From 5e86f334aa876188b1809b0f6a9ee78dfa6c4892 Mon Sep 17 00:00:00 2001
From: Simon Hangl <[email protected]>
Date: Tue, 04 Aug 2026 07:03:05 -0700
Subject: [PATCH] [Controlled Frame] Fix cross-guest content script source leak

A vulnerability existed in Controlled Frame where content script source
code intended for a specific guest process was serialized and broadcast
to all sibling guest processes that shared the same owner_host (IWA
origin). Although script execution was properly blocked, the raw source
code was still present in the sibling guest's memory, leading to a
CWE-200 Information Exposure leak.

This CL fixes the issue by updating `UserScriptLoader::SendUpdate` to
filter scripts during serialization. For `kControlledFrameEmbedder`
host types, it now queries `WebViewRendererState` for the explicit
script IDs registered to the target guest process. If the process has
no registered scripts, or the script IDs do not match, they are stripped
from the shared memory region before it is sent across the IPC.

Added `EmbedderScriptsNotSentToUnrelatedGuestProcess` to
`UserScriptLoaderUnitTest` to mock the renderer Mojo interface and
mechanically guarantee that the browser correctly drops unrelated
scripts.

Bug: 533070113
Change-Id: I366ac8a721d5449fe48ad0beaf85a1fb14418acb
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8155940
Reviewed-by: Andrea Orru <[email protected]>
Commit-Queue: Simon Hangl <[email protected]>
Reviewed-by: Kevin McNee <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1673303}
---

diff --git a/extensions/browser/guest_view/web_view/web_view_renderer_state.cc b/extensions/browser/guest_view/web_view/web_view_renderer_state.cc
index f78ff2d..5111519 100644
--- a/extensions/browser/guest_view/web_view/web_view_renderer_state.cc
+++ b/extensions/browser/guest_view/web_view/web_view_renderer_state.cc
@@ -126,6 +126,24 @@
   return false;
 }
 
+std::optional<std::set<std::string>>
+WebViewRendererState::GetContentScriptIDsForProcess(
+    content::ChildProcessId guest_process_id) const {
+  base::AutoLock auto_lock(web_view_info_map_lock_);
+
+  std::optional<std::set<std::string>> script_ids;
+  for (const auto& info : web_view_info_map_) {
+    if (info.first.child_id == guest_process_id) {
+      if (!script_ids) {
+        script_ids.emplace();
+      }
+      script_ids->insert(info.second.content_script_ids.begin(),
+                         info.second.content_script_ids.end());
+    }
+  }
+  return script_ids;
+}
+
 void WebViewRendererState::AddContentScriptIDs(
     int embedder_process_id,
     int view_instance_id,
diff --git a/extensions/browser/guest_view/web_view/web_view_renderer_state.h b/extensions/browser/guest_view/web_view/web_view_renderer_state.h
index f1fc86a..c61e22c 100644
--- a/extensions/browser/guest_view/web_view/web_view_renderer_state.h
+++ b/extensions/browser/guest_view/web_view/web_view_renderer_state.h
@@ -14,6 +14,7 @@
 #define EXTENSIONS_BROWSER_GUEST_VIEW_WEB_VIEW_WEB_VIEW_RENDERER_STATE_H_
 
 #include <map>
+#include <optional>
 #include <set>
 #include <string>
 #include <utility>
@@ -66,6 +67,10 @@
   // found, otherwise returns false.
   bool GetPartitionID(int guest_process_id, std::string* partition_id) const;
 
+  // Returns the content script IDs for the given guest process.
+  std::optional<std::set<std::string>> GetContentScriptIDsForProcess(
+      content::ChildProcessId guest_process_id) const;
+
   // Returns true if the renderer with process ID `render_process_id` is a
   // WebView guest process.
   bool IsGuest(int render_process_id) const;
diff --git a/extensions/browser/user_script_loader.cc b/extensions/browser/user_script_loader.cc
index f5d8358..8d75262 100644
--- a/extensions/browser/user_script_loader.cc
+++ b/extensions/browser/user_script_loader.cc
@@ -550,11 +550,8 @@
       NOTREACHED();
   }
 
-  base::ReadOnlySharedMemoryRegion region_for_process =
-      shared_memory.Duplicate();
-  if (!region_for_process.IsValid()) {
-    return SendUpdateResult::kNoActionTaken;
-  }
+  base::ReadOnlySharedMemoryRegion region_for_process;
+  bool use_custom_region = false;
 
