From e05978f4fa65bdf419397b6b37fa05d2f2b4b3a9 Mon Sep 17 00:00:00 2001
From: Dale Curtis <[email protected]>
Date: Tue, 02 Jun 2026 18:38:04 -0700
Subject: [PATCH] Ensure session_id is validated for media authorizations

Previously, `MediaStreamDevice.session_id` was treated as a global bearer
token. This CL introduces validation of session IDs before authorizing:
- Added `ValidateAudioSession` and `ValidateVideoSession` to `MediaStreamManager`
  to verify that the supplied session ID belongs to the requesting
  `RenderFrameHost` / origin.
- Added validation checks to `VideoCaptureHost::Start`,
  `RenderFrameAudioInputStreamFactory::Core::CreateStream`, and
  `AudioOutputAuthorizationHandler::RequestDeviceAuthorization`.
- Merged and optimized the internal session lookup in `MediaStreamManager` to
  strictly enforce type-safety (audio vs. video) during validation.
- Invalid validation attempts now trigger `mojo::ReportBadMessage` and
  terminate the compromised renderer.

Fixed: 514242889
Change-Id: I295ddcc3a05ff8ccf656eee646dab33a60626444
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7861584
Reviewed-by: Guido Urdaneta <[email protected]>
Commit-Queue: Dale Curtis <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1640629}
---

diff --git a/content/browser/renderer_host/media/audio_output_authorization_handler.cc b/content/browser/renderer_host/media/audio_output_authorization_handler.cc
index 7b675488..794d4c7 100644
--- a/content/browser/renderer_host/media/audio_output_authorization_handler.cc
+++ b/content/browser/renderer_host/media/audio_output_authorization_handler.cc
@@ -179,6 +179,16 @@
   // output device is found, reuse the input device permissions.
   if (media::AudioDeviceDescription::UseSessionIdToSelectDevice(session_id,
                                                                 device_id)) {
+    if (!media_stream_manager_->ValidateAudioSession(
+            session_id,
+            GlobalRenderFrameHostId(render_process_id_, render_frame_id))) {
+      trace_scope->SimpleEvent("Unauthorized session");
+      std::move(cb).Run(media::OUTPUT_DEVICE_STATUS_ERROR_NOT_AUTHORIZED,
+                        media::AudioParameters::UnavailableDeviceParams(),
+                        std::string(), std::string());
+      return;
+    }
+
     const blink::MediaStreamDevice* device =
         media_stream_manager_->audio_input_device_manager()
             ->GetOpenedDeviceById(session_id);
diff --git a/content/browser/renderer_host/media/media_stream_manager.cc b/content/browser/renderer_host/media/media_stream_manager.cc
index 2babe01b..941761e 100644
--- a/content/browser/renderer_host/media/media_stream_manager.cc
+++ b/content/browser/renderer_host/media/media_stream_manager.cc
@@ -2339,11 +2339,15 @@
   return (it != requests_.end()) ? it->second.get() : nullptr;
 }
 
-MediaStreamManager::DeviceRequest*
-MediaStreamManager::FindRequestByVideoSessionId(
-    const base::UnguessableToken& session_id) const {
+MediaStreamManager::DeviceRequest* MediaStreamManager::FindRequestBySessionId(
+    const base::UnguessableToken& session_id,
+    SessionType* out_type) const {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
+  if (session_id.is_empty()) {
+    return nullptr;
+  }
+
   for (const LabeledDeviceRequest& labeled_request : requests_) {
     DeviceRequest* const request = labeled_request.second.get();
     if (!request) {
@@ -2351,10 +2355,18 @@
     }
     for (const blink::mojom::StreamDevicesPtr& stream_devices_ptr :
          request->stream_devices_set.stream_devices) {
-      const std::optional<blink::MediaStreamDevice>& video_device =
-          stream_devices_ptr->video_device;
-      if (video_device && video_device->serializable_session_id().has_value() &&
-          video_device->serializable_session_id().value() == session_id) {
+      if (stream_devices_ptr->audio_device.has_value() &&
+          stream_devices_ptr->audio_device->session_id() == session_id) {
+        if (out_type) {
+          *out_type = SessionType::kAudio;
+        }
+        return request;
+      }
+      if (stream_devices_ptr->video_device.has_value() &&
+          stream_devices_ptr->video_device->session_id() == session_id) {
+        if (out_type) {
+          *out_type = SessionType::kVideo;
+        }
         return request;
       }
     }
@@ -2363,14 +2375,43 @@
   return nullptr;
 }
 
