Chrome · Forms
CVE-2026-15125
Logic Error in Forms
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifthird_party/blink/renderer/core/html/forms/html_field_set_element.cc |
modified |
Files Changed
third_party/blink/renderer/core/html/custom/custom_element_definition.ccthird_party/blink/renderer/core/html/forms/file_input_type.ccthird_party/blink/renderer/core/html/forms/file_input_type.hthird_party/blink/renderer/core/html/forms/html_field_set_element.ccthird_party/blink/renderer/core/html/forms/html_field_set_element.hthird_party/blink/renderer/core/html/forms/html_form_control_element.cc
Patch
From 126b63885ce76abb52318ff90cb0534339820326 Mon Sep 17 00:00:00 2001 From: Joey Arhar <[email protected]> Date: Thu, 25 Jun 2026 08:05:47 -0700 Subject: [PATCH] Don't fire change event during mutations affecting disabledness Running script inside mutations (InsertedInto, RemovedFrom, MovedFrom) is not allowed. Fixed: 523756329, 523748081, 523737685 Change-Id: Ib0842d5c8fcf837d96f270a8d50d4189ef151d06 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7948021 Reviewed-by: Joey Arhar <[email protected]> Reviewed-by: David Baron <[email protected]> Commit-Queue: Joey Arhar <[email protected]> Cr-Commit-Position: refs/heads/main@{#1652428} --- diff --git a/third_party/blink/renderer/core/html/custom/custom_element_definition.cc b/third_party/blink/renderer/core/html/custom/custom_element_definition.cc index 68afcd48..d0d4b43c 100644 --- a/third_party/blink/renderer/core/html/custom/custom_element_definition.cc +++ b/third_party/blink/renderer/core/html/custom/custom_element_definition.cc @@ -248,8 +248,10 @@ if (ListedElement* listed_element = ListedElement::From(element)) { if (element.FastHasAttribute(html_names::kReadonlyAttr)) listed_element->ReadonlyAttributeChanged(); - if (element.FastHasAttribute(html_names::kDisabledAttr)) - listed_element->DisabledAttributeChanged(); + if (element.FastHasAttribute(html_names::kDisabledAttr)) { + listed_element->DisabledAttributeChanged( + DisabledChangedReason::kAttributeChanged); + } } if (IsFormAssociated()) diff --git a/third_party/blink/renderer/core/html/forms/file_input_type.cc b/third_party/blink/renderer/core/html/forms/file_input_type.cc index 8382530..2240228 100644 --- a/third_party/blink/renderer/core/html/forms/file_input_type.cc +++ b/third_party/blink/renderer/core/html/forms/file_input_type.cc @@ -418,7 +418,7 @@ return GetElement().EnsureShadowSubtree()->lastChild(); } -void FileInputType::DisabledAttributeChanged() { +void FileInputType::DisabledAttributeChanged(DisabledChangedReason reason) { if (Element* button = UploadButton()) { button->SetBooleanAttribute(html_names::kDisabledAttr, GetElement().IsDisabledFormControl()); diff --git a/third_party/blink/renderer/core/html/forms/file_input_type.h b/third_party/blink/renderer/core/html/forms/file_input_type.h index d0be314..152b29c 100644 --- a/third_party/blink/renderer/core/html/forms/file_input_type.h +++ b/third_party/blink/renderer/core/html/forms/file_input_type.h @@ -88,7 +88,7 @@ String DroppedFileSystemId() override; void CreateShadowSubtree() override; HTMLInputElement* UploadButton() const override; - void DisabledAttributeChanged() override; + void DisabledAttributeChanged(DisabledChangedReason) override; void MultipleAttributeChanged() override; String DefaultToolTip(const InputTypeView&) const override; void CopyNonAttributeProperties(const HTMLInputElement&) override; diff --git a/third_party/blink/renderer/core/html/forms/html_field_set_element.cc b/third_party/blink/renderer/core/html/forms/html_field_set_element.cc index bca3141..5e947482 100644 --- a/third_party/blink/renderer/core/html/forms/html_field_set_element.cc +++ b/third_party/blink/renderer/core/html/forms/html_field_set_element.cc @@ -24,6 +24,7 @@ #include "third_party/blink/renderer/core/html/forms/html_field_set_element.h" +#include "base/auto_reset.h" #include "third_party/blink/renderer/core/dom/element_traversal.h" #include "third_party/blink/renderer/core/dom/events/event_dispatch_forbidden_scope.h" #include "third_party/blink/renderer/core/dom/layout_tree_builder_traversal.h" @@ -35,6 +36,7 @@ #include "third_party/blink/renderer/core/html_names.h" #include "third_party/blink/renderer/core/layout/forms/layout_fieldset.h" #include "third_party/blink/renderer/core/layout/layout_block.h" +#include "third_party/blink/renderer/platform/runtime_enabled_features.h" #include "third_party/blink/renderer/platform/wtf/std_lib_extras.h" namespace blink { @@ -124,18 +126,21 @@ // Returns a disabled focused element if it's in descendants of |base|. Element* HTMLFieldSetElement::InvalidateDescendantDisabledStateAndFindFocusedOne( - Element& base) { + Element& base, + DisabledChangedReason reason) { Element* focused_element = AdjustedFocusedElementInTreeScope(); bool should_blur = false; { EventDispatchForbiddenScope event_forbidden; for (HTMLElement& element : Traversal<HTMLElement>::DescendantsOf(base)) { - if (auto* control = DynamicTo<HTMLFormControlElement>(element)) - control->AncestorDisabledStateWasChanged(); - else if (element.IsFormAssociatedCustomElement()) - element.EnsureElementInternals().AncestorDisabledStateWasChanged(); - else + if (auto* control = DynamicTo<HTMLFormControlElement>(element)) { + control->AncestorDisabledStateWasChanged(reason); + } else if (element.IsFormAssociatedCustomElement()) { + element.EnsureElementInternals().AncestorDisabledStateWasChanged( + reason); + } else { continue; + } if (focused_element == &element && element.IsDisabledFormControl()) should_blur = true; } @@ -143,11 +148,12 @@ return should_blur ? focused_element : nullptr; } -void HTMLFieldSetElement::DisabledAttributeChanged() { +void HTMLFieldSetElement::DisabledAttributeChanged( + DisabledChangedReason reason) { bool was_disabled = IsSelfDisabledIgnoringAncestors(); // This element must be updated before the style of nodes in its subtree gets // recalculated. - HTMLFormControlElement::DisabledAttributeChanged(); + HTMLFormControlElement::DisabledAttributeChanged(reason); if (was_disabled != IsSelfDisabledIgnoringAncestors()) { Document& document = GetDocument(); if (was_disabled) { @@ -157,16 +163,18 @@ } } if (Element* focused_element = - InvalidateDescendantDisabledStateAndFindFocusedOne(*this)) + InvalidateDescendantDisabledStateAndFindFocusedOne(*this, reason)) { focused_element->blur(); + } } -void HTMLFieldSetElement::AncestorDisabledStateWasChanged() { +void HTMLFieldSetElement::AncestorDisabledStateWasChanged( + DisabledChangedReason reason) { ancestor_disabled_state_ = AncestorDisabledState::kUnknown; // Do not re-enter HTMLFieldSetElement::DisabledAttributeChanged(), so that // we only invalidate this element's own disabled state and do not traverse // the descendants. - HTMLFormControlElement::DisabledAttributeChanged(); + HTMLFormControlElement::DisabledAttributeChanged(reason); } void HTMLFieldSetElement::DidMoveToNewDocument(Document& old_document) { @@ -184,9 +192,10 @@ EventDispatchForbiddenScope event_forbidden; for (HTMLLegendElement& legend : Traversal<HTMLLegendElement>::ChildrenOf(*this)) { - if (Element* element = - InvalidateDescendantDisabledStateAndFindFocusedOne(legend)) + if (Element* element = InvalidateDescendantDisabledStateAndFindFocusedOne( + legend, DisabledChangedReason::kFieldsetChildrenChanged)) { focused_element = element; + } } } if (!GetDocument().StatePreservingAtomicMoveInProgress() && focused_element) { diff --git a/third_party/blink/renderer/core/html/forms/html_field_set_element.h b/third_party/blink/renderer/core/html/forms/html_field_set_element.h index 69c6ded..1c132ab 100644 --- a/third_party/blink/renderer/core/html/forms/html_field_set_element.h +++ b/third_party/blink/renderer/core/html/forms/html_field_set_element.h @@ -49,8 +49,8 @@ void UpdateMenuItemCheckableExclusivity(HTMLMenuItemElement*); protected: - void DisabledAttributeChanged() override; - void AncestorDisabledStateWasChanged() override; + void DisabledAttributeChanged(DisabledChangedReason) override; + void AncestorDisabledStateWasChanged(DisabledChangedReason) override; void DidMoveToNewDocument(Document& old_document) override; private: @@ -70,7 +70,9 @@ bool MatchesEnabledPseudoClass() const final; bool MatchesDisabledPseudoClass() const final; - Element* InvalidateDescendantDisabledStateAndFindFocusedOne(Element& base); + Element* InvalidateDescendantDisabledStateAndFindFocusedOne( + Element& base, + DisabledChangedReason); }; } // namespace blink diff --git a/third_party/blink/renderer/core/html/forms/html_form_control_element.cc b/third_party/blink/renderer/core/html/forms/html_form_control_element.cc index a60b067..e6bedb46 100644 --- a/third_party/blink/renderer/core/html/forms/html_form_control_element.cc +++ b/third_party/blink/renderer/core/html/forms/html_form_control_element.cc @@ -149,7 +149,7 @@ HTMLElement::AttributeChanged(params); if (params.name == html_names::kDisabledAttr && params.old_value.IsNull() != params.new_value.IsNull()) { - DisabledAttributeChanged(); + DisabledAttributeChanged(DisabledChangedReason::kAttributeChanged); if (params.reason == AttributeModificationReason::kDirectly && IsDisabledFormControl() && AdjustedFocusedElementInTreeScope() == this) blur(); @@ -181,12 +181,13 @@ } }
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/third_party/blink/web_tests/external/wpt/dom/nodes/insertBefore-iframe-crash.html b/third_party/blink/web_tests/external/wpt/dom/nodes/insertBefore-iframe-crash.html new file mode 100644 index 0000000..0effea6 --- /dev/null +++ b/third_party/blink/web_tests/external/wpt/dom/nodes/insertBefore-iframe-crash.html @@ -0,0 +1,61 @@ +<!DOCTYPE html> +<html class="test-wait"> +<link rel=author href="mailto:[email protected]"> +<link rel=help href="https://issues.chromium.org/issues/523756329"> +<script src="/resources/testdriver.js"></script> +<script src="/resources/testdriver-actions.js"></script> +<script src="/resources/testdriver-vendor.js"></script> +<style> + #num { + width: 200px; + height: 60px; + font-size: 30px; + } +</style> + +<fieldset id=fs disabled> + <legend id=legend1> + <input id=num type=number value=5> + </legend> + <legend id=legend2>second</legend> +</fieldset> + +<div id=iframe-host> + <iframe id=iframe src="about:blank"></iframe> +</div> + +<script> +window.onload = async () => { + const fs = document.getElementById('fs'); + const legend1 = document.getElementById('legend1'); + const legend2 = document.getElementById('legend2'); + const num = document.getElementById('num'); + const iframe = document.getElementById('iframe'); + + await new Promise(requestAnimationFrame); + await new Promise(requestAnimationFrame); + + num.addEventListener('change', () => { + iframe.remove(); + }); + + // Target the spin button (step-up arrow) which is on the right edge, upper half. + // We calculate the offset from the center of the input element. + const rect = num.getBoundingClientRect(); + const offsetX = Math.round(rect.width / 2 - 7); + const offsetY = Math.round(-rect.height / 4); + + // Press and hold the spin button + await new test_driver.Actions() + .pointerMove(offsetX, offsetY, {origin: num}) + .pointerDown() + .send(); + + // Wait a frame to ensure the pointer down is processed and value is stepped + await new Promise(requestAnimationFrame); + + fs.insertBefore(legend2, legend1); + document.body.appendChild(iframe); + document.documentElement.classList.remove('test-wait'); +} +</script> diff --git a/third_party/blink/web_tests/external/wpt/dom/nodes/moveBefore/moveBefore-iframe-crash.html b/third_party/blink/web_tests/external/wpt/dom/nodes/moveBefore/moveBefore-iframe-crash.html new file mode 100644 index 0000000..acc8fca --- /dev/null +++ b/third_party/blink/web_tests/external/wpt/dom/nodes/moveBefore/moveBefore-iframe-crash.html @@ -0,0 +1,61 @@ +<!DOCTYPE html> +<html class="test-wait"> +<link rel=author href="mailto:[email protected]"> +<link rel=help href="https://issues.chromium.org/issues/523756329"> +<script src="/resources/testdriver.js"></script> +<script src="/resources/testdriver-actions.js"></script> +<script src="/resources/testdriver-vendor.js"></script> +<style> + #num { + width: 200px; + height: 60px; + font-size: 30px; + } +</style> + +<fieldset id=fs disabled> + <legend id=legend1> + <input id=num type=number value=5> + </legend> + <legend id=legend2>second</legend> +</fieldset> + +<div id=iframe-host> + <iframe id=iframe src="about:blank"></iframe> +</div> + +<script> +window.onload = async () => { + const fs = document.getElementById('fs'); + const legend1 = document.getElementById('legend1'); + const legend2 = document.getElementById('legend2'); + const num = document.getElementById('num'); + const iframe = document.getElementById('iframe'); + + await new Promise(requestAnimationFrame); + await new Promise(requestAnimationFrame); + + num.addEventListener('change', () => { + iframe.remove(); + }); + + // Target the spin button (step-up arrow) which is on the right edge, upper half. + // We calculate the offset from the center of the input element. + const rect = num.getBoundingClientRect(); + const offsetX = Math.round(rect.width / 2 - 7); + const offsetY = Math.round(-rect.height / 4); + + // Press and hold the spin button + await new test_driver.Actions() + .pointerMove(offsetX, offsetY, {origin: num}) + .pointerDown() + .send(); + + // Wait a frame to ensure the pointer down is processed and value is stepped + await new Promise(requestAnimationFrame); + + fs.moveBefore(legend2, legend1); + document.body.appendChild(iframe); + document.documentElement.classList.remove('test-wait'); +} +</script> diff --git a/third_party/blink/web_tests/external/wpt/dom/nodes/moveBefore/moveBefore-legend-input-crash.html b/third_party/blink/web_tests/external/wpt/dom/nodes/moveBefore/moveBefore-legend-input-crash.html new file mode 100644 index 0000000..06b55c2 --- /dev/null +++ b/third_party/blink/web_tests/external/wpt/dom/nodes/moveBefore/moveBefore-legend-input-crash.html @@ -0,0 +1,58 @@ +<!DOCTYPE html> +<html class="test-wait"> +<link rel=author href="mailto:[email protected]"> +<link rel=help href="https://issues.chromium.org/issues/523756329"> +<script src="/resources/testdriver.js"></script> +<script src="/resources/testdriver-actions.js"></script> +<script src="/resources/testdriver-vendor.js"></script> +<style> + #num { + width: 200px; + height: 60px; + font-size: 30px; + } +</style> + +<fieldset id=fieldset disabled> + <legend id=legend> + <input id=num type=number value=5> + </legend> + <span id=pad></span> +</fieldset> + +<div id=iframe-host> + <iframe