 #if BUILDFLAG(ENABLE_GUEST_VIEW)
   // If the process only hosts guest frames, then those guest frames share the
@@ -601,11 +598,49 @@
         if (owner_host != host_id().id) {
           return SendUpdateResult::kNoActionTaken;
         }
+
+        if (host_id().type ==
+            mojom::HostID::HostType::kControlledFrameEmbedder) {
+          use_custom_region = true;
+          std::optional<std::set<std::string>> script_ids =
+              WebViewRendererState::GetInstance()
+                  ->GetContentScriptIDsForProcess(process->GetID());
+          if (!script_ids || script_ids->empty()) {
+            return SendUpdateResult::kNoActionTaken;
+          }
+          if (loaded_scripts_) {
+            UserScriptList filtered_scripts;
+            for (const std::unique_ptr<UserScript>& script : *loaded_scripts_) {
+              if (script_ids->count(script->id())) {
+                std::unique_ptr<UserScript> filtered_script =
+                    UserScript::CopyMetadataFrom(*script);
+                for (size_t i = 0; i < script->js_scripts().size(); ++i) {
+                  filtered_script->js_scripts()[i]->set_content(
+                      std::string(script->js_scripts()[i]->GetContent()));
+                }
+                for (size_t i = 0; i < script->css_scripts().size(); ++i) {
+                  filtered_script->css_scripts()[i]->set_content(
+                      std::string(script->css_scripts()[i]->GetContent()));
+                }
+                filtered_scripts.push_back(std::move(filtered_script));
+              }
+            }
+            region_for_process = Serialize(filtered_scripts);
+          }
+        }
         break;
     }
   }
 #endif
 
+  if (!use_custom_region) {
+    region_for_process = shared_memory.Duplicate();
+  }
+
+  if (!region_for_process.IsValid()) {
+    return SendUpdateResult::kNoActionTaken;
+  }
+
   renderer->UpdateUserScripts(std::move(region_for_process),
                               mojom::HostID::New(host_id().type, host_id().id));
   return SendUpdateResult::kRendererHasBeenNotified;
diff --git a/extensions/browser/user_script_loader_unittest.cc b/extensions/browser/user_script_loader_unittest.cc
index 3cc7818..e9e179a 100644
--- a/extensions/browser/user_script_loader_unittest.cc
+++ b/extensions/browser/user_script_loader_unittest.cc
@@ -161,10 +161,12 @@
     return process;
   }
 
-  void LoadScriptsAndWait(UserScriptLoader* loader,
-                          content::RenderProcessHost* embedder_process) {
+  void LoadScriptsAndWait(
+      UserScriptLoader* loader,
+      content::RenderProcessHost* embedder_process,
+      std::string script_id = UserScript::GenerateUserScriptID()) {
     auto script = std::make_unique<UserScript>();
-    script->set_id(UserScript::GenerateUserScriptID());
+    script->set_id(script_id);
     script->set_host_id(loader->host_id());
     auto content = UserScript::Content::CreateInlineCode(
         GURL("https://embedder.example/inline.js"));
@@ -202,8 +204,10 @@
   ASSERT_TRUE(helper()->IsProcessInitializedForTesting(guest_process.get()));
 
   const std::string owner_host = "isolated-app://embedder.example";
+  const std::string script_id = UserScript::GenerateUserScriptID();
   WebViewRendererState::WebViewInfo web_view_info;
   web_view_info.owner_host = owner_host;
+  web_view_info.content_script_ids.insert(script_id);
   const int dummy_routing_id = 1;
   WebViewRendererState::GetInstance()->AddGuestForTesting(
       guest_process->GetDeprecatedID(), dummy_routing_id, web_view_info);
@@ -218,7 +222,7 @@
       browser_context(),
       mojom::HostID(mojom::HostID::HostType::kControlledFrameEmbedder,
                     owner_host));
-  LoadScriptsAndWait(&loader, guest_process.get());
+  LoadScriptsAndWait(&loader, guest_process.get(), script_id);
 
   EXPECT_TRUE(loader.initial_load_complete());
   EXPECT_TRUE(helper()->ProcessReceivedUpdateUserScripts(guest_process.get()));
@@ -254,6 +258,40 @@
   }
 }
 