+bool MediaStreamManager::ValidateSession(
+    const base::UnguessableToken& session_id,
+    const GlobalRenderFrameHostId& render_frame_host_id,
+    SessionType expected_type) const {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  SessionType actual_type;
+  DeviceRequest* const request =
+      FindRequestBySessionId(session_id, &actual_type);
+  if (!request) {
+    return true;  // Safe: session not active.
+  }
+  return request->requesting_render_frame_host_id == render_frame_host_id &&
+         actual_type == expected_type;
+}
+
+bool MediaStreamManager::ValidateAudioSession(
+    const base::UnguessableToken& session_id,
+    const GlobalRenderFrameHostId& render_frame_host_id) const {
+  return ValidateSession(session_id, render_frame_host_id, SessionType::kAudio);
+}
+
+bool MediaStreamManager::ValidateVideoSession(
+    const base::UnguessableToken& session_id,
+    const GlobalRenderFrameHostId& render_frame_host_id) const {
+  return ValidateSession(session_id, render_frame_host_id, SessionType::kVideo);
+}
+
 #if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_IOS)
 
 CapturedSurfaceController* MediaStreamManager::GetCapturedSurfaceController(
     GlobalRenderFrameHostId capturer_rfh_id,
     const base::UnguessableToken& session_id,
     blink::mojom::CapturedSurfaceControlResult& result) {
-  DeviceRequest* const request = FindRequestByVideoSessionId(session_id);
-  if (!request) {
+  SessionType actual_type;
+  DeviceRequest* const request =
+      FindRequestBySessionId(session_id, &actual_type);
+  if (!request || actual_type != SessionType::kVideo) {
     result = CapturedSurfaceControlResult::kCapturedSurfaceNotFoundError;
     return nullptr;
   }
@@ -3499,9 +3540,10 @@
   // If the video for a screen capture is aborted, the corresponding
   // audio must also be stopped.
   if (blink::IsVideoScreenCaptureMediaType(stream_type)) {
+    SessionType actual_type;
     DeviceRequest* const request =
-        FindRequestByVideoSessionId(capture_session_id);
-    if (request) {
+        FindRequestBySessionId(capture_session_id, &actual_type);
+    if (request && actual_type == SessionType::kVideo) {
       for (const auto& stream_devices_ptr :
            request->stream_devices_set.stream_devices) {
         if (stream_devices_ptr->audio_device.has_value()) {
@@ -4390,8 +4432,10 @@
         callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
-  DeviceRequest* const request = FindRequestByVideoSessionId(session_id);
-  if (!request) {
+  SessionType actual_type;
+  DeviceRequest* const request =
+      FindRequestBySessionId(session_id, &actual_type);
+  if (!request || actual_type != SessionType::kVideo) {
     std::move(callback).Run(blink::mojom::CapturedSurfaceControlResult::
                                 kCapturedSurfaceNotFoundError);
     return;
@@ -4455,8 +4499,9 @@
 
 std::optional<url::Origin> MediaStreamManager::GetOriginByVideoSessionId(
     const base::UnguessableToken& session_id) {
-  DeviceRequest* request = FindRequestByVideoSessionId(session_id);
-  if (request == nullptr) {
+  SessionType actual_type;
+  DeviceRequest* request = FindRequestBySessionId(session_id, &actual_type);
+  if (request == nullptr || actual_type != SessionType::kVideo) {
     return std::nullopt;
   }
   return request->salt_and_origin.origin();
diff --git a/content/browser/renderer_host/media/media_stream_manager.h b/content/browser/renderer_host/media/media_stream_manager.h
index b98ae39c..a5af92dc 100644
--- a/content/browser/renderer_host/media/media_stream_manager.h
+++ b/content/browser/renderer_host/media/media_stream_manager.h
@@ -487,6 +487,31 @@
   std::optional<url::Origin> GetOriginByVideoSessionId(
       const base::UnguessableToken& session_id);
 
