Chrome · PDFium › PDFium
CVE-2026-113022
Memory Corruption in PDFium (PDFium)
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
testing/resources/javascript/textbox_keyboard_event_expected.txttesting/resources/javascript/textbox_on_load_expected.txttesting/resources/javascript/textbox_keyboard_no_event_expected.txttesting/resources/javascript/textbox_keyboard_no_event.intesting/resources/javascript/textbox_on_load.intesting/resources/javascript/textbox_keyboard_event.evttesting/resources/javascript/textbox_keyboard_event.in
Patch
From 67e899575690dd52875592e0b3e09bff89cdaa56 Mon Sep 17 00:00:00 2001 From: Lei Zhang <[email protected]> Date: Thu, 17 Sep 2026 16:51:48 -0700 Subject: [PATCH] Add some JavaScript tests for textboxes - textbox_keyboard_event.in / textbox_keyboard_event.evt: Should trigger JS due to the keyboard event. - textbox_keyboard_no_event.in: Should not trigger JS due to the lack of keyboard events. - textbox_on_load.in: Should not trigger JS due to the lack of keyboard events, but actually does. Inputs based on AI-suggestions attached to the bug report. Bug: 494352583 Change-Id: Ifad2e9c232d50e924da79bfd1cddfd6c032e59e8 Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/158310 Reviewed-by: Tom Sepez <[email protected]> Commit-Queue: Lei Zhang <[email protected]> --- diff --git a/testing/resources/javascript/textbox_keyboard_event.evt b/testing/resources/javascript/textbox_keyboard_event.evt new file mode 100644 index 0000000..f164fdd --- /dev/null +++ b/testing/resources/javascript/textbox_keyboard_event.evt @@ -0,0 +1,3 @@ +mousedown,left,100,100 +mouseup,left,100,100 +charcode,65 diff --git a/testing/resources/javascript/textbox_keyboard_event.in b/testing/resources/javascript/textbox_keyboard_event.in new file mode 100644 index 0000000..080a117 --- /dev/null +++ b/testing/resources/javascript/textbox_keyboard_event.in @@ -0,0 +1,55 @@ +{{header}} +{{object 1 0}} << + /Type /Catalog + /Pages 2 0 R + /AcroForm << + /Fields [4 0 R] + /DR << + /Font << + /F1 5 0 R + >> + >> + >> +>> +endobj +{{object 2 0}} << + /Type /Pages + /Count 1 + /Kids [3 0 R] +>> +endobj +{{object 3 0}} << + /Type /Page + /Parent 2 0 R + /MediaBox [0 0 200 200] + /Annots [4 0 R] +>> +endobj +{{object 4 0}} << + /Type /Annot + /Subtype /Widget + /FT /Tx + /T (MyField) + /DA (0 0 0 rg /F1 12 Tf) + /Rect [50 50 150 150] + /AA << + /K 6 0 R + >> +>> +endobj +{{object 5 0}} << + /Type /Font + /Subtype /Type1 + /BaseFont /Helvetica +>> +endobj +{{object 6 0}} << + /Type /Action + /S /JavaScript + /JS (app.alert('done')) +>> +endobj +{{xref}} +{{trailer}} +{{startxref}} +%%EOF diff --git a/testing/resources/javascript/textbox_keyboard_event_expected.txt b/testing/resources/javascript/textbox_keyboard_event_expected.txt new file mode 100644 index 0000000..daa1eca --- /dev/null +++ b/testing/resources/javascript/textbox_keyboard_event_expected.txt @@ -0,0 +1 @@ +Alert: done diff --git a/testing/resources/javascript/textbox_keyboard_no_event.in b/testing/resources/javascript/textbox_keyboard_no_event.in new file mode 100644 index 0000000..080a117 --- /dev/null +++ b/testing/resources/javascript/textbox_keyboard_no_event.in @@ -0,0 +1,55 @@ +{{header}} +{{object 1 0}} << + /Type /Catalog + /Pages 2 0 R + /AcroForm << + /Fields [4 0 R] + /DR << + /Font << + /F1 5 0 R + >> + >> + >> +>> +endobj +{{object 2 0}} << + /Type /Pages + /Count 1 + /Kids [3 0 R] +>> +endobj +{{object 3 0}} << + /Type /Page + /Parent 2 0 R + /MediaBox [0 0 200 200] + /Annots [4 0 R] +>> +endobj +{{object 4 0}} << + /Type /Annot + /Subtype /Widget + /FT /Tx + /T (MyField) + /DA (0 0 0 rg /F1 12 Tf) + /Rect [50 50 