Flapjack, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: The CSSFontFeatureValue::CustomCSSText() method fails to escape double quotes when serializing the font-feature-settings property. An attacker can use CSS hex escapes to inject a tag containing quotes, which is valid per OpenType specs. When the element’s cssText is serialized and reused in a <style> block, it can lead to arbitrary CSS injection.

Affected files:

• third_party/blink/renderer/core/css/css_font_feature_value.cc
• third_party/blink/renderer/core/css/properties/css_parsing_utils.cc

Estimated timestamp from git blame: 2018-01-29

Summary

A serialization bug in CSSFontFeatureValue::CustomCSSText() allows for potential CSS injection and mutation XSS (mXSS). The method manually serializes the font feature tag_ member by wrapping it in double quotes without escaping internal characters. Because the CSS parser correctly allows characters in the range [0x20, 0x7E] for OpenType tags (including quotes and braces), an attacker can craft a 4-character tag that breaks out of the CSS string context upon serialization.

Root Cause

In third_party/blink/renderer/core/css/properties/css_parsing_utils.cc (ConsumeFontSettingsTagAndValue), the parser validates the font feature tag. It ensures the tag is exactly 4 characters long and that each character is between 0x20 and 0x7E. This range intentionally includes characters like " (0x22), \ (0x5C), and } (0x7D).

However, in third_party/blink/renderer/core/css/css_font_feature_value.cc, the CustomCSSText() function manually concatenates the tag value during serialization:

String CSSFontFeatureValue::CustomCSSText() const {
  StringBuilder builder;
  builder.Append('"');
  builder.Append(tag_);
  builder.Append('"');
  // ...

Because tag_ is not properly escaped, an attacker can inject quotes that prematurely close the serialized string.

Potential Exploitation Scenario

Note: These are suggested steps based on code analysis; a working proof of concept has not been executed.

An attacker can exploit this if a web application or DOM sanitizer reads an element’s cssText and places it into a <style> block (a common pattern for CSP compliance or shadow DOM styling).

1. The attacker controls an inline style and injects a 4-character payload using CSS hex escapes:

// Inject the tag `"}/*`
element.style.fontFeatureSettings = '"\\22\\7d\\2f\\2a"'; 

// Inject a custom property to hold the rest of the payload
element.style.setProperty('--payload', '*/ body { background: red; } /*');

2. The browser parses these successfully. When the application reads element.style.cssText, Blink’s StylePropertySerializer serializes the properties.

3. Due to the lack of escaping, the resulting cssText becomes: font-feature-settings: ""}/*"; --payload: */ body { background: red; } /*;

4. The application inserts this into a <style> block, e.g.: <style>.user-rule { font-feature-settings: ""}/*"; --payload: */ body { background: red; } /*; }</style>

5. When the browser parses this new <style> block:

   • "" completes the font-feature-settings string.
   • } prematurely closes the .user-rule CSS block.
   • /* starts a CSS comment that swallows the remainder of the first line.
   • */ (from the custom property) closes the comment.
   • The attacker’s injected CSS body { background: red; } is evaluated as active CSS in the global scope.

Impact

This vulnerability can be leveraged to bypass application-level CSS sanitizers that rely on the browser’s CSS serialization. This can lead to CSS-based data exfiltration or UI spoofing.

Suggested Fix

In third_party/blink/renderer/core/css/css_font_feature_value.cc, use SerializeString(tag_, builder) (available via third_party/blink/renderer/core/css/css_markup.h) instead of manually appending quotes. This ensures the tag is properly escaped, matching the correct behavior already implemented in CSSFontVariationValue::CustomCSSText().

Evaluated with Chrome root at commit: 2155cb00003ec35716a76ed3246eae995f87b7ff

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

• If you are familiar with the severity guidelines, you may adjust the severity.
• If this is a false positive, and there’s no work to be done, please close as WAI.
• If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.