id=iframe srcdoc="<h1>iframe</h1>"></iframe> +</div> + +<script> +window.onload = async () => { + const fieldset = document.getElementById('fieldset'); + const legend = document.getElementById('legend'); + const num = document.getElementById('num'); + const iframe = document.getElementById('iframe'); + + await new Promise(requestAnimationFrame); + await new Promise(requestAnimationFrame); + + num.addEventListener('change', () => { + iframe.remove(); + }); + + // Target the spin button (step-up arrow) which is on the right edge, upper half. + const rect = num.getBoundingClientRect(); + const offsetX = Math.round(rect.width / 2 - 7); + const offsetY = Math.round(-rect.height / 4); + + // Press and hold the spin button to get capture + await new test_driver.Actions() + .pointerMove(offsetX, offsetY, {origin: num}) + .pointerDown() + .send(); + await new Promise(requestAnimationFrame); + + fieldset.moveBefore(legend, null); + document.body.appendChild(iframe); + await new Promise(requestAnimationFrame); + document.documentElement.classList.remove('test-wait'); +} +</script> diff --git a/third_party/blink/web_tests/external/wpt/dom/nodes/moveBefore/moveBefore-range-iframe-crash.html b/third_party/blink/web_tests/external/wpt/dom/nodes/moveBefore/moveBefore-range-iframe-crash.html new file mode 100644 index 0000000..abde4a8 --- /dev/null +++ b/third_party/blink/web_tests/external/wpt/dom/nodes/moveBefore/moveBefore-range-iframe-crash.html @@ -0,0 +1,54 @@ +<!DOCTYPE html> +<html class="test-wait"> +<link rel=author href="mailto:[email protected]"> +<link rel=help href="https://issues.chromium.org/issues/523748081"> +<script src="/resources/testdriver.js"></script> +<script src="/resources/testdriver-actions.js"></script> +<script src="/resources/testdriver-vendor.js"></script> +<style> + #slider { width: 400px; height: 30px; } +</style> + +<legend id=legend1>legend1</legend> + +<fieldset id=fs disabled> + <legend id=legend2> + <input type=range id=slider min=0 max=100 value=50> + </legend> +</fieldset> + +<iframe id=iframe srcdoc="<body>iframe</body>"></iframe> + +<script> +window.onload = async () => { + const slider = document.getElementById("slider"); + const fs = document.getElementById("fs"); + const legend1 = document.getElementById("legend1"); + const legend2 = document.getElementById("legend2"); + const iframe = document.getElementById("iframe"); + + await new Promise(requestAnimationFrame); + + slider.addEventListener("change", () => { + iframe.remove(); + }, { once: true }); + + slider.addEventListener("input", () => { + fs.moveBefore(legend1, legend2); + document.body.appendChild(iframe); + document.documentElement.classList.remove('test-wait'); + }, { once: true }); + + const rect = slider.getBoundingClientRect(); + const offsetX = Math.round(rect.width * 0.4); + const offsetY = 0; + + await new test_driver.Actions() + .pointerMove(offsetX, offsetY, {origin: slider}) + .pointerDown() + .pause(50) + .pointerMove(offsetX + 5, offsetY, {origin: slider}) + .pointerUp() + .send(); +}; +</script>
Loading diff…
Original Bug Report
reported by [email protected]
UXSS/UAF via synchronous JS execution during moveBefore() in MultipleFieldsTemporalInput
Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.
Overview: A vulnerability in MultipleFieldsTemporalInputTypeView allows author JavaScript to execute synchronously during an atomic DOM move (moveBefore()). This violates the StatePreservingAtomicMoveInProgress invariant, enabling an attacker to remove an iframe without disconnecting its underlying frame, leading to a potential Universal Cross-Site Scripting (UXSS) or Use-After-Free (UAF) primitive.