+  // Validates that the renderer-supplied `session_id` is authorized for use by
+  // the calling `render_frame_host_id`.
+  //
+  // Returns `true` if:
+  // - The session is active and owned by `render_frame_host_id` (valid usage).
+  // - The session is not active/not found in MediaStreamManager. This is
+  //   considered safe as a non-existent session cannot be hijacked; it will
+  //   fail gracefully downstream (e.g., returning null device). This allows
+  //   legitimate asynchronous races (such as teardown races) to fail gracefully
+  //   instead of causing false-positive renderer terminations.
+  //
+  // Returns `false` if:
+  // - The session is active but owned by a different `RenderFrameHost`/origin.
+  // - The session is active but is of the wrong type (e.g., passing a video
+  //   session ID to an audio endpoint).

diff --git a/content/browser/renderer_host/media/render_frame_audio_input_stream_factory_unittest.cc b/content/browser/renderer_host/media/render_frame_audio_input_stream_factory_unittest.cc
index 902e6496..a665b61 100644
--- a/content/browser/renderer_host/media/render_frame_audio_input_stream_factory_unittest.cc
+++ b/content/browser/renderer_host/media/render_frame_audio_input_stream_factory_unittest.cc
@@ -15,8 +15,11 @@
 #include "content/browser/media/forwarding_audio_stream_factory.h"
 #include "content/browser/renderer_host/media/audio_input_device_manager.h"
 #include "content/browser/renderer_host/media/media_stream_manager.h"
+#include "content/browser/renderer_host/media/media_stream_ui_proxy.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/browser/desktop_media_id.h"
+#include "content/public/browser/desktop_streams_registry.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_contents.h"
@@ -174,6 +177,62 @@
         kDeviceName));
   }
 
+  base::UnguessableToken GenerateAudioStream(
+      blink::mojom::MediaStreamType stream_type,
+      const std::string& device_id,
+      const url::Origin& origin) {
+    base::RunLoop run_loop;
+    base::UnguessableToken session_id;
+
+    blink::StreamControls controls(true /* request_audio */,
+                                   false /* request_video */);
+    controls.audio.stream_type = stream_type;
+
+    std::string resolved_device_id =
+        device_id.empty() ? "fake_default_mic_id" : device_id;
+    blink::MediaStreamDevice fake_device(stream_type, resolved_device_id,
+                                         "Fake Device");
+
+    if (!device_id.empty()) {
+      controls.audio.device_ids = {device_id};
+    }
+
+    media_stream_manager_->UseFakeUIFactoryForTests(base::BindRepeating(
+        [](blink::MediaStreamDevice fake_device) {
+          auto fake_ui = std::make_unique<FakeMediaStreamUIProxy>(
+              /*tests_use_fake_render_frame_hosts=*/true);
+          fake_ui->AddAvailableDevices({fake_device});
+          return fake_ui;
+        },
+        fake_device));
+
+    media_stream_manager_->GenerateStreams(
+        main_rfh()->GetGlobalId(), /*requester_id=*/1, /*page_request_id=*/1,
+        controls, MediaDeviceSaltAndOrigin("salt", origin),
+        /*user_gesture=*/true,
+        blink::mojom::StreamSelectionInfo::NewSearchOnlyByDeviceId({}),
+        base::BindOnce(
+            [](base::RunLoop* run_loop, base::UnguessableToken* session_id,
+               blink::mojom::MediaStreamRequestResult result,
+               const std::string& label,
+               blink::mojom::StreamDevicesSetPtr stream_devices_set,
+               bool pan_tilt_zoom_allowed) {
+              DCHECK_EQ(result, blink::mojom::MediaStreamRequestResult::OK);
+              DCHECK_EQ(stream_devices_set->stream_devices.size(), 1u);
+              DCHECK(stream_devices_set->stream_devices[0]
+                         ->audio_device.has_value());
+              *session_id = stream_devices_set->stream_devices[0]
+                                ->audio_device->session_id();
+              run_loop->Quit();
+            },
+            &run_loop, &session_id),
+        base::DoNothing(), base::DoNothing(), base::DoNothing(),
+        base::DoNothing(), base::DoNothing(), base::DoNothing());
+
+    run_loop.Run();
+    return session_id;
+  }
+
   const media::AudioParameters kParams =
       media::AudioParameters::UnavailableDeviceParams();
   const std::string kDeviceId = "test id";
@@ -201,11 +260,9 @@
       factory_remote.BindNewPipeAndPassReceiver(), media_stream_manager_.get(),
       main_rfh());
 
