Flapjack, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: A Use-After-Free (UAF) vulnerability in WidgetBase::UpdateSurfaceAndScreenInfo occurs due to synchronous JavaScript execution during visual property updates. An attacker can destroy the widget synchronously by intercepting an orientationchange event, leading to a dangling pointer read and subsequent virtual call hijack.

Affected files:

• third_party/blink/renderer/platform/widget/widget_base.cc
• third_party/blink/renderer/core/frame/web_frame_widget_impl.cc

Estimated timestamp from git blame: Unknown (Google3 checkout)

Description

A Use-After-Free (UAF) vulnerability exists in the renderer process within WidgetBase::UpdateSurfaceAndScreenInfo. When processing visual property updates that contain an orientation change, the method synchronously invokes client_->OrientationChanged(). This call dispatches a synchronous orientationchange JavaScript event.

If an attacker registers an event listener for this event, they can execute arbitrary DOM manipulation, such as detaching the iframe containing the widget. Detaching the frame immediately triggers the widget shutdown sequence (WebFrameWidgetImpl::Close), which deletes the WidgetBase instance. Upon return from the synchronous callback, the this pointer in UpdateSurfaceAndScreenInfo is dangling. The code subsequently accesses this->client_ to perform a virtual method call (DidUpdateSurfaceAndScreen), providing a reliable primitive for renderer remote code execution (RCE).

Potential Exploitation Steps

1. An attacker creates a malicious page containing an iframe.
2. Inside the iframe, the attacker registers an orientationchange event listener: window.addEventListener('orientationchange', () => { window.parent.document.getElementById('target').remove(); });.
3. The attacker triggers a visual property update that modifies the screen orientation (e.g., via resizing or programmatic orientation APIs).
4. The browser sends the updated properties to the renderer via IPC (WidgetBase::UpdateVisualProperties).
5. Execution reaches WidgetBase::UpdateSurfaceAndScreenInfo. The orientation change is detected, and client_->OrientationChanged() is called.
6. This triggers the synchronous JavaScript event dispatch. The attacker’s listener executes and detaches the iframe.
7. The detachment triggers WebFrameWidgetImpl::Close, which calls widget_base_.reset(), destroying the WidgetBase object.
8. The attacker uses heap manipulation techniques to reclaim the freed WidgetBase memory with attacker-controlled data.
9. Execution returns to UpdateSurfaceAndScreenInfo. The code attempts to call client_->DidUpdateSurfaceAndScreen(...).
10. Because the attacker controls the memory previously occupied by this, a controlled pointer is loaded for client_. Dereferencing this pointer for the virtual call results in arbitrary control flow hijacking.

Note: WidgetBase is manually managed via std::unique_ptr and is not protected by MiraclePtr (BackupRefPtr).

Suggested Fix

Similar to WidgetBase::BeginMainFrame, utilize a base::WeakPtr to ensure the object is still alive after the potentially destructive synchronous callback.

  if (orientation_changed) {
    auto weak_this = weak_ptr_factory_.GetWeakPtr();
    client_->OrientationChanged();
    if (!weak_this) {
      return;
    }
  }

  client_->DidUpdateSurfaceAndScreen(previous_original_screen_infos);

Evaluated with Chrome root at commit: 2155cb00003ec35716a76ed3246eae995f87b7ff

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

• If you are familiar with the severity guidelines, you may adjust the severity.
• If this is a false positive, and there’s no work to be done, please close as WAI.
• If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.