[315:315:0413/110204.399255:INFO:CONSOLE:14] "[poc] iframe loaded, contentWindow present", source: http://127.0.0.1:8765/poc.html (14) [315:315:0413/110204.408727:INFO:CONSOLE:14] "[poc] calling svgScript.moveBefore(textNode, null) ...", source: http://127.0.0.1:8765/poc.html (14) [315:315:0413/110204.413230:INFO:CONSOLE:2] "[poc] >>> attacker JS running inside moveBefore() <<<", source: (2) [315:315:0413/110204.413442:INFO:CONSOLE:7] "[poc] iframe detached during atomic move; contentWindow=LIVE", source: (7) [315:315:0413/110204.413637:INFO:CONSOLE:14] "[poc] moveBefore returned; __ranInsideMoveBefore=true", source: http://127.0.0.1:8765/poc.html (14) [315:315:0413/110204.413769:INFO:CONSOLE:14] "[poc] detached iframe still has live contentWindow: YES (frame teardown was skipped!)", source: http://127.0.0.1:8765/poc.html (14) [315:315:0413/110204.413916:INFO:CONSOLE:14] "[poc] re-inserting iframe (flag now cleared) -> SECURITY_CHECK should fail", source: http://127.0.0.1:8765/poc.html (14) [392:392:0413/110204.411828:FATAL:third_party/blink/renderer/core/html/html_frame_element_base.cc:185] Security CHECK failed: !ContentFrame() || GetDocument().StatePreservingAtomicMoveInProgress(). #0 0x559bb31cf9f6 (/chromium/chromium/src/out/asan/chrome+0x10d769f5) #1 0x559bcb3e3a98 (/chromium/chromium/src/out/asan/chrome+0x28f8aa97) #2 0x559bcb3a1327 (/chromium/chromium/src/out/asan/chrome+0x28f48326) #3 0x559bcb0a8dd5 (/chromium/chromium/src/out/asan/chrome+0x28c4fdd4) #4 0x559bcb0aa939 (/chromium/chromium/src/out/asan/chrome+0x28c51938) #5 0x559bd94e7fd4 (/chromium/chromium/src/out/asan/chrome+0x3708efd3) #6 0x559bd94de42b (/chromium/chromium/src/out/asan/chrome+0x3708542a) #7 0x559bdc1675d3 (/chromium/chromium/src/out/asan/chrome+0x39d0e5d2) #8 0x559bdc16123f (/chromium/chromium/src/out/asan/chrome+0x39d0823e) #9 0x559bdc15c68e (/chromium/chromium/src/out/asan/chrome+0x39d0368d) #10 0x559bdd1b849a (/chromium/chromium/src/out/asan/chrome+0x3ad5f499) #11 0x559bbe1726e4 (/chromium/chromium/src/out/asan/chrome+0x1bd196e3) Task trace: #0 0x559bdc524d58 (/chromium/chromium/src/out/asan/chrome+0x3a0cbd57) #1 0x559bceef6df8 (/chromium/chromium/src/out/asan/chrome+0x2ca9ddf7) Crash keys: "view-count" = "1" "loaded-origin-0" = "http://127.0.0.1:8765" "web-frame-count" = "2" "gpu-generation-intel" = "0" "gpu_count" = "0" "gpu-devid" = "0x0000" "gpu-venid" = "0x0000" "renderer_foreground" = "true" "v8_ro_space_firstpage_address" = "0x79fc00000000" "v8_isolate_address" = "0x7e684ec45000" "variations" = "1db03297-3f4a17df,b1755f03-e38596b7,c203d55b-3f4a17df,cf16e290-b446100,a66dbd64-71c38a98,102166ac-3f4a17df,f7adf49b-3f4a17df,b13ca3d9-84f6cff8,32806e4f-28ea5088,2468d6e5-3f4a17df,f5a1eb9a-3f4a17df,ac59e11a-3f4a17df,8f6c5cc6-3f4a17df,d6284ba0-9610fd4e,73551ca1-3f4a17df,d6737162-3f4a17df,e35cc1a-3f4a17df,e5a1483c-3f4a17df,6a68c9a6-3f4a17df,c1531af3-3f4a17df,7b46cc51-3f4a17df,af00e384-3f4a17df,8f80c10-78198108,a4ca7cb1-3f4a17df,ae727645-d13781e7,e435811b-3f4a17df,ec937206-3f4a17df,cad2b12b-8ef57898,57d6085b-3f4a17df,d6ad7f9a-a9080253,9507cc99-f2018abe,a5ecfb95-3f4a17df,29936542-3f4a17df,f419bc72-3f4a17df,470d37ba-3f4a17df,f7d06457-e9d42fcd,bcb58f65-3f4a17df,d512da3a-513c429d,600d2fa6-3f4a17df,c3eea944-28305c10,bca7ba0b-8cb78501,40355e18-3f4a17df,ff1e0777-3f4a17df,b6083631-447a6f32,d7af3875-3f4a17df,4dc2f223-3f4a17df,5133eb43-307b98b1,f314f5b9-a2b13a7f,6e4a21fe-efc28565,531e1626-4513f3bf,820f17d2-e484eeec,40debc11-3f4a17df,44666d99-3d47f4f4,e14ee5ee-c6d6098d,a98def31-2a5a8f5d,284a13f5-3f4a17df,8f9d758f-3f4a17df,fc1790de-3f4a17df,35c106c9-3f4a17df,639ee5d3-3f4a17df,7dcaa2cd-3f4a17df,57d26b38-3f4a17df,f6f5c542-3f4a17df,3779be93-3f4a17df,305240ad-3f4a17df,3b02c079-3f4a17df,669a7db8-3f4a17df,a028f288-d24710ce,4eb998ce-3f4a17df,9d5ecd8d-ca7d8d80,3e15bfc6-3f4a17df,779782d3-3f4a17df,e1d656a5-3f4a17df,ef3132a9-3f4a17df,87bc8a34-3f4a17df,96def758-3f4a17df,2d3e25b-3f4a17df,f4159b43-3f4a17df,151258bf-3f4a17df,5dfc4774-3f4a17df,893cc7a4-3f4a17df,3c978b59-3f4a17df,9cf6c713-7585e9f1,4ab30a87-c9361ef3,22946be1-22946be1,6ddea229-6ddea229,d4daab79-3f4a17df,acf2401-ec6cb59a,96d006a-c3a49e71,c17129bb-3f4a17df,74be468c-3f4a17df,4146cc26-775f6248,e9844d40-3f4a17df,d1ae5bf4-3f4a17df,e1f2626b-3f4a17df,55cc39e1-3f4a17df,ba449693-9e1c16d0,cad46b80-3f4a17df,70404afa-803f8fc4,fc9ceed7-ee2a48b4,4af38a69-3c635604,b0b97cfb-3f4a17df,66657049-3f4a17df,36860c1b-3f4a17df,7262ef2c-140d00b2,f93c9364-3f4a17df,9e5c75f1-30e1b12b,4d625646-3f4a17df,ec3153de-3f4a17df,2394f90f-ecc8f8cf,d5f746a4-39aaf314,3a3c323e-3f4a17df,56aa5797-e5fec5a6,54be7848-3f4a17df,3ee33b62-3f4a17df,da493d3c-3f4a17df,72bafd3e-cdb4c186,f659c5ca-3f4a17df,f3ed486d-3f4a17df,81c84cff-6154888c,4076100b-3f4a17df,8c162025-3d47f4f4,9f8a0fd2-b4a3cd0c,ffdf4988-3f4a17df,3d3963fc-5d65cee9,3ac9fcb9-3f4a17df,b446c562-3f4a17df,63831cab-3f4a17df,d2a642a0-3f4a17df,