c9a9289d7a45ff7db4e785d809c4cd35df9f091d  [Connection-Allowlist] Fix crash on navigation-triggered downloads.

The bug at a glance

This is a browser-process NULL-pointer dereference in NetworkRestrictionsNavigationThrottle when a navigation has no RenderFrameHost (downloads, 204/205). It is a deterministic crash with no memory-corruption primitive and needs a page under the Connection-Allowlist policy, so it is low-severity DoS.

A page whose policy container carries connection allowlists could crash the whole browser by starting a download navigation (for example via window.open), which gives a cheap browser-wide DoS.

Root cause

MaybeApplyNetworkRestrictions assumed navigation_request.GetRenderFrameHost() was always non-null when it went on to apply connection allowlists to the document being committed. Navigations that become downloads or 204/205 responses never select a RenderFrameHost, so the later use dereferenced NULL. The fix returns kProceed early when no RFH is selected, because no document will be created.

Key code

Early-out for navigations that never commit a document (downloads, 204/205)

+  if (navigation_request.GetRenderFrameHost() == nullptr) {
+    return NetworkRestrictionsResult::kProceed;
+  }

Patch walkthrough

• content/browser/renderer_host/network_restrictions_navigation_throttle.cc — Adds a null check on the navigation’s RenderFrameHost before it defers the commit to apply network restrictions. Without it, download navigations crashed the browser process with a NULL dereference.

Background

Connection-Allowlist — Policy-container feature (connection_allowlists) that restricts which network endpoints a document may contact; the throttle applies it before commit.

NavigationThrottle — Browser-side hook that can proceed, defer or cancel a navigation at defined stages.

Download / 204 navigations — Navigations that never commit a document, so NavigationRequest has no selected RenderFrameHost.

Vulnerability window

1. Reachability — Ordinary web content, but only where the Connection-Allowlist feature applies, meaning the navigation’s policy container carries connection allowlists (likely a feature flag or origin trial; inferred).
2. Trigger — A navigation that becomes a download (the commit cites window.open) or gets HTTP 204/205 reaches the throttle with a null RenderFrameHost.
3. Primitive — NULL-pointer dereference in the browser process, causing a crash and no controllable memory access.

Proof of concept

Conceptually: from a context where connection allowlists are in effect, start a navigation whose response is treated as a download (or returns 204). The throttle then runs without a RenderFrameHost. No code is provided.

Exploitation

1. Crash — The browser process dereferences NULL and terminates, closing all tabs. Nothing beyond DoS is achievable from the diff.

Detection & hunting

For defenders and detection engineers:

• grep -n “GetRenderFrameHost()” content/browser//navigation_throttle.cc** — Find throttles that use the NavigationRequest’s RFH in WillProcessResponse/WillCommit without a null check.
• Crash stacks in NetworkRestrictionsNavigationThrottle::MaybeApplyNetworkRestrictions — Group with download or 204 navigation signals in crash reports.

Audit directions

• Other NavigationThrottles running at response time (downloads, 204/205, MHTML, PDF) — Check that each handles a null RenderFrameHost for navigations that never commit a document.