150 150] + /AA << + /K 6 0 R + >> +>> +endobj +{{object 5 0}} << + /Type /Font + /Subtype /Type1 + /BaseFont /Helvetica +>> +endobj +{{object 6 0}} << + /Type /Action + /S /JavaScript + /JS (app.alert('done')) +>> +endobj +{{xref}} +{{trailer}} +{{startxref}} +%%EOF diff --git a/testing/resources/javascript/textbox_keyboard_no_event_expected.txt b/testing/resources/javascript/textbox_keyboard_no_event_expected.txt new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/testing/resources/javascript/textbox_keyboard_no_event_expected.txt diff --git a/testing/resources/javascript/textbox_on_load.in b/testing/resources/javascript/textbox_on_load.in new file mode 100644 index 0000000..fbe5b26 --- /dev/null +++ b/testing/resources/javascript/textbox_on_load.in @@ -0,0 +1,74 @@ +{{header}} +{{object 1 0}} << + /Type /Catalog + /Pages 2 0 R + /AcroForm << + /Fields [4 0 R 6 0 R] + /DR << + /Font << + /F1 7 0 R + >> + >> + >> + /OpenAction 8 0 R +>> +endobj +{{object 2 0}} << + /Type /Pages + /Count 1 + /Kids [3 0 R] +>> +endobj +{{object 3 0}} << + /Type /Page + /Parent 2 0 R + /Annots [4 0 R 6 0 R] + /MediaBox [0 0 400 400] +>> +endobj +{{object 4 0}} << + /Type /Annot + /Subtype /Widget + /T (SubmitFormButton) + /FT /Btn + /Ff 65536 + /Rect [150 150 250 250] + /AA << + /D 5 0 R + >> +>> +endobj +{{object 5 0}} << + /Type /Action + /S /JavaScript + /JS (app.alert('done')) +>> +endobj +{{object 6 0}} << + /Type /Annot + /Subtype /Widget + /T (Field1) + /FT /Tx + /DA (0 0 0 rg /F1 12 Tf) + /Rect [50 300 350 340] + /AA << + /K 5 0 R + >> +>> +endobj +{{object 7 0}} << + /Type /Font + /Subtype /Type1 + /BaseFont /Helvetica +>> +endobj +{{object 8 0}} << + /Type /Action + /S /JavaScript + /JS (this.getField\('Field1'\).value = 'A';) +>> +endobj +{{xref}} +{{trailer}} +{{startxref}} +%%EOF diff --git a/testing/resources/javascript/textbox_on_load_expected.txt b/testing/resources/javascript/textbox_on_load_expected.txt new file mode 100644 index 0000000..daa1eca --- /dev/null +++ b/testing/resources/javascript/textbox_on_load_expected.txt @@ -0,0 +1 @@ +Alert: done
Loading diff…
Original Bug Report
reported by [email protected]
PDF JavaScript Document.submitForm() can submit without a real user gesture.
VULNERABILITY DETAILS Document.submitForm() is intended to require user interaction before it can submit. However, this can be bypassed by attaching the JavaScript containing submitForm() as a field’s K action, then programmatically modifying the field in OpenAction. When a field is modified, whether it is modified programmatically or by a user, PDFium calls OnKeyStrokeCommit() and dispatches the field’s K action in a kKeyStroke event context. This makes submitForm() incorrectly treat that synthetic event path as satisfying the gesture requirement. As a result, simply opening the PDF is enough to trigger a network submission without any user click or keypress.
VERSION Chrome Version: 146.0.7680.154 (Official Build) (Stable) (64-bit) Operating System: Windows 11 26H1 Build 28000.1719
REPRODUCTION CASE The attached poc.pdf is the minimum proof of concept to reproduce this issue. When opened in a Chrome browser, whether by double-clicking, dragging to chrome window, or typing its address in the address bar, it submits itself to http://127.0.0.1:8000/ without any user interaction. Reproduction steps:
- Start a local HTTP listener, for example, on http://127.0.0.1:8000/.
- Open the PDF in Chrome’s built-in PDF viewer.
- Do not click or type anything.
- Observe that Chrome still sends the submission request.
CREDIT INFORMATION Reporter credit: Jamos Zhu, Sebastian Dowell
References
On This Page