[7392:7392:0404/092650.453405:ERROR:chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc:1516] [FSA-POC] ==== begin stale downgraded_read_paths POC ==== [7392:7392:0404/092650.453725:ERROR:chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc:1525] [FSA-POC] (1) after picker: read=GRANTED write=GRANTED (expect GRANTED/GRANTED) [7392:7392:0404/092650.453865:ERROR:chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc:1531] [FSA-POC] (2) after remove(): downgraded_read_paths contains path = 1 [7392:7392:0404/092650.453949:ERROR:chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc:1538] [FSA-POC] (3) after RevokeGrants(): read=ASK write=ASK (expect ASK/ASK) [7392:7392:0404/092650.454045:ERROR:chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc:1545] [FSA-POC] (3) downgraded_read_paths STILL contains path = 1 <-- BUG part 1 if true [7392:7392:0404/092650.454083:ERROR:chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc:1551] [FSA-POC] (4) session-1 handles dropped; OriginState (and its stale downgraded_read_paths) persists because active_permissions_map_.erase() is never called: 1 [7392:7392:0404/092650.454183:ERROR:chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc:1563] [FSA-POC] (5) after IDB load: read=ASK write=ASK (expect ASK/ASK) [7392:7392:0404/092650.454294:ERROR:chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc:1577] [FSA-POC] (6) user approved WRITE-ONLY prompt: read=ASK write=GRANTED (expect ASK/GRANTED) [7392:7392:0404/092650.454459:ERROR:chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc:1588] [FSA-POC] (7) after writer.close(): read=GRANTED write=GRANTED [7392:7392:0404/092650.454488:ERROR:chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc:1592] [FSA-POC] *** VULNERABILITY CONFIRMED *** [7392:7392:0404/092650.454527:ERROR:chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc:1594] [FSA-POC] User explicitly revoked all permissions in (3) and only [7392:7392:0404/092650.454781:ERROR:chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc:1596] [FSA-POC] approved WRITE in (6), yet the origin now silently holds [7392:7392:0404/092650.454803:ERROR:chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc:1598] [FSA-POC] READ permission (GRANTED) on /tmp/fsa-poc-target.txt [7392:7392:0404/092650.454829:ERROR:chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc:1604] [FSA-POC] ==== end POC ====