7ece8311-3f4a17df,7a32e64e-3f4a17df,8579ead7-3f4a17df,f108c955-3f4a17df,10713630-3f4a17df,8f418b04-299bae22,d3566fbd-c6f74b94,d06639a1-3f4a17df,2e862394-fb669628,a2f28ef8-d7d235fa,5abe5347-3f4a17df,40e3c61f-3f4a17df,d5ce1427-3f4a17df,1339c0d9-3f4a17df,4fa4e3b8-3f4a17df,44fe0078-3f4a17df,c92d2cc4-3f4a17df,2468be5e-5f6398dc,aa540f4f-3f4a17df,30cf4980-61673e6,43395eb-3f4a17df,e6ec9393-3f4a17df,ea0d881d-fd860968,3f752d-3f4a17df,53c64de7-3f4a17df,89bba52e-174ae9a8,444b9649-3f4a17df,a374fdf0-964ff297,5e2ea1a-3f4a17df,c71292e0-3f4a17df,ef4764d7-88fcaf7d,b360dba0-3f4a17df,404dfb1f-3f4a17df,94b88ba6-7e2e67c9,f3dbf5bd-faff9ce0,15607410-b6e8dbb7,ab917364-25c84d73,8018a043-3f4a17df,ad4acdda-3f4a17df,90860314-5ab828e2,b1ceb06f-3f4a17df,a39574eb-3f4a17df,46ca825f-3f4a17df,f8b97b53-3f4a17df,72b751de-3f4a17df,db59f83a-3f4a17df,80b60e4a-3f4a17df,9cdd2223-3f4a17df,c5be9d88-3f4a17df,39a2e568-3f4a17df,7f8767fe-3f4a17df,e0e211ad-e0e211ad,5eaac78e-3f4a17df,2f95a72f-3f4a17df,8abceefd-f7ec9f66,c55491ea-156838e5,1caa3332-20af8ffe,6a6ab26-faa329bf,c21c2b8b-3d47f4f4,e32097a3-3f4a17df,17f1f5fe-3f4a17df,a62c052e-3f4a17df,da968c94-3f4a17df,54d601a5-3f4a17df,91cba98-b3b3bb94,36f4e102-3f4a17df,2b68be8f-3f4a17df,7ca2dd7e-3f4a17df,c823d1e9-3d47f4f4,e2d38844-3f4a17df,afeeb5d0-3f4a17df,19e446cd-3f4a17df,f613598-3f4a17df,40de0170-3f4a17df,25a81d51-3f4a17df,613081e8-3f4a17df,c49d2b35-3f4a17df,d00bdbf9-3f4a17df,2faf225b-3f4a17df,74d4bce7-3d47f4f4,5fd6ae8b-3f4a17df,2f6246c2-3f4a17df,bea4a9c2-750ef675,51d22fd4-3f4a17df,2a2ebc2c-3f4a17df,7b4be1f2-3d47f4f4,f585af0a-3f4a17df,eef5d69a-1dca273f,6332ffaf-3f4a17df,5e19e3dc-f800d222,aa8204ea-3f4a17df,595f5eb0-f23d1dea,5910121-3f4a17df,f9a6f6e9-3f4a17df,377002b7-3f4a17df,31f4a8bd-3f4a17df,935eb749-7a935877,d0083347-3ec702d4,fecdbadb-3f4a17df,b76b514f-3ac589b9,15d1b2d8-3f4a17df,fb92da45-3f4a17df,bf46f37a-3f4a17df,6ec84df5-3f4a17df,e3559213-c0f46cd5,aaa52086-d50cce67,de028327-70abd7a5,3d9fe79-3f4a17df,a3ce8da1-3f4a17df,98ab2bc2-b6dc7ce0,89986dbe-3f01b610,2bac45ad-3f4a17df,5e05ef36-3f4a17df,2d2b187a-3f4a17df,ff7d412f-3f4a17df,b4c2bd17-23db2647,1f70f502-3f4a17df,350559e5-3f4a17df,ea6b5a9c-3f4a17df,f6264095-c3f8eab0,186d6e2c-36c0e608,797fe373-3f4a17df,e6ed801e-cf4f6ead,fd051c38-3f4a17df,ab7eb98c-3f4a17df,b3c54bb3-88fcaf7d,78049c75-f7dfe51d,f1d165c0-3f4a17df,17a43872-3f4a17df,8643cb65-cf4f6ead,80a04e6b-3d47f4f4,7ccab089-3f4a17df,f86bc1e2-3f4a17df,3e672fd9-e109e63f,47a0a3b2-3f4a17df,13e