack Steps

Note: These are potential steps based on code analysis; our tooling has not executed this code to verify a live exploit.

1. An attacker gains JavaScript execution capabilities on any https://[subdomain].meet.google.com/ (e.g., via XSS).
2. The attacker iterates through potential integer tabId values.
3. For each tabId, the attacker sends a message to the Hangout Services extension: chrome.runtime.sendMessage('nkeimhogjdpnpccoofpliimaahmaaome', { method: 'logging.start', tabId: <id>, winUrl: 'https://attacker.com/' }, callback);.
4. If the tabId is valid, the C++ origin check fails and returns the verbose error to thunk.js, which passes it back to the attacker’s callback.
5. The attacker parses the returned error message (e.g., "Invalid security origin. Expected=https://bank.com/...") to extract the actual origin of the tab.
6. (Optional Escalation) The attacker sends a new message with the discovered origin (winUrl: 'https://bank.com/') to successfully initiate WebRTC logging on that tab.

Suggested Fix

Modify the error string generation in WebrtcLoggingPrivateFunction::RphFromRequest to remove the sensitive expected_origin data. A generic error message should be sufficient, for example:

*error = "Invalid security origin.";

Evaluated with Chrome root at commit: 096fc8fdbfacf2546485756d03f160a3d04fcc9b

Results so far have been promising, but there can be wrong deductions. If this proves to be a false positive, please close as WAI; data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.