+// Test that an embedder content script is NOT sent to a guest renderer
+// if that guest's ID is not associated with the script.
+// This prevents cross-guest script leaks in Controlled Frame.

diff --git a/extensions/browser/user_script_loader_unittest.cc b/extensions/browser/user_script_loader_unittest.cc
index 3cc7818..e9e179a 100644
--- a/extensions/browser/user_script_loader_unittest.cc
+++ b/extensions/browser/user_script_loader_unittest.cc
@@ -161,10 +161,12 @@
     return process;
   }
 
-  void LoadScriptsAndWait(UserScriptLoader* loader,
-                          content::RenderProcessHost* embedder_process) {
+  void LoadScriptsAndWait(
+      UserScriptLoader* loader,
+      content::RenderProcessHost* embedder_process,
+      std::string script_id = UserScript::GenerateUserScriptID()) {
     auto script = std::make_unique<UserScript>();
-    script->set_id(UserScript::GenerateUserScriptID());
+    script->set_id(script_id);
     script->set_host_id(loader->host_id());
     auto content = UserScript::Content::CreateInlineCode(
         GURL("https://embedder.example/inline.js"));
@@ -202,8 +204,10 @@
   ASSERT_TRUE(helper()->IsProcessInitializedForTesting(guest_process.get()));
 
   const std::string owner_host = "isolated-app://embedder.example";
+  const std::string script_id = UserScript::GenerateUserScriptID();
   WebViewRendererState::WebViewInfo web_view_info;
   web_view_info.owner_host = owner_host;
+  web_view_info.content_script_ids.insert(script_id);
   const int dummy_routing_id = 1;
   WebViewRendererState::GetInstance()->AddGuestForTesting(
       guest_process->GetDeprecatedID(), dummy_routing_id, web_view_info);
@@ -218,7 +222,7 @@
       browser_context(),
       mojom::HostID(mojom::HostID::HostType::kControlledFrameEmbedder,
                     owner_host));
-  LoadScriptsAndWait(&loader, guest_process.get());
+  LoadScriptsAndWait(&loader, guest_process.get(), script_id);
 
   EXPECT_TRUE(loader.initial_load_complete());
   EXPECT_TRUE(helper()->ProcessReceivedUpdateUserScripts(guest_process.get()));
@@ -254,6 +258,40 @@
   }
 }
 
+// Test that an embedder content script is NOT sent to a guest renderer
+// if that guest's ID is not associated with the script.
+// This prevents cross-guest script leaks in Controlled Frame.
+TEST_F(UserScriptLoaderUnitTest,
+       EmbedderScriptsNotSentToUnrelatedGuestProcess) {
+  std::unique_ptr<content::MockRenderProcessHost> guest_process =
+      CreateAndInitializeProcess(/*is_for_guests_only=*/true);
+  ASSERT_TRUE(helper()->IsProcessInitializedForTesting(guest_process.get()));
+
+  const std::string owner_host = "isolated-app://embedder.example";
+  // Deliberately do NOT add the script_id to web_view_info.content_script_ids.
+  // This simulates a sibling guest process that shouldn't receive the script.
+  WebViewRendererState::WebViewInfo web_view_info;
+  web_view_info.owner_host = owner_host;
+  const int dummy_routing_id = 1;
+  WebViewRendererState::GetInstance()->AddGuestForTesting(
+      guest_process->GetDeprecatedID(), dummy_routing_id, web_view_info);
+  base::ScopedClosureRunner cleanup_guest(base::BindOnce(
+      [](int process_id, int routing_id) {
+        WebViewRendererState::GetInstance()->RemoveGuestForTesting(process_id,
+                                                                   routing_id);
+      },
+      guest_process->GetDeprecatedID(), dummy_routing_id));
+
+  EmbedderUserScriptLoader loader(
+      browser_context(),
+      mojom::HostID(mojom::HostID::HostType::kControlledFrameEmbedder,
+                    owner_host));
+  LoadScriptsAndWait(&loader, guest_process.get());
+
+  EXPECT_TRUE(loader.initial_load_complete());
+  EXPECT_FALSE(helper()->ProcessReceivedUpdateUserScripts(guest_process.get()));
+}
+
 }  // namespace
 
 }  // namespace extensions