Affected files:
third_party/blink/renderer/core/html/forms/multiple_fields_temporal_input_type_view.cc
Estimated timestamp from git blame: Unknown (Google3 checkout)
Root Cause
The moveBefore() API performs state-preserving atomic DOM moves. To ensure DOM consistency, Blink enforces an invariant that author script must not execute while an atomic move is in progress. This is managed by the StatePreservingAtomicMoveInProgress flag.
However, this invariant can be bypassed due to event handling in MultipleFieldsTemporalInputTypeView::DisabledAttributeChanged():
void MultipleFieldsTemporalInputTypeView::DisabledAttributeChanged() {
EventQueueScope scope;
if (SpinButtonElement* spin_button = GetSpinButtonElement())
spin_button->ReleaseCapture();
if (DateTimeEditElement* edit = GetDateTimeEditElement())
edit->DisabledStateChanged();
} // <-- EventQueueScope destructs here
When moveBefore() is called, it does not wrap its execution in an outer EventQueueScope. If the move triggers a disabled state recalculation (e.g., moving a <legend> inside a <fieldset>), DisabledAttributeChanged() is reached. This method declares a local EventQueueScope and calls ReleaseCapture() on the input’s spin button.
If the spin button currently holds pointer capture, ReleaseCapture() queues a change event. Because there is no outer EventQueueScope active from moveBefore(), the destruction of the local EventQueueScope at the end of the method causes ScopedEventQueue::DispatchAllEvents() to fire, synchronously dispatching the change event to JavaScript.
Attack Scenario (Potential Steps)
An attacker could potentially trigger this vulnerability using the following steps:
- Create a document with a
disabled<fieldset>. Inside it, place a<legend>containing a temporal input (e.g.,<input type="date">). Due to the HTML first-legend exemption, the input remains enabled. - Embed a target
<iframe>elsewhere in the document. - Register a
changeevent listener on the<input>that executesiframe.remove(). - Induce the user to interact with the input’s spin button (up/down arrows). This modifies the value and causes the spin button to acquire pointer capture (
capturing_ = true). - Using a macro-task (e.g.,
setTimeout(..., 0)scheduled during amousedownhandler), trigger an atomic move:fieldset.moveBefore(legend, null). moveBefore()setsStatePreservingAtomicMoveInProgress()totrueand performs the insertion.ContainerNode::DidInsertNodeVector()triggersHTMLFieldSetElement::ChildrenChanged(), which recalculates descendant disabled states and eventually callsMultipleFieldsTemporalInputTypeView::DisabledAttributeChanged().- The local
EventQueueScopeis created,ReleaseCapture()queues achangeevent, and the local scope’s destruction flushes the queue synchronously. - The attacker’s
changeevent listener fires whileStatePreservingAtomicMoveInProgress()is stilltrue. - The script calls
iframe.remove(). InsideContainerNode::WillRemoveChild(), the iframe disconnection logic (ChildFrameDisconnector::Disconnect()) is explicitly skipped becauseStatePreservingAtomicMoveInProgress()istrue.
Impact
Removing an iframe without disconnecting its underlying frame is a well-known, powerful primitive. It leaves a live, active LocalFrame attached to a detached element, reliably leading to Universal Cross-Site Scripting (UXSS) and Use-After-Free (UAF) memory corruption vulnerabilities within the renderer process.
Suggested Fix
Prevent synchronous event dispatch during atomic moves. This could be achieved by checking StatePreservingAtomicMoveInProgress() before releasing the spin button capture, or by ensuring that ReleaseCapture() uses kEventDispatchDisallowed when an atomic move is in progress. Alternatively, moveBefore() operations could be wrapped in a broader EventQueueScope to defer all event dispatching until the atomic move is fully complete and the invariant flag is cleared.
Evaluated with Chrome root at commit: 65b3256311f3ab6fb9870eaa522de7e6dd2663bb
Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:
- If you are familiar with the severity guidelines, you may adjust the severity.
- If this is a false positive, and there’s no work to be done, please close as WAI.
- If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.
Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.
References
On This Page