Chrome · Autofill › Autofill
CVE-2026-113139
Memory Corruption in Autofill (Autofill)
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
GetAnchorFrameTokenchrome/browser/ui/autofill/autofill_keyboard_accessory_controller_impl.cc |
modified |
Files Changed
chrome/browser/ui/autofill/autofill_popup_controller_impl.ccchrome/browser/ui/autofill/chrome_autofill_client_unittest.cccomponents/autofill/core/browser/foundations/autofill_client.ccchrome/browser/ui/autofill/popup_controller_common.hchrome/browser/ui/autofill/mock_autofill_popup_controller.hchrome/browser/ui/autofill/chrome_autofill_client.ccchrome/browser/ui/autofill/at_memory_suggestion_controller.hchrome/browser/ui/autofill/autofill_suggestion_controller.hchrome/browser/ui/autofill/autofill_popup_controller_interactive_uitest.ccchrome/browser/ui/autofill/autofill_popup_controller_impl.hchrome/browser/ui/autofill/autofill_keyboard_accessory_controller_impl.hchrome/browser/ui/autofill/at_memory_suggestion_controller.ccchrome/browser/ui/autofill/autofill_keyboard_accessory_controller_impl.ccchrome/browser/ui/autofill/popup_controller_common.cccomponents/autofill/core/browser/foundations/autofill_client.h
Patch
From b4a245ba72f5637cff371547b39852fc444ace1e Mon Sep 17 00:00:00 2001 From: Christoph Schwering <[email protected]> Date: Wed, 16 Sep 2026 02:26:39 -0700 Subject: [PATCH] [Autofill] Rename PopupControllerCommon::frame_token to anchor_frame_token This CL's intention is to clarify the meaning of the frame token. It renames - PopupControllerCommon::frame_token to anchor_frame_token - AutofillSuggestionController::GetFrameToken() to GetAnchorFrameToken() Bug: 536607604 Change-Id: Ia4adbabde0217b9ffa0f7e95f66941f6aa897d25 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8410349 Reviewed-by: Jan Keitel <[email protected]> Commit-Queue: Christoph Schwering <[email protected]> Cr-Commit-Position: refs/heads/main@{#1698778} --- diff --git a/chrome/browser/ui/autofill/at_memory_suggestion_controller.cc b/chrome/browser/ui/autofill/at_memory_suggestion_controller.cc index b383ef9e..5527876f 100644 --- a/chrome/browser/ui/autofill/at_memory_suggestion_controller.cc +++ b/chrome/browser/ui/autofill/at_memory_suggestion_controller.cc @@ -169,8 +169,9 @@ NOTREACHED(); } -const LocalFrameToken& AtMemorySuggestionController::GetFrameToken() const { - return controller_common_.frame_token; +const LocalFrameToken& AtMemorySuggestionController::GetAnchorFrameToken() + const { + return controller_common_.anchor_frame_token; } void AtMemorySuggestionController::HideViewAndDie() { diff --git a/chrome/browser/ui/autofill/at_memory_suggestion_controller.h b/chrome/browser/ui/autofill/at_memory_suggestion_controller.h index 21fa9a94..8bf45be 100644 --- a/chrome/browser/ui/autofill/at_memory_suggestion_controller.h +++ b/chrome/browser/ui/autofill/at_memory_suggestion_controller.h @@ -69,7 +69,7 @@ std::optional<UiSessionId> GetUiSessionId() const override; void SetKeepPopupOpenForTesting(bool keep_popup_open_for_testing) override; void UpdateDataListValues(base::span<const SelectOption> options) override; - const LocalFrameToken& GetFrameToken() const override; + const LocalFrameToken& GetAnchorFrameToken() const override; bool MayRecycle( base::WeakPtr<AutofillSuggestionDelegate> delegate, content::WebContents* web_contents, diff --git a/chrome/browser/ui/autofill/autofill_keyboard_accessory_controller_impl.cc b/chrome/browser/ui/autofill/autofill_keyboard_accessory_controller_impl.cc index 4e8828c..d186617 100644 --- a/chrome/browser/ui/autofill/autofill_keyboard_accessory_controller_impl.cc +++ b/chrome/browser/ui/autofill/autofill_keyboard_accessory_controller_impl.cc @@ -728,7 +728,7 @@ content::RenderFrameHost* rfh = nullptr; if (base::FeatureList::IsEnabled(features::kAutofillSimplifyFocusCheck)) { rfh = FindRenderFrameHostByToken(*web_contents_, - controller_common_.frame_token); + controller_common_.anchor_frame_token); } else { // The focused frame may be different from the one the controller is // anchored to. This happens with race conditions: while Autofill parsed the @@ -738,7 +738,7 @@ // event. rfh = web_contents_->GetFocusedFrame(); content::RenderFrameHost* anchor_rfh = FindRenderFrameHostByToken( - *web_contents_, controller_common_.frame_token); + *web_contents_, controller_common_.anchor_frame_token); if (!rfh || !delegate_ || !IsAncestorOf(anchor_rfh, rfh)) { rfh = nullptr; } @@ -833,9 +833,9 @@ } } -const LocalFrameToken& AutofillKeyboardAccessoryControllerImpl::GetFrameToken() - const { - return controller_common_.frame_token; +const LocalFrameToken& +AutofillKeyboardAccessoryControllerImpl::GetAnchorFrameToken() const { + return controller_common_.anchor_frame_token; } bool AutofillKeyboardAccessoryControllerImpl::HasSuggestions() const { diff --git a/chrome/browser/ui/autofill/autofill_keyboard_accessory_controller_impl.h b/chrome/browser/ui/autofill/autofill_keyboard_accessory_controller_impl.h index f264b1b..b1902124 100644 --- a/chrome/browser/ui/autofill/autofill_keyboard_accessory_controller_impl.h +++ b/chrome/browser/ui/autofill/autofill_keyboard_accessory_controller_impl.h @@ -94,7 +94,7 @@ std::optional<UiSessionId> GetUiSessionId() const override; void SetKeepPopupOpenForTesting(bool keep_popup_open_for_testing) override; void UpdateDataListValues(base::span<const SelectOption> options) override; - const LocalFrameToken& GetFrameToken() const override; + const LocalFrameToken& GetAnchorFrameToken() const override; bool MayRecycle( base::WeakPtr<AutofillSuggestionDelegate> delegate, content::WebContents* web_contents, diff --git a/chrome/browser/ui/autofill/autofill_popup_controller_impl.cc b/chrome/browser/ui/autofill/autofill_popup_controller_impl.cc index 67937bd2..15cac07 100644 --- a/chrome/browser/ui/autofill/autofill_popup_controller_impl.cc +++ b/chrome/browser/ui/autofill/autofill_popup_controller_impl.cc @@ -333,7 +333,7 @@ content::RenderFrameHost* rfh = nullptr; if (base::FeatureList::IsEnabled(features::kAutofillSimplifyFocusCheck)) { rfh = FindRenderFrameHostByToken(*web_contents_, - controller_common_.frame_token); + controller_common_.anchor_frame_token); } else { // The focused frame may be different from the one the controller is // anchored to. This happens with race conditions: while Autofill parsed the @@ -343,7 +343,7 @@ // event. rfh = web_contents_->GetFocusedFrame(); content::RenderFrameHost* anchor_rfh = FindRenderFrameHostByToken( - *web_contents_, controller_common_.frame_token); + *web_contents_, controller_common_.anchor_frame_token); const bool focus_is_in_descendant = rfh && delegate_ && IsAncestorOf(anchor_rfh, rfh); @@ -480,8 +480,9 @@ } } -const LocalFrameToken& AutofillPopupControllerImpl::GetFrameToken() const { - return controller_common_.frame_token; +const LocalFrameToken& AutofillPopupControllerImpl::GetAnchorFrameToken() + const { + return controller_common_.anchor_frame_token; } bool AutofillPopupControllerImpl::IsViewVisibilityAcceptingThresholdEnabled() diff --git a/chrome/browser/ui/autofill/autofill_popup_controller_impl.h b/chrome/browser/ui/autofill/autofill_popup_controller_impl.h index e60b4d1e..bd448b2 100644 --- a/chrome/browser/ui/autofill/autofill_popup_controller_impl.h +++ b/chrome/browser/ui/autofill/autofill_popup_controller_impl.h @@ -74,7 +74,7 @@ std::optional<UiSessionId> GetUiSessionId() const override; void SetKeepPopupOpenForTesting(bool keep_popup_open_for_testing) override; void UpdateDataListValues(base::span<const SelectOption> options) override; - const LocalFrameToken& GetFrameToken() const override; + const LocalFrameToken& GetAnchorFrameToken() const override; bool MayRecycle( base::WeakPtr<AutofillSuggestionDelegate> delegate, content::WebContents* web_contents, diff --git a/chrome/browser/ui/autofill/autofill_suggestion_controller.h b/chrome/browser/ui/autofill/autofill_suggestion_controller.h index 998a370..c2c6b99 100644 --- a/chrome/browser/ui/autofill/autofill_suggestion_controller.h +++ b/chrome/browser/ui/autofill/autofill_suggestion_controller.h @@ -107,8 +107,8 @@ // Updates the data list values currently shown. virtual void UpdateDataListValues(base::span<const SelectOption> options) = 0; - // Returns the token of the frame that this controller is associated with. - virtual const LocalFrameToken& GetFrameToken() const = 0; + // Returns the token of the frame that this controller is anchored to. + virtual const LocalFrameToken& GetAnchorFrameToken() const = 0; // Returns true if the controller can be reused for the given parameters. virtual bool MayRecycle( diff --git a/chrome/browser/ui/autofill/chrome_autofill_client.cc b/chrome/browser/ui/autofill/chrome_autofill_client.cc index b1bb721..8ef878fa 100644 --- a/chrome/browser/ui/autofill/chrome_autofill_client.cc +++ b/chrome/browser/ui/autofill/chrome_autofill_client.cc @@ -911,7 +911,7 @@ const LocalFrameToken& frame_token, base::span<const SelectOption> options) { if (suggestion_controller_ && - suggestion_controller_->GetFrameToken() == frame_token) { + suggestion_controller_->GetAnchorFrameToken() == frame_token) { suggestion_controller_->UpdateDataListValues(options); } } @@ -1442,7 +1442,7 @@ suggestion_controller_ = AutofillSuggestionController::GetOrCreate( suggestion_controller_, delegate, web_contents(), PopupControllerCommon( - open_args.frame_token, element_bounds_in_screen_space, + open_args.anchor_frame_token, element_bounds_in_screen_space, open_args.text_direction, open_args.anchor_type, open_args.show_tabbed_popup, open_args.prefer_prev_arrow_side_on_suggestions_update), diff --git a/chrome/browser/ui/autofill/mock_autofill_popup_controller.h b/chrome/browser/ui/autofill/mock_autofill_popup_controller.h index 7de6c73..651ddc80 100644 --- a/chrome/browser/ui/autofill/mock_autofill_popup_controller.h +++ b/chrome/browser/ui/autofill/mock_autofill_popup_controller.h @@ -52,9 +52,11 @@ void set_element_bounds(const gfx::RectF& bounds) { element_bounds_ = bounds; } - const LocalFrameToken& GetFrameToken() const override { return frame_token_; } - void set_frame_token(const LocalFrameToken& frame_token) { - frame_token_ = frame_token; + const LocalFrameToken& GetAnchorFrameToken() const override { + return anchor_frame_token_; + } + void set_anchor_frame_token(const LocalFrameToken& frame_token) { + anchor_frame_token_ = frame_token; } MOCK_METHOD(base::i18n::TextDirection, GetElementTextDirection, @@ -170,7 +172,7 @@ "Arial, Times New Roman, 15px"}; gfx::RectF element_bounds_ = {100, 100, 250, 50}; PopupAnchorType anchor_type_ = PopupAnchorType::kField; - LocalFrameToken frame_token_; + LocalFrameToken anchor_frame_token_; base::WeakPtrFactory<MockAutofillPopupController> weak_ptr_factory_{this}; }; diff --git a/chrome/browser/ui/autofill/popup_controller_common.cc b/chrome/browser/ui/autofill/popup_controller_common.cc index 76a9479f..fd4393d 100644 --- a/chrome/browser/ui/autofill/popup_controller_common.cc +++ b/chrome/browser/ui/autofill/popup_controller_common.cc @@ -11,13 +11,13 @@ namespace autofill { PopupControllerCommon::PopupControllerCommon( - LocalFrameToken frame_token, + LocalFrameToken anchor_frame_token, gfx::RectF element_bounds, base::i18n::TextDirection text_direction, PopupAnchorType anchor_type, bool show_tabbed_popup, bool prefer_prev_arrow_side_on_suggestions_update) - : frame_token(std::move(frame_token)), + : anchor_frame_token(std::move(anchor_frame_token)), element_bounds(std::move(element_bounds)), text_direction(text_direction), anchor_type(anchor_type), diff --git a/chrome/browser/ui/autofill/popup_controller_common.h