From 899e77f0d448f44b5c9065911721d6f608a675c9 Mon Sep 17 00:00:00 2001
From: Jordan Bayles <[email protected]>
Date: Fri, 10 Apr 2026 14:16:28 -0700
Subject: [PATCH] Fix Use-After-Free in WebContentsImpl::ForSecurityDropFullscreen

When `ForSecurityDropFullscreen` drops the fullscreen state of upstream
openers, it iterates over a set of `raw_ptr<WebContentsImpl>` instances.
Calling `ExitFullscreen()` on these openers can spin a nested message
loop (e.g., when waiting for the OS window transition to finish).
During this nested message loop, other `WebContentsImpl` instances in
the iteration set can be destroyed via IPCs (such as `window.close()`).

Previously, the loop continued to process the dangling `raw_ptr`s in
the local copy of the set, leading to a Use-After-Free when attempting
to query their fullscreen state via `is_fullscreen()`.

This CL mitigates the UAF by first caching the target WebContentsImpl
instances as a `std::vector<base::WeakPtr<WebContentsImpl>>`. During the
actual iteration where `ExitFullscreen()` is called, the validity of
each `WeakPtr` is checked before dereferencing, ensuring that destroyed
WebContents are safely ignored even if reentrancy occurs.

Bug: 497436531
Change-Id: I190490caeab24daa9508fa27caf8dace613e9172
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7747694
Reviewed-by: Avi Drissman <[email protected]>
Commit-Queue: Jordan Bayles <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1613095}
---

diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index b1998f14..5901f6c 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -7397,10 +7397,20 @@
   // upstream contents. Drop that WebContents out of fullscreen if it does. This
   // is theoretically quadratic-ish (fullscreen contentses x each one's opener
   // length) but neither of those is expected to ever be a large number.
-  auto fullscreen_set_copy = *FullscreenContentsSet(GetBrowserContext());
-  for (WebContentsImpl* fullscreen_contents : fullscreen_set_copy) {
-    if (is_fullscreen(fullscreen_contents, display_id)) {
-      auto opener_contentses = GetAllOpeningWebContents(fullscreen_contents);
+  std::vector<base::WeakPtr<WebContentsImpl>> fullscreen_contents_list;
+  for (WebContentsImpl* fullscreen_contents :
+       *FullscreenContentsSet(GetBrowserContext())) {
+    fullscreen_contents_list.push_back(
+        fullscreen_contents->weak_factory_.GetWeakPtr());
+  }
+
+  for (auto& fullscreen_contents : fullscreen_contents_list) {
+    if (!fullscreen_contents) {
+      continue;
+    }
+    if (is_fullscreen(fullscreen_contents.get(), display_id)) {
+      auto opener_contentses =
+          GetAllOpeningWebContents(fullscreen_contents.get());
       if (opener_contentses.count(this)) {
         fullscreen_contents->ExitFullscreen(true);
       }
@@ -7414,29 +7424,41 @@
   // any request to enter fullscreen will have the upstream of the WebContents
   // checked. (See CanEnterFullscreenMode().)
 
-  std::vector<base::WeakPtr<WebContentsImpl>> blocked_contentses;
+  std::vector<base::WeakPtr<WebContentsImpl>> blocked_contents_list;
+  std::vector<base::WeakPtr<WebContentsImpl>> openers;
+  for (WebContentsImpl* opener : GetAllOpeningWebContents(this)) {
+    openers.push_back(opener->weak_factory_.GetWeakPtr());
+  }
 
-  for (auto opener : GetAllOpeningWebContents(this)) {
-    if (is_fullscreen(opener, display_id)) {
+  for (auto& opener : openers) {
+    if (!opener) {
+      continue;
+    }
+
+    if (is_fullscreen(opener.get(), display_id)) {
       opener->ExitFullscreen(true);
     }
 
+    if (!opener) {
+      continue;
+    }
+
     // ...block the WebContents from entering fullscreen until further notice.
     ++opener->fullscreen_blocker_count_;
-    blocked_contentses.push_back(opener->weak_factory_.GetWeakPtr());
+    blocked_contents_list.push_back(opener);
   }
 
   return base::ScopedClosureRunner(base::BindOnce(
-      [](std::vector<base::WeakPtr<WebContentsImpl>> blocked_contentses) {
+      [](std::vector<base::WeakPtr<WebContentsImpl>> blocked_contents_list) {
         for (base::WeakPtr<WebContentsImpl>& web_contents :
-             blocked_contentses) {
+             blocked_contents_list) {
           if (web_contents) {
             DCHECK_GT(web_contents->fullscreen_blocker_count_, 0);
             --web_contents->fullscreen_blocker_count_;
           }
         }
       },
-      std::move(blocked_contentses)));
+      std::move(blocked_contents_list)));
 }
 
 void WebContentsImpl::ResumeLoadingCreatedWebContents() {