From 80ddc28c7cb4038a6a73b15f452c1239222fd036 Mon Sep 17 00:00:00 2001
From: Mihalis Haatainen <[email protected]>
Date: Fri, 17 Apr 2026 15:00:53 -0700
Subject: [PATCH] Fix missing browser-side sandbox enforcement for kPointerLock

RenderWidgetHostImpl::RequestMouseLock() does not check the
WebSandboxFlags::kPointerLock sandbox flag. A compromised renderer
inside a sandboxed frame (without allow-pointer-lock) can call
RequestMouseLock() via Mojo IPC directly, bypassing the renderer-side
check in PointerLockController::RequestPointerLock().

Add browser-side IsSandboxed(kPointerLock) check matching the pattern
of the kModals fix (Bug 491676472, fixed 2025-03-12).

Bug: 492211919
Change-Id: I504cbfc17b6e7e8484a9622939dc98fef2beb755
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7761269
Reviewed-by: Dave Tapuska <[email protected]>
Commit-Queue: Charlie Reis <[email protected]>
Reviewed-by: Charlie Reis <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1616880}
---

diff --git a/AUTHORS b/AUTHORS
index 7ec65ea..ebb541c 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -1099,6 +1099,7 @@
 Mihai Maerean <[email protected]>
 Mihai Tica <[email protected]>
 Mihai Tica <[email protected]>
+Mihalis Haatainen <[email protected]>
 Mike Pennisi <[email protected]>
 Mike Tilburg <[email protected]>
 Mikhail Pozdnyakov <[email protected]>
diff --git a/content/browser/bad_message.h b/content/browser/bad_message.h
index 4b9d513..d1b63fb 100644
--- a/content/browser/bad_message.h
+++ b/content/browser/bad_message.h
@@ -365,6 +365,7 @@
   RFH_OPEN_URL_INVALID_DISPOSITION = 337,
   RFH_ENTER_FULLSCREEN_PERMISSION_DENIED = 338,
   DT_DUPLICATE_CHILD_TARGET_CREATED = 339,
+  RWH_POINTER_LOCK_FROM_SANDBOXED_FRAME = 340,
 
   // Please add new elements here. The naming convention is abbreviated class
   // name (e.g. RenderFrameHost becomes RFH) plus a unique description of the
diff --git a/content/browser/renderer_host/render_widget_host_delegate.cc b/content/browser/renderer_host/render_widget_host_delegate.cc
index f180bdd..fd4b6b1 100644
--- a/content/browser/renderer_host/render_widget_host_delegate.cc
+++ b/content/browser/renderer_host/render_widget_host_delegate.cc
@@ -133,6 +133,11 @@
   return false;
 }
 
+bool RenderWidgetHostDelegate::IsPointerLockSandboxedForWidget(
+    RenderWidgetHostImpl* render_widget_host) {
+  return false;
+}
+
 bool RenderWidgetHostDelegate::RequestKeyboardLock(RenderWidgetHostImpl* host,
                                                    bool esc_key_locked) {
   return false;
diff --git a/content/browser/renderer_host/render_widget_host_delegate.h b/content/browser/renderer_host/render_widget_host_delegate.h
index e4c41fea..d83118c 100644
--- a/content/browser/renderer_host/render_widget_host_delegate.h
+++ b/content/browser/renderer_host/render_widget_host_delegate.h
@@ -258,6 +258,17 @@
   // pointer isn't locked.
   virtual RenderWidgetHostImpl* GetPointerLockWidget();
 
