Project Fortify, an experimental security project, has identified the following potential security issue.

Overview: An Isolated Web App (IWA) can bypass permissions to send arbitrary multicast UDP packets to the local network. This occurs due to multicast IPs being misclassified as public, bypassing Private Network Access (PNA) checks, and missing multicast policy validation in RestrictedUDPSocket data-sending methods. This enables active local network spoofing (e.g., mDNS/SSDP) from an unauthorized context.

Affected files:

• services/network/restricted_udp_socket.cc
• content/browser/direct_sockets/direct_sockets_service_impl.cc
• services/network/public/cpp/ip_address_space_util.cc

Estimated timestamp from git blame: 2025-09-01

Overview

There is a potential vulnerability in the Direct Sockets API where an Isolated Web App (IWA) can send multicast UDP traffic without possessing the direct-sockets-multicast permission or Private Network Access (PNA) permissions (e.g., LOCAL_NETWORK). This flaw arises from two chained logic errors:

1. PNA Bypass: Multicast IP addresses are misclassified as public IP space.
2. Multicast Policy Bypass: The RestrictedUDPSocket data-sending methods (Send and SendTo) fail to enforce the multicast permission flag, unlike the group membership methods (JoinGroup and LeaveGroup).

Technical Details

1. Private Network Access (PNA) Bypass When an IWA attempts to open a connected UDP socket, DirectSocketsServiceImpl::OnResolveCompleteForUDPSocket calls GetRequiredPermissions(resolved_addresses). This function checks if the IP address requires PNA permissions using network::IPAddressToIPAddressSpace().

In services/network/public/cpp/ip_address_space_util.cc, IPAddressToIPAddressSpace checks the IP against NonPublicAddressSpaceMap(). However, this map omits multicast ranges (IPv4 224.0.0.0/4 and IPv6 ff00::/8). Consequently, multicast addresses are classified as IPAddressSpace::kPublic. Because they are seen as public, GetRequiredPermissions returns an empty list, completely bypassing PNA checks and prompts.

2. Missing Multicast Check in RestrictedUDPSocket After bypassing PNA, the browser creates a RestrictedUDPSocket in the Network Service. While the browser correctly passes allow_multicast = false to the Network Service, services/network/restricted_udp_socket.cc only checks this flag in JoinGroup and LeaveGroup.

The Send method (used for CONNECTED sockets) and SendTo method (used for BOUND sockets) unconditionally forward data to the underlying OS socket. The OS happily routes the UDP datagram to the multicast group.

Suggested Attacker Steps

(Note: These are potential steps based on code analysis; our tooling agent does not currently have the ability to run code to produce a live PoC).

1. An attacker creates a malicious IWA that declares the base direct-sockets permission in its manifest, but deliberately omits direct-sockets-multicast and direct-sockets-private.
2. A victim installs and runs the IWA.
3. The IWA’s JavaScript executes the following to target a local SSDP multicast group:

   const socket = new UDPSocket({ remoteAddress: '239.255.255.250', remotePort: 1900 });
   const { writable } = await socket.opened;
   

   (Because 239.255.255.250 is classified as public, the socket connects immediately without triggering a PNA local network prompt).
4. The IWA writes a spoofed SSDP discovery payload to the stream:

   const writer = writable.getWriter();
   await writer.write({ data: new TextEncoder().encode("M-SEARCH * HTTP/1.1\r\n...") });
   

   (Because RestrictedUDPSocket::Send lacks the allow_multicast_ check, the packet is emitted onto the local network).

Suggested Fix

1. Fix the IP Space Map: In services/network/public/cpp/ip_address_space_util.cc, update NonPublicAddressSpaceMap() to include the IPv4 (224.0.0.0/4) and IPv6 (ff00::/8) multicast blocks so they are treated as kLocal (or mapped to a new space that strictly requires PNA permissions).
2. Enforce Multicast Checks:
   • In RestrictedUDPSocket::SendTo, check if dest_addr is a multicast address. If it is, verify that allow_multicast_ is true.
   • In DirectSocketsServiceImpl::OnResolveCompleteForUDPSocket, check if the resolved address is a multicast address. If it is, fail the connection immediately if IsMulticastAllowed(context_) is false, preventing a connected socket from being bound to a multicast destination without permissions.

Evaluated with Chrome root at commit: a9cbf6e8b275fe4147435aa905f3b7f5a656f5f0

Results from so far have been promising, but there can be wrong deductions. If this proves to be a false positive, please close as WAI; data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.