8c923-3f4a17df,89a375de-3f4a17df,f2b6a878-3f4a17df,85b000a2-d93a0620,bb199083-3f4a17df,94e21eca-3f4a17df,6222c570-3f4a17df,a14eecea-3f4a17df,5870a003-3f4a17df,2ca06d17-3f4a17df,84b4fc65-3f4a17df,1b0dc97-3f4a17df,52a20523-3f4a17df,63f121e7-3f4a17df,bfc33382-3f4a17df,3797f84b-3f4a17df,6ff79bbe-3f4a17df,bef5c006-3f4a17df,c1e0d32e-3f4a17df,1ffefb1a-3f4a17df,18324944-3f4a17df,e9854fc-2e12b55,ed2195eb-3f4a17df,f3b6291d-7fa80c0f,ead3e59e-8c7df51c,2cc36617-3f4a17df,ff6056ba-3f4a17df,f4f00e05-ca7d8d80,9481ce98-3d47f4f4,2a426c03-3d47f4f4,70678518-dee66fa8,be338734-dee66fa8,5f9907a9-dee66fa8,8eeccb9a-dee66fa8,2b465683-dee66fa8,52fc7926-dee66fa8,bc9b361d-dee66fa8,a41a7188-dee66fa8,ff71bfdc-dee66fa8,251fc742-dee66fa8,2159dd0c-dee66fa8,e7cc79d5-dee66fa8,4b935545-bb2d3403,9a38bae3-3d47f4f4,2d1e43a3-3d47f4f4,386dc267-3d47f4f4,d69d967d-4866ef6e,a4406b35-1657e2d6,408da146-1657e2d6," "num-experiments" = "313" "reentry_guard_tls_slot" = "unused" "switch-19" = "--trace-process-track-uuid=3190708990997080739" "switch-18" = "--pseudonymization-salt-handle=7,i,3901750837414608651,110039614" "switch-17" = "--variations-seed-version" "switch-16" = "--field-trial-handle=3,i,2304753110506386746,1331596938022247987" "switch-15" = "--shared-files=v8_context_snapshot_data:100" "switch-14" = "--launch-time-ticks=150402402915" "switch-13" = "--time-ticks-at-unix-epoch=-1775927720986130" "switch-12" = "--renderer-client-id=5" === poc-bypass.html (SECURITY_CHECK bypass, no crash) === [462:462:0413/110809.499932:INFO:CONSOLE:1] "[poc-bypass] script running inside moveBefore()", source: (1) [462:462:0413/110809.500082:INFO:CONSOLE:4] "[poc-bypass] removed; contentWindow LIVE", source: (4) [462:462:0413/110809.500183:INFO:CONSOLE:6] "[poc-bypass] re-inserted into B with live ContentFrame; SECURITY_CHECK bypassed", source: (6) [462:462:0413/110809.506709:INFO:CONSOLE:11] "[poc-bypass] moveBefore returned; bypass=true parent=containerB contentWindow=LIVE", source: http://127.0.0.1:8765/poc-bypass.html (11) [462:462:0413/110809.511009:INFO:CONSOLE:11] "[poc-bypass] survived layout; iframe re-parented with stale live LocalFrame (security invariant violated)", source: http://127.0.0.1:8765/poc-bypass.html (11) [462:477:0413/110812.931120:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: PHONE_REGISTRATION_ERROR [462:477:0413/110812.933005:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: PHONE_REGISTRATION_ERROR