From 4e3702db97c2dd7de414837c8056e847bce2fc3a Mon Sep 17 00:00:00 2001
From: Tim Judkins <[email protected]>
Date: Fri, 12 Jun 2026 02:13:48 -0700
Subject: [PATCH] [Extensions] Move userscript access validation after async file load

This CL moves the access validation checks for `userScripts.execute` to
happen after any associated asynchronous file load that happens,
aligning it with the similar checks we do for `scripting.executeScript`.
Previously if a cross-origin navigation happened between the time of
checking access and actual execution, the script would still be blocked
by later checks, but the process could get incorrectly marked as having
executed a user script. This CL resolves this case and adds a test to
cover it.

As an added bonus resolves a potential use-after-free crash that might
have happened if the tab was closed during the async load, due to the
raw ScriptExecutor pointer no longer needing to be passed through to
UserScriptsExecuteFunction::DidLoadResources.

Additionally a small tweak was needed for the existing
userScripts.execute test. It tests some error messages around access
being blocked, but it was specifying a script file that didn't actually
exist. Since the access check has been moved to after the file load,
this resulted in an error for the file not existing instead of access.
To resolve this the `script.js` file has been added to the test
extension so the file load actually succeeds.

Fixed: 513199795
Change-Id: Ide343225a8c531acc6a11a47be81fe94a9fb08a0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7924186
Reviewed-by: Andrea Orru <[email protected]>
Commit-Queue: Tim <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1645782}
---

diff --git a/chrome/browser/extensions/api/user_scripts/user_scripts_apitest.cc b/chrome/browser/extensions/api/user_scripts/user_scripts_apitest.cc
index 9e7c447..4c8f0ef 100644
--- a/chrome/browser/extensions/api/user_scripts/user_scripts_apitest.cc
+++ b/chrome/browser/extensions/api/user_scripts/user_scripts_apitest.cc
@@ -19,10 +19,12 @@
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/test_navigation_observer.h"
 #include "extensions/browser/background_script_executor.h"
+#include "extensions/browser/extension_file_task_runner.h"
 #include "extensions/browser/extension_prefs.h"
 #include "extensions/browser/extension_registry.h"
 #include "extensions/browser/extension_util.h"
 #include "extensions/browser/renderer_startup_helper.h"
+#include "extensions/browser/script_injection_tracker.h"
 #include "extensions/browser/user_script_manager.h"
 #include "extensions/buildflags/buildflags.h"
 #include "extensions/common/extension_features.h"
@@ -199,6 +201,68 @@
       << message_;
 }
 
