Report description

Incomplete fix for CVE-2024-10229: service worker still intercepts EventSource and sendBeacon from extension isolated worlds

Bug location

Where do you want to report your vulnerability?

Chrome VRP – Report security issues affecting the Chrome browser. See program rules

Which URL (or repository) have you found the vulnerability in?

https://chromium.googlesource.com/chromium/src/+/main/third_party/blink/renderer/modules/eventsource/event_source.cc

The problem

Please describe the technical details of the vulnerability

Tested on: Chromium 146.0.7680.164 (Ubuntu snap package, Ubuntu 24.04 LTS x86_64), default settings, no flags.

Summary

CVE-2024-10229 fixed service worker interception of some extension content script requests from isolated worlds. Based on local testing, fetch() and XHR now bypass the page’s service worker, but EventSource and sendBeacon still appear to go through it.

A page-controlled service worker can:

• return attacker-controlled data to an extension’s EventSource
• observe the body of an extension’s sendBeacon

PoC Setup

Place the attached files into two folders:

• extension/ – manifest.json, content.js (the test extension)
• server/ – server.py, sw.js, index.html (the attacker’s page and service worker)

Requires: Python 3 and Chromium (or Chrome). No other dependencies.

Steps to Reproduce

1. Open a terminal in the PoC root folder and start the server:

   python3 server/server.py
   

2. Open a second terminal in the same folder and launch Chromium:

   chromium --no-first-run --user-data-dir=/tmp/es-test \
     --load-extension=extension/ \
     http://localhost:8888
   

3. In the browser, press F12 to open DevTools and go to the Console tab
4. Refresh the page once (this lets the service worker activate and claim the page)
5. The content script runs all four tests and prints a results block:

   === RESULTS ===
   EventSource: INJECTED_BY_SERVICE_WORKER
   fetch:       data: REAL_SERVER_DATA
   XHR:         timeout
   sendBeacon:  INTERCEPTED by SW (body: {"secret":"EXTENSION_DATA"})
   ===============
   

EventSource and sendBeacon are intercepted by the service worker. fetch and XHR are not. (XHR shows “timeout” because the SSE stream stays open, but it was not intercepted by the SW – the request went to the real server.)

Expected Result

Requests from extension isolated worlds should not be observable or response-controllable by a page service worker. Current stable already enforces this for fetch() and XHR.

Actual Result

EventSource and sendBeacon from the isolated world are still handled by the page’s service worker, while fetch() and XHR are not.

Additional Notes

Based on source review of current Chromium, third_party/blink/renderer/modules/eventsource/event_source.cc (Connect()) and third_party/blink/renderer/core/loader/ping_loader.cc (SendBeaconCommon()) do not call SetSkipServiceWorker(true) for isolated worlds, while fetch_manager.cc and xml_http_request.cc do.

Impact analysis

A malicious site with an active service worker can still intercept network requests from an extension content script’s isolated world when the script uses EventSource or sendBeacon. This allows attacker-controlled response injection into EventSource and disclosure of sendBeacon payloads across the same isolation boundary that CVE-2024-10229 was meant to protect.

If an extension uses EventSource on a page where a malicious service worker controls the origin, the worker can replace the SSE data the extension receives.

The cause

What version of Chrome have you found the security issue in?

146.0.7680.164 stable

Is the security issue related to a crash?

No, it is not related to a crash.

Choose the type of vulnerability

Sensitive data exposure

How would you like to be publicly acknowledged for your report?

foxribeye