CVE-2026-13997
Overview
Files Changed
chrome/browser/ui/android/extensions/BUILD.gnchrome/browser/ui/android/extensions/java/src/org/chromium/chrome/browser/ui/extensions/ExtensionInstallDialogBridge.javachrome/browser/ui/android/extensions/javatests/src/org/chromium/chrome/browser/ui/extensions/ExtensionInstallDialogBridgeTest.java
Patch
From 732db38c3676de61c895346a68dd57eb1a53cf08 Mon Sep 17 00:00:00 2001 From: Eva Su <[email protected]> Date: Mon, 18 May 2026 16:27:16 -0700 Subject: [PATCH] [Desktop Android] Add tap security to ExtensionInstallDialogBridge Modal dialogs should have standard input protection mechanisms and crbug.com/514069689 found that the ExtensionInstallDialogBridge is missing the BUTTON_TAP_PROTECTION_PERIOD_MS and FILTER_TOUCH_FOR_SECURITY properties. This CL adds them which should protect the extension installation and permission prompts from clickjacking and obscured UI attacks. Fixed: 514069689 Change-Id: Iec6d1eaecb1ad36940019ecb6d05e61a3b2655f6 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7855935 Reviewed-by: Tim <[email protected]> Commit-Queue: Eva Su <[email protected]> Cr-Commit-Position: refs/heads/main@{#1632475} --- diff --git a/chrome/browser/ui/android/extensions/BUILD.gn b/chrome/browser/ui/android/extensions/BUILD.gn index ccb6be3..57de6e5 100644 --- a/chrome/browser/ui/android/extensions/BUILD.gn +++ b/chrome/browser/ui/android/extensions/BUILD.gn @@ -105,6 +105,7 @@ "//content/public/android:content_full_java", "//third_party/androidx:androidx_annotation_annotation_java", "//third_party/jni_zero:jni_zero_java", + "//ui/android:ui_utils_java", ] sources += [ "java/src/org/chromium/chrome/browser/ui/extensions/ExtensionAction.java", @@ -258,6 +259,7 @@ "//third_party/mockito:mockito_java", "//ui/android:ui_java_test_support", "//ui/android:ui_no_recycler_view_java", + "//ui/android:ui_utils_java", ] } } diff --git a/chrome/browser/ui/android/extensions/java/src/org/chromium/chrome/browser/ui/extensions/ExtensionInstallDialogBridge.java b/chrome/browser/ui/android/extensions/java/src/org/chromium/chrome/browser/ui/extensions/ExtensionInstallDialogBridge.java index fe356009..b9b70552 100644 --- a/chrome/browser/ui/android/extensions/java/src/org/chromium/chrome/browser/ui/extensions/ExtensionInstallDialogBridge.java +++ b/chrome/browser/ui/android/extensions/java/src/org/chromium/chrome/browser/ui/extensions/ExtensionInstallDialogBridge.java @@ -29,6 +29,7 @@ import org.chromium.build.annotations.NullMarked; import org.chromium.build.annotations.Nullable; +import org.chromium.ui.UiUtils; import org.chromium.ui.base.WindowAndroid; import org.chromium.ui.modaldialog.DialogDismissalCause; import org.chromium.ui.modaldialog.ModalDialogManager; @@ -59,7 +60,11 @@ this.mContext = context; this.mPropertyModelBuilder = new PropertyModel.Builder(ModalDialogProperties.ALL_KEYS) - .with(ModalDialogProperties.CONTROLLER, this); + .with(ModalDialogProperties.CONTROLLER, this) + .with(ModalDialogProperties.FILTER_TOUCH_FOR_SECURITY, true) + .with( + ModalDialogProperties.BUTTON_TAP_PROTECTION_PERIOD_MS, + UiUtils.PROMPT_INPUT_PROTECTION_SHORT_DELAY_MS); } /** diff --git a/chrome/browser/ui/android/extensions/javatests/src/org/chromium/chrome/browser/ui/extensions/ExtensionInstallDialogBridgeTest.java b/chrome/browser/ui/android/extensions/javatests/src/org/chromium/chrome/browser/ui/extensions/ExtensionInstallDialogBridgeTest.java index b73bdf6..f6f109df 100644 --- a/chrome/browser/ui/android/extensions/javatests/src/org/chromium/chrome/browser/ui/extensions/ExtensionInstallDialogBridgeTest.java +++ b/chrome/browser/ui/android/extensions/javatests/src/org/chromium/chrome/browser/ui/extensions/ExtensionInstallDialogBridgeTest.java @@ -351,6 +351,23 @@ verify(mNativeMock, times(0)).onDialogCanceled(anyLong()); } + /** Tests that tapjacking protections are correctly applied to the dialog model. */ + @Test + @SmallTest + public void testTapjackingProtections() { + buildAndShowDialog(); + PropertyModel dialogModel = mModalDialogManager.getShownDialogModel(); + + Assert.assertNotNull("Dialog model should not be null", dialogModel); + Assert.assertTrue( + "FILTER_TOUCH_FOR_SECURITY should be true", + dialogModel.get(ModalDialogProperties.FILTER_TOUCH_FOR_SECURITY)); + Assert.assertEquals( + "BUTTON_TAP_PROTECTION_PERIOD_MS should match", + org.chromium.ui.UiUtils.PROMPT_INPUT_PROTECTION_SHORT_DELAY_MS, + dialogModel.get(ModalDialogProperties.BUTTON_TAP_PROTECTION_PERIOD_MS)); + } + /** * Tests that clicking on the dialog's cancel button triggers the onDialogAccepted() and * destroy() callbacks.