+// Tests that executing user scripts correctly handles a cross-document
+// navigation occurring during the asynchronous file loading phase, preventing
+// unauthorized script execution or improper marking of the new process.
+IN_PROC_BROWSER_TEST_F(UserScriptsAPITest,
+                       ExecuteUserScripts_CrossDocumentNavigationRace) {
+  ExtensionTestMessageListener ready_listener("ready",
+                                              ReplyBehavior::kWillReply);
+  ExtensionTestMessageListener tab_created_listener("tab_created",
+                                                    ReplyBehavior::kWillReply);
+  ExtensionTestMessageListener execute_called_listener(
+      "execute_called", ReplyBehavior::kWillReply);
+
+  ResultCatcher catcher;
+
+  const Extension* extension =
+      LoadExtension(test_data_dir_.AppendASCII("user_scripts/navigation_race"));
+  ASSERT_TRUE(extension);
+
+  user_scripts_test_util::SetUserScriptsAPIAllowed(profile(), extension->id(),
+                                                   /*allowed=*/true);
+
+  ASSERT_TRUE(ready_listener.WaitUntilSatisfied());
+  ready_listener.Reply(
+      embedded_test_server()->GetURL("a.com", "/empty.html").spec());
+
+  ASSERT_TRUE(tab_created_listener.WaitUntilSatisfied());
+
+  // Block the file task runner.
+  base::WaitableEvent block_file_task_runner;
+  GetExtensionFileTaskRunner()->PostTask(
+      FROM_HERE, base::BindLambdaForTesting([&]() {
+        base::ScopedAllowBaseSyncPrimitivesForTesting allow_blocking;
+        block_file_task_runner.Wait();
+      }));
+
+  tab_created_listener.Reply("");
+
+  ASSERT_TRUE(execute_called_listener.WaitUntilSatisfied());
+
+  // Now userScripts.execute() has been called. The file task is queued.
+  // Navigate the tab to c.com, which the extension does not have permission
+  // for.
+  content::WebContents* web_contents = GetActiveWebContents();
+  ASSERT_TRUE(NavigateToURL(
+      web_contents, embedded_test_server()->GetURL("c.com", "/empty.html")));
+
+  // Unblock file task runner
+  block_file_task_runner.Signal();
+
+  execute_called_listener.Reply("");
+
+  // Wait for the result from the extension. The execute should result in an
+  // expected error due to the script being blocked after the navigation.
+  EXPECT_TRUE(catcher.GetNextResult()) << catcher.message();
+
+  // Verify that the new document's process was not marked as having run user
+  // scripts.
+  content::RenderFrameHost* main_frame = web_contents->GetPrimaryMainFrame();
+  EXPECT_FALSE(ScriptInjectionTracker::DidProcessRunUserScriptFromExtension(
+      *main_frame->GetProcess(), extension->id()));
+}
+
 // TODO(crbug.com/335421977): Flaky on "Linux ChromiumOS MSan Tests".
 #if BUILDFLAG(IS_CHROMEOS) && defined(MEMORY_SANITIZER)
 #define MAYBE_ConfigureWorld DISABLED_ConfigureWorld
diff --git a/chrome/test/data/extensions/api_test/user_scripts/execute/script.js b/chrome/test/data/extensions/api_test/user_scripts/execute/script.js
new file mode 100644
index 0000000..214229f
--- /dev/null
+++ b/chrome/test/data/extensions/api_test/user_scripts/execute/script.js
@@ -0,0 +1,5 @@
+// Copyright 2026 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+document.title = 'Injected';
diff --git a/chrome/test/data/extensions/api_test/user_scripts/navigation_race/background.js b/chrome/test/data/extensions/api_test/user_scripts/navigation_race/background.js
new file mode 100644
index 0000000..a4549227
--- /dev/null
+++ b/chrome/test/data/extensions/api_test/user_scripts/navigation_race/background.js
@@ -0,0 +1,33 @@
+// Copyright 2026 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+chrome.test.getConfig(async function(config) {
+  const url_a = await chrome.test.sendMessage('ready');
+  const tab = await chrome.tabs.create({url: url_a});
+  await chrome.test.sendMessage('tab_created');
+
+  // C++ replies when the C++ side has blocked the file task runner.
+  // We now call execute.
+  const promise = chrome.userScripts.execute({
+    target: {tabId: tab.id},
+    js: [{file: 'script.js'}],
+  });
+
+  // Let C++ know we called execute so it can navigate the tab.
+  await chrome.test.sendMessage('execute_called');
+
+  try {
+    await promise;
+    chrome.test.fail('Execution succeeded incorrectly');
+  } catch (e) {
+    // Because the extension doesn't have the 'tabs' permission, the
+    // browser-side check generates a generic error rather than leaking the
+    // cross-origin URL.
+    if (e.message.includes('Cannot access contents of the page')) {
+      chrome.test.succeed();
+    } else {
+      chrome.test.fail('Unexpected error: ' + e.message);
+    }
+  }
+});
diff --git a/chrome/test/data/extensions/api_test/user_scripts/navigation_race/manifest.json b/chrome/test/data/extensions/api_test/user_scripts/navigation_race/manifest.json
new file mode 100644
index 0000000..b3de9f7
--- /dev/null
+++ b/chrome/test/data/extensions/api_test/user_scripts/navigation_race/manifest.json
@@ -0,0 +1,14 @@
+{
+  "name": "UserScripts Navigation Race",
+  "version": "1.0",
+  "manifest_version": 3,
+  "background": {
+    "service_worker": "background.js"
+  },
+  "permissions": [
+    "userScripts"
+  ],
+  "host_permissions": [
+    "http://a.com/*"
+  ]
+}
\ No newline at end of file
diff --git a/chrome/test/data/extensions/api_test/user_scripts/navigation_race/script.js b/chrome/test/data/extensions/api_test/user_scripts/navigation_race/script.js
new file mode 100644
index 0000000..214229f
--- /dev/null
+++ b/chrome/test/data/extensions/api_test/user_scripts/navigation_race/script.js
@@ -0,0 +1,5 @@
+// Copyright 2026 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be