-  base::UnguessableToken session_id =
-      audio_input_device_manager()->Open(blink::MediaStreamDevice(
-          blink::mojom::MediaStreamType::DEVICE_AUDIO_CAPTURE, kDeviceId,
-          kDeviceName));
-  base::RunLoop().RunUntilIdle();
+  url::Origin origin = url::Origin::Create(GURL("https://test.com"));
+  base::UnguessableToken session_id = GenerateAudioStream(
+      blink::mojom::MediaStreamType::DEVICE_AUDIO_CAPTURE, "", origin);
 
   mojo::PendingRemote<blink::mojom::RendererAudioInputStreamFactoryClient>
       client;
@@ -229,11 +286,16 @@
   RenderFrameHost* main_frame = source_contents->GetPrimaryMainFrame();
   WebContentsMediaCaptureId capture_id(
       main_frame->GetProcess()->GetDeprecatedID(), main_frame->GetRoutingID());
-  base::UnguessableToken session_id =
-      audio_input_device_manager()->Open(blink::MediaStreamDevice(
-          blink::mojom::MediaStreamType::GUM_TAB_AUDIO_CAPTURE,
-          capture_id.ToString(), kDeviceName));
-  base::RunLoop().RunUntilIdle();
+
+  url::Origin origin = url::Origin::Create(GURL("https://test.com"));
+  DesktopMediaID media_id(DesktopMediaID::TYPE_WEB_CONTENTS,
+                          DesktopMediaID::kNullId, capture_id);
+  std::string stream_id = DesktopStreamsRegistry::GetInstance()->RegisterStream(
+      main_rfh()->GetProcess()->GetDeprecatedID(), main_rfh()->GetRoutingID(),
+      origin, media_id, kRegistryStreamTypeTab);
+
+  base::UnguessableToken session_id = GenerateAudioStream(
+      blink::mojom::MediaStreamType::GUM_TAB_AUDIO_CAPTURE, stream_id, origin);
 
   mojo::PendingRemote<blink::mojom::RendererAudioInputStreamFactoryClient>
       client;
@@ -257,11 +319,16 @@
   RenderFrameHost* main_frame = source_contents->GetPrimaryMainFrame();
   WebContentsMediaCaptureId capture_id(
       main_frame->GetProcess()->GetDeprecatedID(), main_frame->GetRoutingID());
-  base::UnguessableToken session_id =
-      audio_input_device_manager()->Open(blink::MediaStreamDevice(
-          blink::mojom::MediaStreamType::GUM_TAB_AUDIO_CAPTURE,
-          capture_id.ToString(), kDeviceName));
-  base::RunLoop().RunUntilIdle();
+
+  url::Origin origin = url::Origin::Create(GURL("https://test.com"));
+  DesktopMediaID media_id(DesktopMediaID::TYPE_WEB_CONTENTS,
+                          DesktopMediaID::kNullId, capture_id);
+  std::string stream_id = DesktopStreamsRegistry::GetInstance()->RegisterStream(
+      main_rfh()->GetProcess()->GetDeprecatedID(), main_rfh()->GetRoutingID(),
+      origin, media_id, kRegistryStreamTypeTab);
+
+  base::UnguessableToken session_id = GenerateAudioStream(
+      blink::mojom::MediaStreamType::GUM_TAB_AUDIO_CAPTURE, stream_id, origin);
 
   source_contents.reset();
   mojo::PendingRemote<blink::mojom::RendererAudioInputStreamFactoryClient>
diff --git a/content/browser/renderer_host/media/video_capture_unittest.cc b/content/browser/renderer_host/media/video_capture_unittest.cc
index 5d907811..b634973 100644
--- a/content/browser/renderer_host/media/video_capture_unittest.cc
+++ b/content/browser/renderer_host/media/video_capture_unittest.cc
@@ -116,8 +116,11 @@
 
     // Create a Host and connect it to a simulated IPC channel.
     host_ = std::make_unique<VideoCaptureHost>(
-        GlobalRenderFrameHostId() /* render_frame_host_id */,
+        GlobalRenderFrameHostId(1, 1) /* render_frame_host_id */,
         media_stream_manager_.get());
+    host_receiver_ =
+        std::make_unique<mojo::Receiver<media::mojom::VideoCaptureHost>>(
+            host_.get(), host_remote_.BindNewPipeAndPassReceiver());
 
