Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: A vulnerability in Chrome for Android’s Custom Tabs allows an external application to inject arbitrary View IDs into the browser’s Activity hierarchy. This enables an attacker to hijack internal view lookups, leading to browser process crashes or UI spoofing of trusted elements.

Affected files:

• chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomButtonParamsImpl.java
• chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabBottomBarDelegate.java
• chrome/android/java/res_app/layout/main.xml

Estimated timestamp from git blame: 2020-12-11

Description

A potential vulnerability exists in Chrome for Android’s Custom Tabs (CCT) where an attacker-controlled application can hijack internal View IDs. By supplying a crafted CustomTabsIntent with specific EXTRA_TOOLBAR_ITEMS, an attacker can inject an ImageButton into the Chrome Activity hierarchy with an arbitrary ID that collides with Chrome’s internal resource IDs (e.g., R.id.toolbar, R.id.url_bar, R.id.menu_button_wrapper).

This occurs because CustomButtonParamsImpl.fromBundle() reads the KEY_ID from the intent’s bundle without any range or namespace validation. This ID is subsequently applied to a View via button.setId(mId) in CustomButtonParamsImpl.buildBottomBarButton(). Unlike the parallel RemoteViews path in CustomTabBottomBarDelegate.java, which uses transformViewIds() to strip IDs and prevent collisions, the legacy bottom bar button path performs no sanitization.

Potential Impact

1. Denial of Service (Browser Crash): Internal Chrome components frequently use findViewById(R.id.target) and cast the result to a specific class. For example, BaseCustomTabRootUiCoordinator.java (line 438) calls mActivity.findViewById(R.id.toolbar) and casts it to CustomTabToolbar. Because the bottombar_stub is located at a lower index in the coordinator layout (index 7) than the control_container_stub (index 13) in main.xml, the depth-first search returns the attacker’s ImageButton. This causes a ClassCastException and an immediate browser process crash.
2. UI Spoofing: Trusted Chrome UI elements, such as In-Product Help (IPH) bubbles, can be anchored to attacker-controlled buttons. For example, CustomTabHistoryIphController.java (line 94) anchors a history IPH bubble to R.id.menu_button_wrapper. Hijacking this ID allows an attacker to misdirect the user’s trust to an action defined by the attacker’s PendingIntent.

Suggested Reproduction Steps (Potential)

1. Identify a target resource ID in Chrome (e.g., R.id.toolbar for a crash or R.id.menu_button_wrapper for spoofing).
2. Construct a CustomTabsIntent and add a button to EXTRA_TOOLBAR_ITEMS where the KEY_ID in the bundle matches the target resource ID.
3. Launch the Custom Tab from a separate app.
4. Observe the browser process crash or the misanchored UI element.

Suggested Fix

The legacy button path in CustomTabBottomBarDelegate.java should be updated to sanitize view IDs. Specifically, in CustomTabBottomBarDelegate.showBottomBarIfNecessary(), any ImageButton generated via params.buildBottomBarButton() should have its ID reset to View.NO_ID or a safe, non-colliding value after being added to the layout, similar to how transformViewIds() handles the RemoteViews path.

Evaluated with Chrome root at commit: b3153093eb3c78c3e88ccf562bcbc20437a04b0e

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

• If you are familiar with the severity guidelines, you may adjust the severity.
• If this is a false positive, and there’s no work to be done, please close as WAI.
• If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.