diff --git a/chrome/browser/extensions/api/user_scripts/user_scripts_apitest.cc b/chrome/browser/extensions/api/user_scripts/user_scripts_apitest.cc
index 9e7c447..4c8f0ef 100644
--- a/chrome/browser/extensions/api/user_scripts/user_scripts_apitest.cc
+++ b/chrome/browser/extensions/api/user_scripts/user_scripts_apitest.cc
@@ -19,10 +19,12 @@
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/test_navigation_observer.h"
 #include "extensions/browser/background_script_executor.h"
+#include "extensions/browser/extension_file_task_runner.h"
 #include "extensions/browser/extension_prefs.h"
 #include "extensions/browser/extension_registry.h"
 #include "extensions/browser/extension_util.h"
 #include "extensions/browser/renderer_startup_helper.h"
+#include "extensions/browser/script_injection_tracker.h"
 #include "extensions/browser/user_script_manager.h"
 #include "extensions/buildflags/buildflags.h"
 #include "extensions/common/extension_features.h"
@@ -199,6 +201,68 @@
       << message_;
 }
 
+// Tests that executing user scripts correctly handles a cross-document
+// navigation occurring during the asynchronous file loading phase, preventing
+// unauthorized script execution or improper marking of the new process.
+IN_PROC_BROWSER_TEST_F(UserScriptsAPITest,
+                       ExecuteUserScripts_CrossDocumentNavigationRace) {
+  ExtensionTestMessageListener ready_listener("ready",
+                                              ReplyBehavior::kWillReply);
+  ExtensionTestMessageListener tab_created_listener("tab_created",
+                                                    ReplyBehavior::kWillReply);
+  ExtensionTestMessageListener execute_called_listener(
+      "execute_called", ReplyBehavior::kWillReply);
+
+  ResultCatcher catcher;
+
+  const Extension* extension =
+      LoadExtension(test_data_dir_.AppendASCII("user_scripts/navigation_race"));
+  ASSERT_TRUE(extension);
+
+  user_scripts_test_util::SetUserScriptsAPIAllowed(profile(), extension->id(),
+                                                   /*allowed=*/true);
+
+  ASSERT_TRUE(ready_listener.WaitUntilSatisfied());
+  ready_listener.Reply(
+      embedded_test_server()->GetURL("a.com", "/empty.html").spec());
+
+  ASSERT_TRUE(tab_created_listener.WaitUntilSatisfied());
+
+  // Block the file task runner.
+  base::WaitableEvent block_file_task_runner;
+  GetExtensionFileTaskRunner()->PostTask(
+      FROM_HERE, base::BindLambdaForTesting([&]() {
+        base::ScopedAllowBaseSyncPrimitivesForTesting allow_blocking;
+        block_file_task_runner.Wait();
+      }));
+
+  tab_created_listener.Reply("");
+
+  ASSERT_TRUE(execute_called_listener.WaitUntilSatisfied());
+
+  // Now userScripts.execute() has been called. The file task is queued.
+  // Navigate the tab to c.com, which the extension does not have permission
+  // for.
+  content::WebContents* web_contents = GetActiveWebContents();
+  ASSERT_TRUE(NavigateToURL(
+      web_contents, embedded_test_server()->GetURL("c.com", "/empty.html")));
+
+  // Unblock file task runner
+  block_file_task_runner.Signal();
+
+  execute_called_listener.Reply("");
+
+  // Wait for the result from the extension. The execute should result in an
+  // expected error due to the script being blocked after the navigation.
+  EXPECT_TRUE(catcher.GetNextResult()) << catcher.message();
+
