Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: A potential heap-use-after-free read vulnerability exists in the browser process within the Autofill BNPL implementation. A non-owning std::string_view in a network request structure can become dangling if the parent BnplManager is destroyed during an asynchronous OAuth token fetch.

Affected files:

• components/autofill/core/browser/payments/payments_request_details.h
• components/autofill/core/browser/payments/bnpl_manager.cc
• components/autofill/core/browser/payments/payments_network_interface_base.cc
• components/autofill/core/browser/payments/payments_requests/get_bnpl_payment_instrument_for_fetching_url_request.cc
• components/autofill/core/browser/foundations/browser_autofill_manager.cc

Estimated timestamp from git blame: 2025-01-20

Technical Description

A potential heap-use-after-free (UAF) read has been identified in the browser process in the Buy Now, Pay Later (BNPL) Autofill flow. The issue arises from the use of a non-owning std::string_view in the GetBnplPaymentInstrumentForFetchingUrlRequestDetails structure, which stores device fingerprinting data (risk_data).

Vulnerability Mechanism

In components/autofill/core/browser/payments/payments_request_details.h (line 518), the struct GetBnplPaymentInstrumentForFetchingUrlRequestDetails stores risk_data as a std::string_view. This is inconsistent with other request structures in the same file that use owning std::string objects for similar data.

During a BNPL flow, BnplManager::FetchRedirectUrl() populates this structure, assigning the risk_data view to a string owned by OngoingFlowState, which is managed by BnplManager. BnplManager is a per-frame object (owned by BrowserAutofillManager).

The request is then passed to PaymentsNetworkInterface, which is a per-WebContents object. If the network request requires an asynchronous OAuth token fetch, the interface initiates the fetch and returns control to the event loop.

The UAF Trigger

If the frame is navigated or detached while the OAuth token fetch is pending, BrowserAutofillManager::Reset() is called, which destroys the BnplManager. Crucially, the BnplManager destructor is the default implementation and does not explicitly cancel ongoing requests in the PaymentsNetworkInterface.

When BnplManager is destroyed, its OngoingFlowState is deleted, and the backing std::string for risk_data is freed. Once the token fetch completes, PaymentsNetworkInterfaceBase::SetOAuth2TokenAndStartRequest() calls request_->GetRequestContent(). In get_bnpl_payment_instrument_for_fetching_url_request.cc, this implementation dereferences the now-dangling std::string_view to build the JSON request body, leading to a heap-UAF read.

Potential Impact

This results in a heap-use-after-free read in the privileged browser process. A compromised renderer could potentially exploit this by grooming the heap during the asynchronous window to exfiltrate browser process memory contents via the resulting network request. This issue also causes a browser process crash (Denial of Service). As std::string_view does not use raw_ptr, this is not protected by MiraclePtr.

Suggested Potential Reproduction Steps

1. Use a Chrome build with BNPL features enabled.
2. Trigger a BNPL flow on a merchant site (e.g., by selecting a BNPL issuer from Autofill suggestions).
3. While the browser is fetching redirect details (specifically during the OAuth token fetch phase), navigate the tab or remove the associated iframe (e.g., using window.location.href = ... or iframe.remove()).
4. If the OAuth token was not previously cached, the completion of the fetch should trigger a dereference of the freed memory in the browser process.

Recommended Fix

The GetBnplPaymentInstrumentForFetchingUrlRequestDetails structure should be updated to use an owning std::string for the risk_data field, matching the design of GetBnplPaymentInstrumentForFetchingVcnRequestDetails and other sibling structures. Additionally, the BnplManager destructor should ensure all pending requests are cancelled.

Evaluated with Chrome root at commit: 29093e11cf509e3593f6229e4b1b075cca356049

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

• If you are familiar with the severity guidelines, you may adjust the severity.
• If this is a false positive, and there’s no work to be done, please close as WAI.
• If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.