Medium chrome Logic Error 📄 Reporter bug report 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInappropriate implementation in Fullscreen
DescriptionInappropriate implementation in Fullscreen
ComponentFullscreen
Bug ClassLogic Error
Tracker40067914
Fix commit92bebd7aaa77 (chromium/src) +32/-2
CISA KEVNot listed
CreditedUmar Farooq
Disclosed2025-01-14

Changed Functions

FunctionChangeNotes
IN_PROC_BROWSER_TEST_F
chrome/browser/webshare/share_service_browsertest.cc
modified
SafeBrowsingShareServiceBrowserTest
chrome/browser/webshare/share_service_browsertest.cc
modified

Files Changed

  • chrome/browser/webshare/share_service_browsertest.cc
  • chrome/browser/webshare/share_service_impl.cc
From 92bebd7aaa776384c1a62b1814ce8de1ab90ea75 Mon Sep 17 00:00:00 2001
From: Hoch Hochkeppel <mhochk@microsoft.com>
Date: Fri, 18 Oct 2024 23:07:16 +0000
Subject: [PATCH] Exit fullscreen on Windows for navigator.share

The 'Share' experience on Windows is designed with a windowed
experience in mind, and results in unintuitive behaviors when invoked
from a fullscreen context. To mitigate any risks from these behaviors,
and to ensure the optimal user experience, this change ensures that
fullscreen is exited prior to starting the Windows portion of the
'Share' flow.

Bug: 40067914
Change-Id: I36af174544f738965e988e8d0fb4b29349cad8c5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5938489
Reviewed-by: Daniel Murphy <dmurph@chromium.org>
Commit-Queue: Hoch Hochkeppel <mhochk@microsoft.com>
Reviewed-by: Amanda Baker <ambake@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#1370877}
---

diff --git a/chrome/browser/webshare/share_service_browsertest.cc b/chrome/browser/webshare/share_service_browsertest.cc
index 1c4f45a..e6a131f 100644
--- a/chrome/browser/webshare/share_service_browsertest.cc
+++ b/chrome/browser/webshare/share_service_browsertest.cc
@@ -108,6 +108,27 @@
                                      WebShareMethod::kShare, kRepeats);
 }
 
+#if BUILDFLAG(IS_WIN)
+IN_PROC_BROWSER_TEST_F(ShareServiceBrowserTest, Fullscreen) {
+  base::HistogramTester histogram_tester;
+  ASSERT_TRUE(embedded_test_server()->Start());
+  ASSERT_TRUE(ui_test_utils::NavigateToURL(
+      browser(), embedded_test_server()->GetURL("/webshare/index.html")));
+  content::WebContents* const web_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+
+  ui_test_utils::FullscreenWaiter waiter(browser(), {.tab_fullscreen = true});
+  EXPECT_TRUE(
+      content::ExecJs(web_contents, "document.body.requestFullscreen();"));
+  waiter.Wait();
+  ASSERT_TRUE(web_contents->IsFullscreen());
+
+  EXPECT_EQ("share succeeded",
+            content::EvalJs(web_contents, "share_text('hello')"));
+  EXPECT_FALSE(web_contents->IsFullscreen());
+}
+#endif  // BUILDFLAG(IS_WIN)
+
 class SafeBrowsingShareServiceBrowserTest : public ShareServiceBrowserTest {
  public:
   SafeBrowsingShareServiceBrowserTest()
diff --git a/chrome/browser/webshare/share_service_impl.cc b/chrome/browser/webshare/share_service_impl.cc
index 83195cd7..f174b4bb 100644
--- a/chrome/browser/webshare/share_service_impl.cc
+++ b/chrome/browser/webshare/share_service_impl.cc
@@ -282,6 +282,12 @@
          blink::mojom::ShareError result) { std::move(callback).Run(result); },
       std::move(sharing_service_operation), std::move(callback)));
 #elif BUILDFLAG(IS_WIN)
+  // Drop fullscreen mode so the Share UI can be easily clicked away from,
+  // without clicking back into the web contents
+  base::ScopedClosureRunner fullscreen_block =
+      web_contents->ForSecurityDropFullscreen(
+          /*display_id=*/display::kInvalidDisplayId);
+
   auto share_operation = std::make_unique<webshare::ShareOperation>(
       title, text, share_url, web_contents);
   auto* const share_operation_ptr = share_operation.get();
@@ -289,10 +295,13 @@
       std::move(files),
       base::BindOnce(
           [](std::unique_ptr<webshare::ShareOperation> share_operation,
-             ShareCallback callback, blink::mojom::ShareError result) {
+             base::ScopedClosureRunner fullscreen_block, ShareCallback callback,
+             blink::mojom::ShareError result) {
+            fullscreen_block.RunAndReset();
             std::move(callback).Run(result);
           },
-          std::move(share_operation), std::move(callback)));
+          std::move(share_operation), std::move(fullscreen_block),
+          std::move(callback)));
 #else
   NOTREACHED_IN_MIGRATION();
   std::move(callback).Run(blink::mojom::ShareError::INTERNAL_ERROR);
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/chrome/browser/webshare/share_service_browsertest.cc b/chrome/browser/webshare/share_service_browsertest.cc
index 1c4f45a..e6a131f 100644
--- a/chrome/browser/webshare/share_service_browsertest.cc
+++ b/chrome/browser/webshare/share_service_browsertest.cc
@@ -108,6 +108,27 @@
                                      WebShareMethod::kShare, kRepeats);
 }
 
+#if BUILDFLAG(IS_WIN)
+IN_PROC_BROWSER_TEST_F(ShareServiceBrowserTest, Fullscreen) {
+  base::HistogramTester histogram_tester;
+  ASSERT_TRUE(embedded_test_server()->Start());
+  ASSERT_TRUE(ui_test_utils::NavigateToURL(
+      browser(), embedded_test_server()->GetURL("/webshare/index.html")));
+  content::WebContents* const web_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+
+  ui_test_utils::FullscreenWaiter waiter(browser(), {.tab_fullscreen = true});
+  EXPECT_TRUE(
+      content::ExecJs(web_contents, "document.body.requestFullscreen();"));
+  waiter.Wait();
+  ASSERT_TRUE(web_contents->IsFullscreen());
+
+  EXPECT_EQ("share succeeded",
+            content::EvalJs(web_contents, "share_text('hello')"));
+  EXPECT_FALSE(web_contents->IsFullscreen());
+}
+#endif  // BUILDFLAG(IS_WIN)
+
 class SafeBrowsingShareServiceBrowserTest : public ShareServiceBrowserTest {
  public:
   SafeBrowsingShareServiceBrowserTest()
Loading diff…

Original Bug Report

reported by pu...@gmail.com

Security: [Esc] KeyPress Does Not Work in FullScreen While navigator.share Is Active

VULNERABILITY DETAILS

We Can Prevent [Esc] KeyPress in Full Screen Mode Using navigator.share

VERSION
Chrome Version: [115.0.5790.99] + [stable]
Operating System: [Windows 10]

REPRODUCTION CASE

  1. Open PocIndex.html
  2. Double Click [Click Me!] button
  3. Done

CREDIT INFORMATION
Reporter credit: Umar Farooq

View on issue tracker