+  // Verify that the new document's process was not marked as having run user
+  // scripts.
+  content::RenderFrameHost* main_frame = web_contents->GetPrimaryMainFrame();
+  EXPECT_FALSE(ScriptInjectionTracker::DidProcessRunUserScriptFromExtension(
+      *main_frame->GetProcess(), extension->id()));
+}
+
 // TODO(crbug.com/335421977): Flaky on "Linux ChromiumOS MSan Tests".
 #if BUILDFLAG(IS_CHROMEOS) && defined(MEMORY_SANITIZER)
 #define MAYBE_ConfigureWorld DISABLED_ConfigureWorld
diff --git a/chrome/test/data/extensions/api_test/user_scripts/execute/script.js b/chrome/test/data/extensions/api_test/user_scripts/execute/script.js
new file mode 100644
index 0000000..214229f
--- /dev/null
+++ b/chrome/test/data/extensions/api_test/user_scripts/execute/script.js
@@ -0,0 +1,5 @@
+// Copyright 2026 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+document.title = 'Injected';
diff --git a/chrome/test/data/extensions/api_test/user_scripts/navigation_race/background.js b/chrome/test/data/extensions/api_test/user_scripts/navigation_race/background.js
new file mode 100644
index 0000000..a4549227
--- /dev/null
+++ b/chrome/test/data/extensions/api_test/user_scripts/navigation_race/background.js
@@ -0,0 +1,33 @@
+// Copyright 2026 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+chrome.test.getConfig(async function(config) {
+  const url_a = await chrome.test.sendMessage('ready');
+  const tab = await chrome.tabs.create({url: url_a});
+  await chrome.test.sendMessage('tab_created');
+
+  // C++ replies when the C++ side has blocked the file task runner.
+  // We now call execute.
+  const promise = chrome.userScripts.execute({
+    target: {tabId: tab.id},
+    js: [{file: 'script.js'}],
+  });
+
+  // Let C++ know we called execute so it can navigate the tab.
+  await chrome.test.sendMessage('execute_called');
+
+  try {
+    await promise;
+    chrome.test.fail('Execution succeeded incorrectly');
+  } catch (e) {
+    // Because the extension doesn't have the 'tabs' permission, the
+    // browser-side check generates a generic error rather than leaking the
+    // cross-origin URL.
+    if (e.message.includes('Cannot access contents of the page')) {
+      chrome.test.succeed();
+    } else {
+      chrome.test.fail('Unexpected error: ' + e.message);
+    }
+  }
+});
diff --git a/chrome/test/data/extensions/api_test/user_scripts/navigation_race/manifest.json b/chrome/test/data/extensions/api_test/user_scripts/navigation_race/manifest.json
new file mode 100644
index 0000000..b3de9f7
--- /dev/null
+++ b/chrome/test/data/extensions/api_test/user_scripts/navigation_race/manifest.json
@@ -0,0 +1,14 @@
+{
+  "name": "UserScripts Navigation Race",
+  "version": "1.0",
+  "manifest_version": 3,
+  "background": {
+    "service_worker": "background.js"
+  },
+  "permissions": [
+    "userScripts"
+  ],
+  "host_permissions": [
+    "http://a.com/*"
+  ]
+}
\ No newline at end of file
diff --git a/chrome/test/data/extensions/api_test/user_scripts/navigation_race/script.js b/chrome/test/data/extensions/api_test/user_scripts/navigation_race/script.js
new file mode 100644
index 0000000..214229f
--- /dev/null
+++ b/chrome/test/data/extensions/api_test/user_scripts/navigation_race/script.js
@@ -0,0 +1,5 @@
+// Copyright 2026 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+document.title = 'Injected';