b/chrome/browser/ui/autofill/popup_controller_common.h index 13ce9070..85050ea8 100644 --- a/chrome/browser/ui/autofill/popup_controller_common.h +++ b/chrome/browser/ui/autofill/popup_controller_common.h @@ -18,7 +18,7 @@ struct PopupControllerCommon { public: PopupControllerCommon( - LocalFrameToken frame_token, + LocalFrameToken anchor_frame_token, gfx::RectF element_bounds, base::i18n::TextDirection text_direction, PopupAnchorType anchor_type = PopupAnchorType::kField, @@ -33,7 +33,7 @@ // The frame in which the popup is anchored. Typically this is the frame of // the field on which the user triggered Autofill. - LocalFrameToken frame_token; + LocalFrameToken anchor_frame_token; // The bounds of the DOM element that is the focus of the popup. // These coordinates are in screen space. diff --git a/components/autofill/core/browser/foundations/autofill_client.cc b/components/autofill/core/browser/foundations/autofill_client.cc index b7298b85..161a1105 100644 --- a/components/autofill/core/browser/foundations/autofill_client.cc +++ b/components/autofill/core/browser/foundations/autofill_client.cc @@ -46,7 +46,7 @@ AutofillClient::PopupOpenArgs::PopupOpenArgs() = default; AutofillClient::PopupOpenArgs::PopupOpenArgs( - LocalFrameToken frame_token, + LocalFrameToken anchor_frame_token, const gfx::RectF& element_bounds, base::i18n::TextDirection text_direction, std::vector<Suggestion> suggestions, @@ -56,7 +56,7 @@ bool show_tabbed_popup, bool prefer_prev_arrow_side_on_suggestions_update, std::u16string search_bar_initial_value) - : frame_token(std::move(frame_token)), + : anchor_frame_token(std::move(anchor_frame_token)), element_bounds(element_bounds), text_direction(text_direction), suggestions(std::move(suggestions)), diff --git a/components/autofill/core/browser/foundations/autofill_client.h b/components/autofill/core/browser/foundations/autofill_client.h index 58d2f4c..4146d60f 100644 --- a/components/autofill/core/browser/foundations/autofill_client.h +++ b/components/autofill/core/browser/foundations/autofill_client.h @@ -288,7 +288,7 @@ // Required arguments to create a dropdown showing autofill suggestions. struct PopupOpenArgs { PopupOpenArgs(); - PopupOpenArgs(LocalFrameToken frame_token, + PopupOpenArgs(LocalFrameToken anchor_frame_token, const gfx::RectF& element_bounds, base::i18n::TextDirection text_direction, std::vector<Suggestion> suggestions, @@ -303,9 +303,9 @@ PopupOpenArgs& operator=(const PopupOpenArgs&); PopupOpenArgs& operator=(PopupOpenArgs&&); ~PopupOpenArgs(); - // The frame in which the popup is anchored. Typically this is the frame of + // The frame which the popup is anchored to. Typically this is the frame of // the field on which the user triggered Autofill. - LocalFrameToken frame_token; + LocalFrameToken anchor_frame_token; // TODO(crbug.com/340817507): Update this member name since bounds can now // refer to the caret bounds and elements gives the idea of HTML elements // only. diff --git a/chrome/browser/ui/autofill/autofill_popup_controller_interactive_uitest.cc b/chrome/browser/ui/autofill/autofill_popup_controller_interactive_uitest.cc index 71171c81..b38fd560 100644 --- a/chrome/browser/ui/autofill/autofill_popup_controller_interactive_uitest.cc +++ b/chrome/browser/ui/autofill/autofill_popup_controller_interactive_uitest.cc @@ -220,13 +220,13 @@ {u"suggestion2", u"suggestion2"}, {u"suggestion3", u"suggestion3"}, {u"suggestion4", u"suggestion4"}}; - client->UpdateAutofillDataListValues(controller->GetFrameToken(), rows); + client->UpdateAutofillDataListValues(controller->GetAnchorFrameToken(), rows); int original_suggestions_count = controller->GetLineCount(); static_cast<AutofillPopupController&>(*controller).SelectSuggestion(3); // Replace the list with the smaller one. rows = {{u"suggestion1", u"suggestion1"}}; - client->UpdateAutofillDataListValues(controller->GetFrameToken(), rows); + client->UpdateAutofillDataListValues(controller->GetAnchorFrameToken(), rows); // Make sure that previously selected line #3 doesn't exist. ASSERT_LT(controller->GetLineCount(), original_suggestions_count); // Selecting a new line should not crash. diff --git a/chrome/browser/ui/autofill/chrome_autofill_client_unittest.cc b/chrome/browser/ui/autofill/chrome_autofill_client_unittest.cc index 427c8ba..4fa42906 100644 --- a/chrome/browser/ui/autofill/chrome_autofill_client_unittest.cc +++ b/chrome/browser/ui/autofill/chrome_autofill_client_unittest.cc @@ -1283,7 +1283,7 @@ LocalFrameToken token2(base::UnguessableToken::Create()); testing::NiceMock<MockAutofillPopupController> mock_controller; - mock_controller.set_frame_token(token1); + mock_controller.set_anchor_frame_token(token1); client()->set_suggestion_controller_for_testing(mock_controller.GetWeakPtr());
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/chrome/browser/ui/autofill/autofill_popup_controller_interactive_uitest.cc b/chrome/browser/ui/autofill/autofill_popup_controller_interactive_uitest.cc
index 71171c81..b38fd560 100644
--- a/chrome/browser/ui/autofill/autofill_popup_controller_interactive_uitest.cc
+++ b/chrome/browser/ui/autofill/autofill_popup_controller_interactive_uitest.cc
@@ -220,13 +220,13 @@
{u"suggestion2", u"suggestion2"},
{u"suggestion3", u"suggestion3"},
{u"suggestion4", u"suggestion4"}};
- client->UpdateAutofillDataListValues(controller->GetFrameToken(), rows);
+ client->UpdateAutofillDataListValues(controller->GetAnchorFrameToken(), rows);
int original_suggestions_count = controller->GetLineCount();
static_cast<AutofillPopupController&>(*controller).SelectSuggestion(3);
// Replace the list with the smaller one.
rows = {{u"suggestion1", u"suggestion1"}};
- client->UpdateAutofillDataListValues(controller->GetFrameToken(), rows);
+ client->UpdateAutofillDataListValues(controller->GetAnchorFrameToken(), rows);
// Make sure that previously selected line #3 doesn't exist.
ASSERT_LT(controller->GetLineCount(), original_suggestions_count);
// Selecting a new line should not crash.
diff --git a/chrome/browser/ui/autofill/chrome_autofill_client_unittest.cc b/chrome/browser/ui/autofill/chrome_autofill_client_unittest.cc
index 427c8ba..4fa42906 100644
--- a/chrome/browser/ui/autofill/chrome_autofill_client_unittest.cc
+++ b/chrome/browser/ui/autofill/chrome_autofill_client_unittest.cc
@@ -1283,7 +1283,7 @@
LocalFrameToken token2(base::UnguessableToken::Create());
testing::NiceMock<MockAutofillPopupController> mock_controller;
- mock_controller.set_frame_token(token1);
+ mock_controller.set_anchor_frame_token(token1);
client()->set_suggestion_controller_for_testing(mock_controller.GetWeakPtr());
Loading diff…
Original Bug Report
reported by [email protected]
Unfocused subframe can show or replace the active Autofill popup via kAutofillSimplifyFocusCheck
Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.
Overview: The default-enabled kAutofillSimplifyFocusCheck feature simplifies the focus check in Autofill popup controllers to an existence-only lookup. This potentially allows a compromised, unfocused, cross-origin subframe to trigger, show, or replace the active per-tab Autofill popup while the user is actively interacting with a focused sibling frame. Consequently, this enables browser-process security UI spoofing and Autofill credential/profile hijacking.
Affected files:
chrome/browser/ui/autofill/autofill_popup_controller_impl.ccchrome/browser/ui/autofill/autofill_keyboard_accessory_controller_impl.cc
Estimated timestamp from git blame: 2026-07-03
Root Cause Analysis
The default-enabled feature kAutofillSimplifyFocusCheck (defined in components/autofill/core/common/autofill_features.cc) was introduced to simplify the focus checks performed before showing Autofill suggestions.
