Report description

OnDeviceAiSettingsHandler mutates on-device AI user setting despite mandatory GenAILocalFoundationalModelSettings=Disabled and hidden AI settings UI

Bug location

Where do you want to report your vulnerability?

Chrome VRP – Report security issues affecting the Chrome browser. See program rules

Which URL (or repository) have you found the vulnerability in?

https://chromium.googlesource.com/chromium/src/+/refs/heads/main/chrome/browser/ui/webui/settings/on_device_ai_settings_handler.cc

The problem

Please describe the technical details of the vulnerability

Chrome registers the OnDeviceAiSettingsHandler on chrome://settings even when the AI settings UI is unavailable and a mandatory enterprise policy disables local foundational GenAI model usage.

Environment tested:

• Chrome 147.0.7727.138 (Official Build) (arm64)
• chrome://policy shows:
  • GenAILocalFoundationalModelSettings = 1
  • Source: Platform
  • Applies to: Machine
  • Level: Mandatory
  • Status: OK

Observed UI/policy state:

• Navigating to chrome://settings/ai redirects to chrome://settings.
• In chrome://settings, loadTimeData values showAiPage and showOnDeviceAiSettings are missing.
• chrome://on-device-internals shows:
  • enabled by enterprise policy: false
  • foundational model state: Not Eligible

Despite this, chrome://settings still exposes the legacy WebUI message handler for on-device AI settings. Calling getOnDeviceAiEnabled returns allowedByPolicy:false, but setOnDeviceAiEnabled still mutates the user setting.

Relevant source:

• chrome/browser/ui/webui/settings/on_device_ai_settings_handler.cc registers:
  • getOnDeviceAiEnabled
  • setOnDeviceAiEnabled
  • openOnDeviceAiFeedbackDialog
• GetOnDeviceAiState() computes allowedByPolicy from GenAILocalFoundationalModelEnterprisePolicySettings.
• HandleSetOnDeviceAiEnabled() does not check allowedByPolicy or enterprise policy state. It directly writes: optimization_guide.on_device_foundational_model_user_settings

Proof of concept from chrome://settings DevTools console:

(async () => { function getOnDeviceAiEnabled() { return new Promise((resolve) => { const callbackId = vrp_get_${Date.now()}_${Math.random()}; const original = cr.webUIResponse; const timer = setTimeout(() => { cr.webUIResponse = original; resolve({responded:false,error:’timeout’}); }, 3000);

  cr.webUIResponse = function(id, success, response) {
    if (id !== callbackId) return original.apply(this, arguments);
    clearTimeout(timer);
    cr.webUIResponse = original;
    resolve({responded:true,success,response});
  };

  chrome.send('getOnDeviceAiEnabled', [callbackId]);
});

}

const before = await getOnDeviceAiEnabled(); chrome.send(‘setOnDeviceAiEnabled’, [false]); const afterFalse = await getOnDeviceAiEnabled(); chrome.send(‘setOnDeviceAiEnabled’, [true]); const afterTrue = await getOnDeviceAiEnabled();

console.log(JSON.stringify({before, afterFalse, afterTrue}, null, 2)); })();

Observed result:

{ “before”: { “responded”: true, “success”: true, “response”: { “allowedByPolicy”: false, “enabled”: true } }, “afterFalse”: { “responded”: true, “success”: true, “response”: { “allowedByPolicy”: false, “enabled”: false } }, “afterTrue”: { “responded”: true, “success”: true, “response”: { “allowedByPolicy”: false, “enabled”: true } } }

The mutation persisted after browser restart. chrome://on-device-internals also reflected the mutation: “enabled by user setting” changed false/true while “enabled by enterprise policy” stayed false.

Security impact: A hidden WebUI handler allows a user-level on-device AI setting to be modified under a mandatory machine-level policy that disables local foundational GenAI model usage. The normal AI settings UI is not available, but the backend WebUI message remains callable and mutates persistent local state.

Limitation: I did not prove that the model can be downloaded or executed despite policy. chrome://on-device-internals continued to show the foundational model as Not Eligible because enabled by enterprise policy remained false.

Impact analysis

The demonstrated exploit path requires script execution in the privileged chrome://settings WebUI context, for example through DevTools or another bug that can execute JavaScript in that WebUI. I tested a normal Chrome extension attacker model using chrome.scripting.executeScript against chrome://settings, and Chrome blocked it with “Cannot access a chrome:// URL.”

An attacker with code execution in chrome://settings can call the hidden OnDeviceAiSettingsHandler and mutate the persistent on-device AI user setting even while a mandatory machine-level GenAILocalFoundationalModelSettings policy disables local foundational GenAI model usage and the normal AI settings UI is hidden.

What the attacker gains:

• Ability to change optimization_guide.on_device_foundational_model_user_settings despite allowedByPolicy:false.
• The changed value persists after browser restart.
• chrome://on-device-internals reflects the mutation as “enabled by user setting: true/false.”

Current limitation: I did not demonstrate model download or model execution despite the enterprise policy. The model remained Not Eligible because “enabled by enterprise policy” stayed false. Therefore the current impact is policy-inconsistent persistent state mutation of a hidden/policy-disabled setting, not a confirmed full bypass of model execution.

The cause

What version of Chrome have you found the security issue in?

147.0.7727.138 (Official Build) (arm64)

Is the security issue related to a crash?

No, it is not related to a crash.

Choose the type of vulnerability

Permissions Bypass

How would you like to be publicly acknowledged for your report?

Itzik Chimino