Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports without the Chrome Security team.

Overview: The Autofill preview popover for <select> elements using appearance: base-select inherits custom fonts from the page author. A malicious site can use @font-face with unicode-range to observe font loads triggered during the preview (hover) state, leaking sensitive Autofill data before the user commits.

Affected files:

• third_party/blink/renderer/core/html/resources/html.css
• third_party/blink/renderer/core/html/forms/select_type.cc
• third_party/blink/renderer/core/html/forms/html_select_element.cc

Estimated timestamp from git blame: 2025-08-19

Summary

A potential vulnerability in the implementation of the appearance: base-select Autofill preview allows an attacker to leak sensitive user information (such as country, state, or credit card details) stored in Autofill profiles. The leak occurs via a font-loading side-channel because the User Agent (UA) stylesheet for the select preview popover does not pin the font used for rendering suggested values. This allows a site to detect which option is being previewed by observing which custom font is loaded when the user hovers over an Autofill suggestion.

Technical Details

In appearance: base-select mode, when a user hovers over an Autofill suggestion in the browser’s dropdown, the browser displays a preview. This is handled in MenuListSelectType::DidSetSuggestedOption (in select_type.cc), which updates a UA shadow DOM popover (autofill_popover_text_) with the suggested option’s label.

The UA stylesheet for this preview text (select::-internal-select-autofill-preview-text in html.css) defines layout and overflow properties but lacks a font declaration with !important. Because the <select> element in base-select mode uses font: inherit, the preview text inside the shadow root inherits the font-family from the host <select> element, which is controlled by the page author.

This is a regression compared to standard <input> and <textarea> elements, which use ::-internal-input-suggested with font: -webkit-small-control !important (found in html.css around line 669) to specifically prevent author-controlled fonts from rendering preview text and creating side-channels.

Potential Attack Vector

An attacker could potentially exploit this as follows (note that these steps have not been verified with a live Proof of Concept):

1. Attacker Setup (Styling): The attacker applies CSS to a <select> element designed to capture sensitive data, setting appearance: base-select and a custom font: select { appearance: base-select; font-family: 'LeakFont'; }.
2. Attacker Setup (Font Probes): The attacker defines multiple @font-face rules for the 'LeakFont' family. Each rule specifies a unique unicode-range corresponding to a specific Private Use Area character (e.g., U+E001, U+E002) and points to a unique source URL.
3. Attacker Setup (Option Elements): The attacker populates the <select> with <option> elements (e.g., countries) and silently appends the unique Unicode character corresponding to that value to the option’s text node (e.g., <option value="US">United States &#xE001;</option>).
4. Attacker Setup (Observation): The attacker includes JavaScript that monitors the CSS Font Loading API (document.fonts) or monitors their server logs for requests to the .woff2 files.
5. Victim Interaction: A victim visits the page, clicks a preceding input field, and the browser displays the Autofill dropdown containing their saved profile.
6. Information Leak: The victim hovers over the profile entry. This triggers HTMLSelectElement::SetSuggestedOption, setting the state to WebAutofillState::kPreviewed and displaying the preview via MenuListSelectType::DidSetSuggestedOption.
7. Because the autofill_popover_text_ inherits 'LeakFont', rendering the preview string “United States \uE001” causes the text engine to match the \uE001 character to the unicode-range: U+E001 rule. This triggers an immediate network request for the corresponding font file.
8. The attacker observes this font load, immediately identifying that the victim’s autofill profile contains “United States” without the victim ever explicitly committing to fill the form.

Suggested Fix

Update third_party/blink/renderer/core/html/resources/html.css to explicitly pin the font for the base-select autofill preview text. Add the following properties to the select::-internal-select-autofill-preview-text rule (around line 2265), similar to what is done for ::-internal-input-suggested:

select::-internal-select-autofill-preview-text {
  font: -webkit-small-control !important;
  font-feature-settings: normal !important;
  /* ... existing properties ... */
}

This ensures the preview always renders with the system font and ignores author-provided web fonts, neutralizing the side-channel.

Evaluated with Chrome root at commit: 096fc8fdbfacf2546485756d03f160a3d04fcc9b

Results so far have been promising, but there can be wrong deductions. If this proves to be a false positive, please close as WAI; data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.