Specifically, in AutofillPopupControllerImpl::Show() (and its Android counterpart AutofillKeyboardAccessoryControllerImpl::Show()), the previous safety gate that verified whether the anchoring frame was an ancestor of the currently focused frame (IsAncestorOf(anchor_rfh, focused_rfh)) is bypassed when the feature is enabled. Instead, the controller performs an existence-only frame lookup using the caller’s frame token:
// chrome/browser/ui/autofill/autofill_popup_controller_impl.cc
content::RenderFrameHost* rfh = nullptr;
if (base::FeatureList::IsEnabled(features::kAutofillSimplifyFocusCheck)) {
rfh = FindRenderFrameHostByToken(*web_contents_,
controller_common_.frame_token);
} else {
...
rfh = web_contents_->GetFocusedFrame();
content::RenderFrameHost* anchor_rfh = FindRenderFrameHostByToken(
*web_contents_, controller_common_.frame_token);
const bool focus_is_in_descendant =
rfh && delegate_ && IsAncestorOf(anchor_rfh, rfh);
if (!focus_is_in_descendant) {
...
Hide(SuggestionHidingReason::kNoFrameHasFocus);
return;
}
}
FindRenderFrameHostByToken simply iterates through all RenderFrameHosts in the WebContents and returns any frame matching the token, regardless of focus state or active status.
Since there are no other per-subframe focus or ancestry checks on the path from the renderer’s AskForValuesToFill IPC down to the browser’s Show() method, an active but completely unfocused cross-origin subframe can successfully invoke and display its Autofill suggestions over a focused sibling frame.
Potential Attack Scenario
Note: Our tooling agent does not have the capability to run code or execute a live proof of concept; the steps below describe the logical attack path based on code analysis.
- A page embeds Sibling Frame A (
attacker.example, running a compromised renderer) and Sibling Frame B (victim.example, containing a legitimate input field). - The user interacts with and clicks on Frame B’s input field, making Frame B the focused frame (
web_contents_->GetFocusedFrame()). - Sibling Frame A’s compromised renderer sends a
mojom::AutofillDriver::AskForValuesToFillIPC message with a customFormDatastructure containing a field withis_focusable = trueand custom coordinates/bounds positioned over Sibling Frame B’s input field. - In the browser process,
RouteToManagerconverts and processes the request. The bounds are translated into root coordinates, placing them directly over Frame B’s input. - The browser-side
ChromeAutofillClient::ShowAutofillSuggestionsImplis invoked. It callsGetOrCreate()to handle the active popup controller. - Since the delegate for the request (Frame A) differs from the existing controller’s delegate (Frame B), recycling fails. The browser hides Frame B’s legitimate popup and instantiates a new controller for Frame A.
AutofillPopupControllerImpl::Show()is called. The tab-level focus check passes because the tab itself is active.- Since
kAutofillSimplifyFocusCheckis enabled, the controller callsFindRenderFrameHostByTokenon Frame A’s token. This succeeds and returns Frame A’s validRenderFrameHost. - The controller binds the keypress observer and popup lifecycle helper to Sibling Frame A, meaning keypresses or frame-level changes in Sibling Frame B will not dismiss the popup.
- A browser-native, trusted Autofill dropdown is shown directly over Sibling Frame B’s input field. If the user accepts a suggestion, the filled data is dispatched to Sibling Frame A’s delegate, leaking sensitive autofill information to the attacker’s domain.
Suggested Fix
To remediate this issue, the browser-process Autofill pipeline must enforce that the frame initiating the request is either the currently focused frame or an ancestor of the focused frame. If kAutofillSimplifyFocusCheck is to be kept enabled, the simplified check should still validate that the request is initiated by a frame that is authorized to show popups in the active tab (e.g., verifying focus or ancestry at the IPC boundary or during suggestion display), rather than relying solely on frame existence.
Evaluated with Chrome root at commit: bf775e5d75cb9e1767e2cd02cc93efa0077d14a5
Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:
- If you are familiar with the severity guidelines, you may adjust the severity.
- If this is a false positive, and there’s no work to be done, please close as WAI.
- If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.
Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.
References
On This Page