Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports without the security team.

Overview: The Home button’s drag-and-drop handler fails to filter javascript: URLs when setting the home page preference. This allows an attacker to persistently set a malicious javascript: payload as the user’s home page, which executes in the context of the active tab (UXSS) when the user navigates home.

Affected files:

• chrome/browser/ui/views/toolbar/home_button.cc
• chrome/browser/ui/views/frame/browser_root_view.cc
• ui/views/widget/drop_helper.cc
• content/browser/renderer_host/render_widget_host_impl.cc
• third_party/blink/renderer/core/frame/local_frame.cc

Estimated timestamp from git blame: 2026-01-26

Summary

There is a potential Persistent Universal Cross-Site Scripting (UXSS) vulnerability in the HomeButton component (chrome/browser/ui/views/toolbar/home_button.cc). By dragging a javascript: URL onto the Home button, an attacker can set it as the user’s home page preference (prefs::kHomePage). Because this preference is synced across devices, the payload becomes persistent and multi-device. When the user later triggers the ‘Home’ action (via click or Alt+Home), the javascript: URL is executed in the context of the currently active tab, bypassing Content Security Policy (CSP).

Vulnerability Details

1. Missing Scheme Filter in HomeButton: When a user drags a URL onto the Home button, the HomeButton::CanDrop method returns true for any valid URL data. This causes the Views DropHelper to stop its upward traversal, bypassing the safety filters in BrowserRootView::FilterURLsForDropability that explicitly block javascript: URLs to prevent self-XSS.
2. Unsafe Preference Write: HomeButton::UpdateHomePage then writes the dropped URL to prefs::kHomePage using only a CHECK(is_valid()) validation. It fails to perform scheme filtering, allowing javascript: URLs to be saved.
3. Cross-Device Sync: The kHomePage preference is a SYNCABLE_PREF. The malicious URL is synchronized to all other desktop Chrome instances where the user is signed in.
4. Trigger and Execution: When the user clicks the Home button, Home() (chrome/browser/ui/browser_commands.cc) reads the home page URL and calls OpenURL with is_renderer_initiated = false.
5. Debug URL Processing: NavigationControllerImpl sees the javascript: URL, identifies it as a renderer-debug URL (blink::IsRendererDebugURL), and routes it to HandleRendererDebugURL.
6. UXSS: The URL is sent via Mojo to the renderer’s LocalFrame::LoadJavaScriptURL. The script executes in the MainWorld of the current page with CSPDisposition::DO_NOT_CHECK, resulting in UXSS on the active tab’s origin.

Potential Reproduction Steps

Please note: our tooling agent cannot run code, so these are suggested steps to verify the vulnerability.

1. Enable ‘Show Home button’ in chrome://settings/appearance.
2. Create and navigate to an attacker-controlled page with a draggable link containing a javascript: payload: <a href="javascript:alert('UXSS: ' + document.domain)" draggable="true">Drag me to the Home button</a>.
3. Drag the link onto the Home button in the browser toolbar.
4. Navigate to a sensitive website (e.g., https://example.com).
5. Press Alt+Home or click the Home button.
6. Observe that the JavaScript execution occurs in the context of the current site’s origin.

Suggested Fix

Modify HomeButton::CanDrop or HomeButton::UpdateHomePage to explicitly filter out javascript: URLs, similar to the existing protection in BrowserRootView::FilterURLsForDropability. For example:

void HomeButton::UpdateHomePage(...) {
  // ... existing code ...
  if (!url_infos.empty() && prefs_) {
    GURL new_homepage = url_infos.front().url;
    // Fix: Disallow javascript: URLs to prevent UXSS.
    if (new_homepage.SchemeIs(url::kJavaScriptScheme)) {
      return;
    }
    CHECK(new_homepage.is_valid());
    prefs_->SetString(prefs::kHomePage, new_homepage.spec());
    // ...

Evaluated with Chrome root at commit: ff3d2b74fa39431785bd60e51463b08fcc71ee33

Results so far have been promising, but there can be wrong deductions. If this proves to be a false positive, please close as WAI; data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.