Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: DigitalIdentitySafetyInterstitialControllerDesktop::ShowInterstitialImpl takes a content::WebContents by reference and uses it again after calling ShowWebModal(). On macOS, exiting fullscreen synchronously during modal display can trigger a nested run loop that processes a tab close, leading to immediate destruction of the WebContents. Consequently, the subsequent call to Observe() dereferences a dangling WebContents& reference, triggering a Use-After-Free (UAF) in the browser process.

Affected files:

• chrome/browser/ui/views/digital_credentials/digital_identity_safety_interstitial_controller_desktop.cc
• chrome/browser/ui/views/digital_credentials/digital_identity_safety_interstitial_controller_desktop.h

Estimated timestamp from git blame: 2024-08-20

Detailed Writeup

Root Cause Analysis

A potential Use-After-Free (UAF) vulnerability exists in the desktop implementation of the digital credentials safety interstitial.

In DigitalIdentitySafetyInterstitialControllerDesktop::ShowInterstitialImpl (defined in chrome/browser/ui/views/digital_credentials/digital_identity_safety_interstitial_controller_desktop.cc), the content::WebContents object is taken by reference (content::WebContents& web_contents) and dereferenced again after ShowWebModal() returns, without any liveness verification:

void DigitalIdentitySafetyInterstitialControllerDesktop::ShowInterstitialImpl(
    content::WebContents& web_contents,
    bool was_request_aborted) {
  ...
  dialog_widget_ = constrained_window::ShowWebModal(
      dialog_model_builder.Build(), &web_contents); // <--- Can synchronously destroy web_contents
  extensions::SecurityDialogTracker::GetInstance()->AddSecurityDialog(
      dialog_widget_);

  close_on_navigation_observer_ = std::make_unique<CloseOnNavigationObserver>();
  close_on_navigation_observer_->Observe(web_contents); // <--- UAF: web_contents may be dangling
}

Inside CloseOnNavigationObserver::Observe(), it immediately calls web_contents.GetWeakPtr() which performs a virtual call on the deleted WebContents instance:

void DigitalIdentitySafetyInterstitialControllerDesktop::CloseOnNavigationObserver::Observe(
    content::WebContents& web_contents) {
  web_contents_ = web_contents.GetWeakPtr(); // <--- Virtual call via freed vtable
  ...
}

Synchronous Destruction Path

When ShowWebModal is called, it blocks the web contents interaction. If the tab is currently in HTML fullscreen mode (content::FullscreenMode::kContent), the browser forces it to exit fullscreen via web_contents->ExitFullscreen(true) to ensure that the interstitial dialog is shown with proper window decorations.

On macOS, exiting native fullscreen spins a synchronous AppKit nested message/event loop inside -[NSWindow toggleFullScreen:]. If a tab close or detach request is processed during this synchronous event spin, the WebContentsImpl is destroyed immediately. When control returns up the stack, constrained_window::ShowWebModalDialogViews passes its CHECK(weak_widget) because the views widget close is posted asynchronously, and ShowInterstitialImpl continues execution with a dangling web_contents reference.

Since this reference is held on the stack, it is not protected by MiraclePtr/BackupRefPtr.

Suggested/Potential Replay Steps

Note: These are potential steps. Our security review tools do not currently have the capability to execute proof-of-concept exploit code locally.

1. On macOS, a script-opened tab (closable via script) is navigated to an attacker-controlled origin.
2. The user initiates HTML fullscreen via a gesture (document.documentElement.requestFullscreen()).
3. The user initiates a high-risk digital credentials request via a gesture, triggering the safety interstitial dialog path.
4. While the macOS native fullscreen exit animation runs (which spins the nested run loop), a script-initiated close or detach event (window.close()) is processed.
5. The WebContents is synchronously destroyed, leaving the web_contents reference in ShowInterstitialImpl dangling.
6. The browser crashes or encounters a memory safety violation (UAF) upon executing Observe(web_contents).

Suggested Fix

To resolve this issue, verify the liveness of the WebContents before accessing it after the ShowWebModal call. The controller class already maintains a weak pointer to the WebContents (web_contents_), which is set inside ShowInterstitial:

  if (!web_contents_) {
    return;
  }
  close_on_navigation_observer_ = std::make_unique<CloseOnNavigationObserver>();
  close_on_navigation_observer_->Observe(*web_contents_);

Evaluated with Chrome root at commit: 9ebf4302210513a012c901d87a2668b3aadf8cc1

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

• If you are familiar with the severity guidelines, you may adjust the severity.
• If this is a false positive, and there’s no work to be done, please close as WAI.
• If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.