[.] Sanitizer coverage enabled. Counter map size: 11276665, Cmp map size: 262144 Note: Google Test filter = WebViewNewWindowTest.SECURITY_CrossProcessOwnershipTransferBypass/InnerWebContents [==========] Running 1 test from 1 test suite. [----------] Global test environment set-up. [----------] 1 test from WebViewNewWindowTest [ RUN ] WebViewNewWindowTest.SECURITY_CrossProcessOwnershipTransferBypass/InnerWebContents [.] Sanitizer coverage enabled. Counter map size: 11276665, Cmp map size: 262144 [.] Sanitizer coverage enabled. Counter map size: 11276665, Cmp map size: 262144 Gtk-Message: 17:36:49.362: Failed to load module "canberra-gtk-module" Gtk-Message: 17:36:49.367: Failed to load module "canberra-gtk-module" [16092:16109:0402/173649.440001:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [16092:16109:0402/173649.440413:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [16092:16109:0402/173649.440630:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [16092:16109:0402/173649.440793:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [16092:16109:0402/173649.751863:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [16092:16109:0402/173649.911053:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [.] Sanitizer coverage enabled. Counter map size: 11276665, Cmp map size: 262144 (browser_tests:16092): dbind-WARNING **: 17:36:50.070: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/229127/at-spi/bus_20: No such file or directory [16092:16109:0402/173650.246992:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [16092:16109:0402/173650.247374:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [16126:16126:0402/173650.443589:WARNING:sandbox/policy/linux/sandbox_linux.cc:404] InitializeSandbox() called with multiple threads in process gpu-process. [16126:16126:0402/173650.473665:WARNING:ui/gfx/linux/gbm_support_x11.cc:48] dri3 extension not supported. [16092:16092:0402/173650.977442:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [16092:16092:0402/173650.977747:WARNING:device/bluetooth/dbus/bluez_dbus_manager.cc:209] Floss manager service not available, cannot set Floss enable/disable. [16092:16109:0402/173650.978061:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [16092:16092:0402/173651.013594:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [16092:16092:0402/173651.043693:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [16092:16109:0402/173651.044437:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [16092:16109:0402/173651.213165:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [16092:16109:0402/173651.213493:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [16092:16092:0402/173651.213370:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [16092:16092:0402/173651.224802:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [16092:16109:0402/173651.225312:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [16092:16092:0402/173651.258819:WARNING:dbus/property.cc:94] Failed to connect to PropertiesChangedsignal. [16092:16092:0402/173651.259065:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.Properties.GetAll: object_path= /org/freedesktop/UPower/devices/DisplayDevice: unknown error type: [16092:16092:0402/173651.259114:WARNING:dbus/property.cc:174] GetAll request failed for: org.freedesktop.UPower.Device [16092:16092:0402/173651.281932:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [16092:16109:0402/173651.282548:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [16092:16092:0402/173651.327439:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [16092:16109:0402/173651.328021:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [16092:16092:0402/173651.422853:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [16092:16092:0402/173651.422937:WARNING:ui/base/idle/idle_linux.cc:111] None of the known D-Bus ScreenSaver services could be used. LaunchProcess: failed to execvp: xdg-desktop-menu LaunchProcess: failed to execvp: xdg-icon-resource LaunchProcess: failed to execvp: xdg-icon-resource LaunchProcess: failed to execvp: xdg-icon-resource LaunchProcess: failed to execvp: xdg-icon-resource LaunchProcess: failed to execvp: xdg-icon-resource LaunchProcess: failed to execvp: xdg-icon-resource LaunchProcess: failed to execvp: xdg-icon-resource [16092:16106:0402/173652.082070:WARNING:chrome/browser/web_applications/os_integration/web_app_shortcut_linux.cc:186] Could not install icon chrome-ndeecadiifkijphgdmgmfohooighklhb-Default.png at size 512. LaunchProcess: failed to execvp: xdg-desktop-menu [16092:16092:0402/173652.985593:ERROR:chrome/browser/apps/guest_view/web_view_browsertest.cc:2140] [POC] BEFORE NAV: owner_process=8 owner_origin=chrome-extension://ndeecadiifkijphgdmgmfohooighklhb owner_host=ndeecadiifkijphgdmgmfohooighklhb [16092:16092:0402/173653.146335:ERROR:chrome/browser/apps/guest_view/web_view_browsertest.cc:2172] [POC] AFTER NAV: owner_process=7 owner_origin=http://attacker.test:39101 owner_host=ndeecadiifkijphgdmgmfohooighklhb ../../chrome/browser/apps/guest_view/web_view_browsertest.cc:2183: Failure Expected equality of these values: original_owner_process_id Which is: 8 new_owner_process_id Which is: 7 [POC] *** BUG #1 *** owner_rfh_id_ was transferred to a cross-process RFH (was chrome-extension://ndeecadiifkijphgdmgmfohooighklhb in process 8, now http://attacker.test:39101 in process 7) Stack trace: #0 0x563958705bc5 (/chromium/chromium/src/out/asan/browser_tests+0x1d195bc4) #1 0x56397d1cda82 (/chromium/chromium/src/out/asan/browser_tests+0x41c5da81) #2 0x56397d1d37b2 (/chromium/chromium/src/out/asan/browser_tests+0x41c637b1) #3 0x56396e6fb7fb (/chromium/chromium/src/out/asan/browser_tests+0x3318b7fa) #4 0x56396e703d9d (/chromium/chromium/src/out/asan/browser_tests+0x33193d9c) #5 0x56396e6f261d (/chromium/chromium/src/out/asan/browser_tests+0x3318261c) #6 0x5639753d9a60 (/chromium/chromium/src/out/asan/browser_tests+0x39e69a5f) #7 0x5639753dda49 (/chromium/chromium/src/out/asan/browser_tests+0x39e6da48) #8 0x5639753dcedb (/chromium/chromium/src/out/asan/browser_tests+0x39e6ceda) #9 0x5639753d66d2 (/chromium/chromium/src/out/asan/browser_tests+0x39e666d1) #10 0x5639753d6ccd (/chromium/chromium/src/out/asan/browser_tests+0x39e66ccc) #11 0x56397d1cb801 (/chromium/chromium/src/out/asan/browser_tests+0x41c5b800) #12 0x563979e3cb0c (/chromium/chromium/src/out/asan/browser_tests+0x3e8ccb0b) ../../chrome/browser/apps/guest_view/web_view_browsertest.cc:2196: Failure Expected: (original_owner_host) != (unattached_guest->owner_host()), actual: "ndeecadiifkijphgdmgmfohooighklhb" vs "ndeecadiifkijphgdmgmfohooighklhb" [POC] *** BUG #2 *** owner_host_ still contains extension ID 'ndeecadiifkijphgdmgmfohooighklhb' after cross-process transfer — SetOwnerHost() was never called Stack trace: #0 0x563958705f03 (/chromium/chromium/src/out/asan/browser_tests+0x1d195f02) #1 0x56397d1cda82 (/chromium/chromium/src/out/asan/browser_tests+0x41c5da81) #2 0x56397d1d37b2 (/chromium/chromium/src/out/asan/browser_tests+0x41c637b1) #3 0x56396e6fb7fb (/chromium/chromium/src/out/asan/browser_tests+0x3318b7fa) #4 0x56396e703d9d (/chromium/chromium/src/out/asan/browser_tests+0x33193d9c) #5 0x56396e6f261d (/chromium/chromium/src/out/asan/browser_tests+0x3318261c) #6 0x5639753d9a60 (/chromium/chromium/src/out/asan/browser_tests+0x39e69a5f) #7 0x5639753dda49 (/chromium/chromium/src/out/asan/browser_tests+0x39e6da48) #8 0x5639753dcedb (/chromium/chromium/src/out/asan/browser_tests+0x39e6ceda) #9 0x5639753d66d2 (/chromium/chromium/src/out/asan/browser_tests+0x39e666d1) #10 0x5639753d6ccd (/chromium/chromium/src/out/asan/browser_tests+0x39e66ccc) #11 0x56397d1cb801 (/chromium/chromium/src/out/asan/browser_tests+0x41c5b800) #12 0x563979e3cb0c (/chromium/chromium/src/out/asan/browser_tests+0x3e8ccb0b) ../../chrome/browser/apps/guest_view/web_view_browsertest.cc:2212: Failure Expected equality of these values: nullptr Which is: NULL lookup_result Which is: 0x7d43b9411a80 [POC] *** BUG #3 *** CanEmbedderAccessInstanceID PASSED for cross-origin web process 7 — a compromised renderer at this origin can now AttachToEmbedderFrame and hijack the guest with extension-keyed StoragePartition Stack trace: #0 0x563958706087 (/chromium/chromium/src/out/asan/browser_tests+0x1d196086) #1 0x56397d1cda82 (/chromium/chromium/src/out/asan/browser_tests+0x41c5da81) #2 0x56397d1d37b2 (/chromium/chromium/src/out/asan/browser_tests+0x41c637b1) #3 0x56396e6fb7fb (/chromium/chromium/src/out/asan/browser_tests+0x3318b7fa) #4 0x56396e703d9d (/chromium/chromium/src/out/asan/browser_tests+0x33193d9c) #5 0x56396e6f261d (/chromium/chromium/src/out/asan/browser_tests+0x3318261c) #6 0x5639753d9a60 (/chromium/chromium/src/out/asan/browser_tests+0x39e69a5f) #7 0x5639753dda49 (/chromium/chromium/src/out/asan/browser_tests+0x39e6da48) #8 0x5639753dcedb (/chromium/chromium/src/out/asan/browser_tests+0x39e6ceda) #9 0x5639753d66d2 (/chromium/chromium/src/out/asan/browser_tests+0x39e666d1) #10 0x5639753d6ccd (/chromium/chromium/src/out/asan/browser_tests+0x39e66ccc) #11 0x56397d1cb801 (/chromium/chromium/src/out/asan/browser_tests+0x41c5b800) #12 0x563979e3cb0c (/chromium/chromium/src/out/asan/browser_tests+0x3e8ccb0b) [ FAILED ] WebViewNewWindowTest.SECURITY_CrossProcessOwnershipTransferBypass/InnerWebContents, where GetParam() = false (5825 ms) [----------] 1 test from WebViewNewWindowTest (5825 ms total) [----------] Global test environment tear-down [==========] 1 test from 1 test suite ran. (5827 ms total) [ PASSED ] 0 tests. [ FAILED ] 1 test, listed below: [ FAILED ] WebViewNewWindowTest.SECURITY_CrossProcessOwnershipTransferBypass/InnerWebContents, where GetParam() = false 1 FAILED TEST