From 47ffe717717435d672257187a00922b391d0a27e Mon Sep 17 00:00:00 2001
From: Daniel Clark <[email protected]>
Date: Mon, 03 Aug 2026 09:38:04 -0700
Subject: [PATCH] Set g_in_move_resize_loop as soon as we get WM_ENTERSIZEMOVE

When the user clicks on a window border to start window resizing,
Windows' native modal loop sends WM_ENTERSIZEMOVE, and
`ScopedAllowApplicationTasksInNativeNestedLoop` is set so that IPC
from renderer processes can continue to be handled.

If the user then drags the window border, WM_SIZING or WM_MOVING will
be received, at which point `UserResizeMoveDetector` will set
`g_in_move_resize_loop`. This causes
`DesktopDragDropClientWin::StartDragAndDrop` to correctly guard
against mouse actions during the window resize being treated
as a drag/drop by checking `IsInNativeMoveResizeLoop()`.

But if a compromised renderer spams `LocalFrameHost::StartDragging`
IPC messages in the gap between `WM_ENTERSIZEMOVE` and
`WM_SIZING`/`WM_MOVING`, the `g_in_move_resize_loop` guard isn't
yet set, meaning the `IsInNativeMoveResizeLoop()` check in
`DesktopDragDropClientWin::StartDragAndDrop` will return false
and a payload from the renderer could be completed as a drop despite
the user only having clicked the window border.

Fix it by setting `g_in_move_resize_loop` as soon as WM_ENTERSIZEMOVE
is received. This is consistent with the timing with which we set
`g_is_in_native_menu_loop` in `HWNDMessageHandler::OnEnterMenuLoop`.

Fixed: 520469117
Change-Id: I65722bfd78e418f9e43c2ee0eafe85382d7dabd4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8175067
Reviewed-by: David Bienvenu <[email protected]>
Commit-Queue: Dan Clark <[email protected]>
Reviewed-by: Allen Bauer <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1672718}
---

diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_win_unittest.cc b/ui/views/widget/desktop_aura/desktop_window_tree_host_win_unittest.cc
index a4d0dd0..dccab27 100644
--- a/ui/views/widget/desktop_aura/desktop_window_tree_host_win_unittest.cc
+++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_win_unittest.cc
@@ -397,5 +397,38 @@
   EXPECT_FALSE(host_b->IsInNativeMoveResizeLoop());
 }
 
+// The native size/move modal loop is already on the stack once WM_ENTERSIZEMOVE
+// has been delivered, but no WM_SIZING/WM_MOVING arrives until the user moves
+// the mouse. That loop pumps application tasks (including Mojo IPCs from
+// renderers), so IsInNativeMoveResizeLoop() must already report true at
+// WM_ENTERSIZEMOVE. Otherwise a task running in the gap sees false and can
+// start an OS-level drag while the user is holding a resize border.
+TEST_F(DesktopWindowTreeHostWinTest, IsInNativeMoveResizeLoopOnEnterSizeMove) {
+  Widget widget;
+  widget.Init(CreateParams(Widget::InitParams::CLIENT_OWNS_WIDGET,
+                           Widget::InitParams::TYPE_WINDOW));
+  widget.Show();
+
+  DesktopWindowTreeHostWin* host = static_cast<DesktopWindowTreeHostWin*>(
+      widget.GetNativeWindow()->GetHost());
+  EXPECT_FALSE(host->IsInNativeMoveResizeLoop());
+
+  HWND hwnd = widget.GetNativeWindow()->GetHost()->GetAcceleratedWidget();
+
+  // The user has pressed the mouse on a resize border. Windows has entered the
+  // modal loop, but the mouse has not moved yet.
+  ::SendMessage(hwnd, WM_ENTERSIZEMOVE, 0, 0);
+  EXPECT_TRUE(host->IsInNativeMoveResizeLoop());
+
+  // The user now drags, producing the first WM_SIZING.
+  RECT rect = {};
+  ::GetWindowRect(hwnd, &rect);
+  ::SendMessage(hwnd, WM_SIZING, WMSZ_RIGHT, reinterpret_cast<LPARAM>(&rect));
+  EXPECT_TRUE(host->IsInNativeMoveResizeLoop());
+
+  ::SendMessage(hwnd, WM_EXITSIZEMOVE, 0, 0);
+  EXPECT_FALSE(host->IsInNativeMoveResizeLoop());
+}
+
 }  // namespace test
 }  // namespace views
diff --git a/ui/views/win/user_resize_move_detector.cc b/ui/views/win/user_resize_move_detector.cc
index 7f76fe48..af3580d 100644
--- a/ui/views/win/user_resize_move_detector.cc
+++ b/ui/views/win/user_resize_move_detector.cc
@@ -19,12 +19,14 @@
 void UserResizeMoveDetector::OnEnterSizeMove() {
   if (state_ == State::kNotResizing) {
     state_ = State::kInSizeMove;
+    // The native modal size/move loop is on the stack from here until
+    // WM_EXITSIZEMOVE.
+    g_in_move_resize_loop = true;
   }
 }
 