Original Bug Report
Potential tapjacking and missing touch filtering in ExtensionInstallDialogBridge on Desktop Android
Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.
Overview: The ExtensionInstallDialogBridge on Desktop Android lacks standard security protections against tapjacking and obscured touches. By omitting button tap delays and touch filtering, the extension permission prompt could be exploited to trick users into granting unintended permissions.
Affected files:
chrome/browser/ui/android/extensions/java/src/org/chromium/chrome/browser/ui/extensions/ExtensionInstallDialogBridge.javachrome/browser/ui/android/extensions/extension_install_dialog_view_android.cc
Estimated timestamp from git blame: 2025-09-24
Summary
The ExtensionInstallDialogBridge on Desktop Android fails to implement standard input protection mechanisms for its modal dialogs. Specifically, it omits ModalDialogProperties.BUTTON_TAP_PROTECTION_PERIOD_MS and ModalDialogProperties.FILTER_TOUCH_FOR_SECURITY when constructing the PropertyModel. This leaves the extension installation and permission prompts vulnerable to tapjacking (clickjacking) and obscured UI attacks.
Root Cause Analysis
In chrome/browser/ui/android/extensions/java/src/org/chromium/chrome/browser/ui/extensions/ExtensionInstallDialogBridge.java, the PropertyModel for the dialog is initialized in the constructor (line 60):
this.mPropertyModelBuilder =
new PropertyModel.Builder(ModalDialogProperties.ALL_KEYS)
.with(ModalDialogProperties.CONTROLLER, this);
No further security properties are added during the dialog’s construction. According to the Chromium Android modal dialog framework (ModalDialogView.java):
mButtonTapProtectionDurationMsdefaults to0, meaning buttons are active the instant they are rendered.mFilterTouchForSecuritydefaults tofalse, meaning the dialog does not filter or block touches if the window is partially obscured by another application.
In contrast, other security-sensitive dialogs in Chrome for Android (e.g., PermissionDialogModelFactory.java or DangerousDownloadDialog.java) explicitly set these properties, typically using a 600ms delay (UiUtils.PROMPT_INPUT_PROTECTION_SHORT_DELAY_MS) and enabling touch filtering.
Potential Attack Scenario
An attacker could potentially exploit this behavior through the following steps:
- A user is lured to a malicious website or uses a malicious extension that triggers a permission request (e.g.,
chrome.permissions.request()). - The attacker uses a ‘double-tap’ lure, such as a simple game requiring rapid tapping at a specific screen location.
- At a precisely timed moment, the attacker triggers the extension permission prompt.
- Because there is no 600ms input protection delay, the user’s next tap (already in flight) lands on the ‘Allow’ button the moment it appears, granting the permission before the user can react to the UI change.
- Alternatively, a malicious application could use an overlay to obscure the dialog; since touch filtering is disabled, touches intended for the overlay would be delivered to the underlying permission buttons.
Suggested Fix
The ExtensionInstallDialogBridge should opt-in to standard modal dialog security protections. Update the constructor in ExtensionInstallDialogBridge.java to include these keys:
this.mPropertyModelBuilder =
new PropertyModel.Builder(ModalDialogProperties.ALL_KEYS)
.with(ModalDialogProperties.CONTROLLER, this)
.with(ModalDialogProperties.FILTER_TOUCH_FOR_SECURITY, true)
.with(ModalDialogProperties.BUTTON_TAP_PROTECTION_PERIOD_MS,
UiUtils.PROMPT_INPUT_PROTECTION_SHORT_DELAY_MS);
Note: These steps and impacts are based on code analysis; a functional proof-of-concept has not yet been executed.
Evaluated with Chrome root at commit: 1a8d40fc44df2088d5945c0bf53584038aa1614a
Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:
- If you are familiar with the severity guidelines, you may adjust the severity.
- If this is a false positive, and there’s no work to be done, please close as WAI.
- If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.
Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.