+  // Returns true if the owning frame of |render_widget_host| is sandboxed
+  // with the kPointerLock flag, meaning the pointer lock request should be
+  // denied. It is ok to only check the top-most frame of the widget, because
+  // any subframes within the widget will be at least as restrictive as it.
+  // Any additional restrictions imposed on subframes of the widget cannot be
+  // enforced by the browser process, because they share a renderer process
+  // with the top-most frame of the widget.
+  // Note: crbug.com/492211919
+  virtual bool IsPointerLockSandboxedForWidget(
+      RenderWidgetHostImpl* render_widget_host);
+
   // Returns true if we are waiting for the user to make a selection on the
   // pointer lock permission request dialog.
   virtual bool IsWaitingForPointerLockPrompt(
diff --git a/content/browser/renderer_host/render_widget_host_impl.cc b/content/browser/renderer_host/render_widget_host_impl.cc
index a97558e..6eef4da 100644
--- a/content/browser/renderer_host/render_widget_host_impl.cc
+++ b/content/browser/renderer_host/render_widget_host_impl.cc
@@ -3279,6 +3279,17 @@
     bool from_user_gesture,
     bool unadjusted_movement,
     input::InputRouterImpl::RequestMouseLockCallback response) {
+  // Browser-side enforcement of the kPointerLock sandbox flag.
+  // The renderer correctly blocks this via PointerLockController, but a
+  // compromised renderer can bypass that check via direct Mojo IPC.
+  // Note: crbug.com/492211919
+  if (delegate_ && delegate_->IsPointerLockSandboxedForWidget(this)) {
+    bad_message::ReceivedBadMessage(
+        GetProcess(), bad_message::RWH_POINTER_LOCK_FROM_SANDBOXED_FRAME);
+    std::move(response).Run(blink::mojom::PointerLockResult::kPermissionDenied,
+                            mojo::NullRemote());
+    return;
+  }
   if (IsPointerLocked()) {
     std::move(response).Run(blink::mojom::PointerLockResult::kAlreadyLocked,
                             /*context=*/mojo::NullRemote());
diff --git a/content/browser/security_exploit_browsertest.cc b/content/browser/security_exploit_browsertest.cc
index aaa2699..29527cd7 100644
--- a/content/browser/security_exploit_browsertest.cc
+++ b/content/browser/security_exploit_browsertest.cc
@@ -3658,4 +3658,38 @@
   EXPECT_TRUE(subframe->IsRenderFrameLive());
 }
 
+// Regression test for browser-side validation of the allow-pointer-lock
+// sandbox attribute. A sandboxed frame without allow-pointer-lock should not
+// be able to acquire pointer lock via Mojo IPC.
+IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,
+                       PointerLockDisallowedFromSandboxedFrame) {
+  IsolateOrigin("b.com");
+  GURL main_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), main_url));
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+  FrameTreeNode* root = web_contents->GetPrimaryFrameTree().root();
+  RenderFrameHostImpl* main_frame = root->current_frame_host();
+  GURL child_url(embedded_test_server()->GetURL("b.com", "/title2.html"));
+  {
+    std::string js_str = base::StringPrintf(
+        "var frame = document.createElement('iframe'); "
+        "frame.sandbox = 'allow-scripts'; "
+        "frame.src = '%s'; "
+        "document.body.appendChild(frame);",
+        child_url.spec().c_str());
+    EXPECT_TRUE(ExecJs(main_frame, js_str));
+    ASSERT_TRUE(WaitForLoadStop(web_contents));
+  }
+  RenderFrameHostImpl* subframe = root->child_at(0)->current_frame_host();
+  EXPECT_TRUE(
+      subframe->IsSandboxed(network::mojom::WebSandboxFlags::kPointerLock));
+  RenderProcessHostBadIpcMessageWaiter kill_waiter(subframe->GetProcess());
+  RenderWidgetHostImpl* rwh = subframe->GetRenderWidgetHost();
+  rwh->RequestMouseLock(false, false, base::DoNothing());
+  EXPECT_EQ(bad_message::RWH_POINTER_LOCK_FROM_SANDBOXED_FRAME,
+            kill_waiter.Wait());
+  EXPECT_FALSE(subframe->IsRenderFrameLive());
+}
+
 }  // namespace content
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index da7bf6a8..73df454 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -5284,6 +5284,24 @@
   }
 }
 