 void UserResizeMoveDetector::OnSizing() {
   if (state_ == State::kInSizeMove) {
-    g_in_move_resize_loop = true;
     state_ = State::kInSizing;
     hwnd_delegate_->HandleBeginUserResize();
   }
@@ -32,7 +34,6 @@
 
 void UserResizeMoveDetector::OnMoving() {
   if (state_ == State::kInSizeMove) {
-    g_in_move_resize_loop = true;
     state_ = State::kInMoving;
     hwnd_delegate_->HandleBeginUserDrag();
   }

diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_win_unittest.cc b/ui/views/widget/desktop_aura/desktop_window_tree_host_win_unittest.cc
index a4d0dd0..dccab27 100644
--- a/ui/views/widget/desktop_aura/desktop_window_tree_host_win_unittest.cc
+++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_win_unittest.cc
@@ -397,5 +397,38 @@
   EXPECT_FALSE(host_b->IsInNativeMoveResizeLoop());
 }
 
+// The native size/move modal loop is already on the stack once WM_ENTERSIZEMOVE
+// has been delivered, but no WM_SIZING/WM_MOVING arrives until the user moves
+// the mouse. That loop pumps application tasks (including Mojo IPCs from
+// renderers), so IsInNativeMoveResizeLoop() must already report true at
+// WM_ENTERSIZEMOVE. Otherwise a task running in the gap sees false and can
+// start an OS-level drag while the user is holding a resize border.
+TEST_F(DesktopWindowTreeHostWinTest, IsInNativeMoveResizeLoopOnEnterSizeMove) {
+  Widget widget;
+  widget.Init(CreateParams(Widget::InitParams::CLIENT_OWNS_WIDGET,
+                           Widget::InitParams::TYPE_WINDOW));
+  widget.Show();
+
+  DesktopWindowTreeHostWin* host = static_cast<DesktopWindowTreeHostWin*>(
+      widget.GetNativeWindow()->GetHost());
+  EXPECT_FALSE(host->IsInNativeMoveResizeLoop());
+
+  HWND hwnd = widget.GetNativeWindow()->GetHost()->GetAcceleratedWidget();
+
+  // The user has pressed the mouse on a resize border. Windows has entered the
+  // modal loop, but the mouse has not moved yet.
+  ::SendMessage(hwnd, WM_ENTERSIZEMOVE, 0, 0);
+  EXPECT_TRUE(host->IsInNativeMoveResizeLoop());
+
+  // The user now drags, producing the first WM_SIZING.
+  RECT rect = {};
+  ::GetWindowRect(hwnd, &rect);
+  ::SendMessage(hwnd, WM_SIZING, WMSZ_RIGHT, reinterpret_cast<LPARAM>(&rect));
+  EXPECT_TRUE(host->IsInNativeMoveResizeLoop());
+
+  ::SendMessage(hwnd, WM_EXITSIZEMOVE, 0, 0);
+  EXPECT_FALSE(host->IsInNativeMoveResizeLoop());
+}
+
 }  // namespace test
 }  // namespace views