     OpenSession();
   }
@@ -128,6 +131,7 @@
 
     CloseSession();
 
+    host_receiver_.reset();
     host_.reset();
   }
 
@@ -224,11 +228,12 @@
         .Times(AnyNumber())
         .WillRepeatedly(ExitMessageLoop(task_runner_, run_loop.QuitClosure()));
 
-    host_->Start(DeviceId(), opened_session_id_, params,
-                 observer_receiver_.BindNewPipeAndPassRemote());
+    host_remote_->Start(DeviceId(), opened_session_id_, params,
+                        observer_receiver_.BindNewPipeAndPassRemote());
 
     // Ensure that the browser context has been retrevied and the observer is
     // connected.
+    host_remote_.FlushForTesting();
     observer_receiver_.FlushForTesting();
 
     run_loop.Run();
@@ -243,11 +248,12 @@
                 DoOnVideoCaptureError(
                     media::VideoCaptureError::kVideoCaptureControllerInvalid))
         .Times(1);
-    host_->Start(DeviceId(), base::UnguessableToken(), params,
-                 observer_receiver_.BindNewPipeAndPassRemote());
+    host_remote_->Start(DeviceId(), base::UnguessableToken::Create(), params,
+                        observer_receiver_.BindNewPipeAndPassRemote());
 
     // Ensure that the browser context has been retrevied and the observer is
     // connected.
+    host_remote_.FlushForTesting();
     observer_receiver_.FlushForTesting();
   }
 
@@ -266,16 +272,18 @@
     EXPECT_CALL(*this,
                 DoOnStateChanged(media::mojom::VideoCaptureState::STARTED))
         .Times(AtMost(1));
-    host_->Start(DeviceId(), opened_session_id_, params,
-                 observer_receiver_.BindNewPipeAndPassRemote());
+    host_remote_->Start(DeviceId(), opened_session_id_, params,
+                        observer_receiver_.BindNewPipeAndPassRemote());
 
     // Ensure that the browser context has been retrevied and the observer is
     // connected.
+    host_remote_.FlushForTesting();
     observer_receiver_.FlushForTesting();
 
     EXPECT_CALL(*this,
                 DoOnStateChanged(media::mojom::VideoCaptureState::STOPPED));
-    host_->Stop(DeviceId());
+    host_remote_->Stop(DeviceId());
+    host_remote_.FlushForTesting();
     run_loop.RunUntilIdle();
   }
 
@@ -285,7 +293,8 @@
 
     EXPECT_CALL(*this,
                 DoOnStateChanged(media::mojom::VideoCaptureState::PAUSED));
-    host_->Pause(DeviceId());
+    host_remote_->Pause(DeviceId());
+    host_remote_.FlushForTesting();
 
     media::VideoCaptureParams params;
     params.requested_format = media::VideoCaptureFormat(
@@ -293,7 +302,8 @@
 
     EXPECT_CALL(*this,
                 DoOnStateChanged(media::mojom::VideoCaptureState::RESUMED));
-    host_->Resume(DeviceId(), opened_session_id_, params);
+    host_remote_->Resume(DeviceId(), opened_session_id_, params);
+    host_remote_.FlushForTesting();
     run_loop.RunUntilIdle();
   }
 
@@ -303,7 +313,8 @@
     EXPECT_CALL(*this,
                 DoOnStateChanged(media::mojom::VideoCaptureState::STOPPED))
         .WillOnce(ExitMessageLoop(task_runner_, run_loop.QuitClosure()));
-    host_->Stop(DeviceId());
+    host_remote_->Stop(DeviceId());
+    host_remote_.FlushForTesting();
 
     run_loop.Run();
 
@@ -365,6 +376,9 @@
   std::string opened_device_label_;
 
   std::unique_ptr<VideoCaptureHost> host_;
+  mojo::Remote<media::mojom::VideoCaptureHost> host_remote_;
+  std::unique_ptr<mojo::Receiver<media::mojom::VideoCaptureHost>>
+      host_receiver_;
   mojo::Receiver<media::mojom::VideoCaptureObserver> observer_receiver_{this};
 };