+bool WebContentsImpl::IsPointerLockSandboxedForWidget(
+    RenderWidgetHostImpl* render_widget_host) {
+  // Check the sandbox flags of the frame that owns the requesting widget.
+  // It is ok to only check the top-most frame of the widget, because any
+  // subframes within the widget will be at least as restrictive as it. Any
+  // additional restrictions imposed on subframes of the widget cannot be
+  // enforced by the browser process, because they share a renderer process
+  // with the top-most frame of the widget.
+  // Note: crbug.com/492211919
+  for (FrameTreeNode* node : GetPrimaryFrameTree().Nodes()) {
+    RenderFrameHostImpl* rfh = node->current_frame_host();
+    if (rfh && rfh->GetRenderWidgetHost() == render_widget_host) {
+      return rfh->IsSandboxed(network::mojom::WebSandboxFlags::kPointerLock);
+    }
+  }
+  return false;
+}
+
 bool WebContentsImpl::HasPointerLock(RenderWidgetHostImpl* render_widget_host) {
   // To verify if the mouse is locked, the mouse_lock_widget_ needs to be
   // assigned to the widget that requested the mouse lock, and the top-level
diff --git a/content/browser/web_contents/web_contents_impl.h b/content/browser/web_contents/web_contents_impl.h
index 03b93177..a082cfe 100644
--- a/content/browser/web_contents/web_contents_impl.h
+++ b/content/browser/web_contents/web_contents_impl.h
@@ -1196,6 +1196,8 @@
   DevicePostureProviderImpl* GetDevicePostureProvider() override;
   bool GetResizable() override;
   void LostPointerLock(RenderWidgetHostImpl* render_widget_host) override;
+  bool IsPointerLockSandboxedForWidget(
+      RenderWidgetHostImpl* render_widget_host) override;
   bool HasPointerLock(RenderWidgetHostImpl* render_widget_host) override;
   RenderWidgetHostImpl* GetPointerLockWidget() override;
   bool OnRenderFrameProxyVisibilityChanged(
diff --git a/tools/metrics/histograms/metadata/stability/enums.xml b/tools/metrics/histograms/metadata/stability/enums.xml
index 74cc653..7bf5109e 100644
--- a/tools/metrics/histograms/metadata/stability/enums.xml
+++ b/tools/metrics/histograms/metadata/stability/enums.xml
@@ -506,6 +506,7 @@
   <int value="337" label="RFH_OPEN_URL_INVALID_DISPOSITION"/>
   <int value="338" label="RFH_ENTER_FULLSCREEN_PERMISSION_DENIED"/>
   <int value="339" label="DT_DUPLICATE_CHILD_TARGET_CREATED"/>

diff --git a/content/browser/security_exploit_browsertest.cc b/content/browser/security_exploit_browsertest.cc
index aaa2699..29527cd7 100644
--- a/content/browser/security_exploit_browsertest.cc
+++ b/content/browser/security_exploit_browsertest.cc
@@ -3658,4 +3658,38 @@
   EXPECT_TRUE(subframe->IsRenderFrameLive());
 }
 
+// Regression test for browser-side validation of the allow-pointer-lock
+// sandbox attribute. A sandboxed frame without allow-pointer-lock should not
+// be able to acquire pointer lock via Mojo IPC.
+IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,
+                       PointerLockDisallowedFromSandboxedFrame) {
+  IsolateOrigin("b.com");
+  GURL main_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), main_url));
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+  FrameTreeNode* root = web_contents->GetPrimaryFrameTree().root();
+  RenderFrameHostImpl* main_frame = root->current_frame_host();
+  GURL child_url(embedded_test_server()->GetURL("b.com", "/title2.html"));
+  {
+    std::string js_str = base::StringPrintf(
+        "var frame = document.createElement('iframe'); "
+        "frame.sandbox = 'allow-scripts'; "
+        "frame.src = '%s'; "
+        "document.body.appendChild(frame);",
+        child_url.spec().c_str());
+    EXPECT_TRUE(ExecJs(main_frame, js_str));
+    ASSERT_TRUE(WaitForLoadStop(web_contents));
+  }
+  RenderFrameHostImpl* subframe = root->child_at(0)->current_frame_host();
+  EXPECT_TRUE(
+      subframe->IsSandboxed(network::mojom::WebSandboxFlags::kPointerLock));
+  RenderProcessHostBadIpcMessageWaiter kill_waiter(subframe->GetProcess());
+  RenderWidgetHostImpl* rwh = subframe->GetRenderWidgetHost();
+  rwh->RequestMouseLock(false, false, base::DoNothing());
+  EXPECT_EQ(bad_message::RWH_POINTER_LOCK_FROM_SANDBOXED_FRAME,
+            kill_waiter.Wait());
+  EXPECT_FALSE(subframe->IsRenderFrameLive());
+}
+
 }  // namespace content