Chrome · Fullscreen
CVE-2025-0440
Logic Error in Fullscreen
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
IN_PROC_BROWSER_TEST_Fchrome/browser/webshare/share_service_browsertest.cc |
modified | |
SafeBrowsingShareServiceBrowserTestchrome/browser/webshare/share_service_browsertest.cc |
modified |
Files Changed
chrome/browser/webshare/share_service_browsertest.ccchrome/browser/webshare/share_service_impl.cc
Patch
From 92bebd7aaa776384c1a62b1814ce8de1ab90ea75 Mon Sep 17 00:00:00 2001
From: Hoch Hochkeppel <mhochk@microsoft.com>
Date: Fri, 18 Oct 2024 23:07:16 +0000
Subject: [PATCH] Exit fullscreen on Windows for navigator.share
The 'Share' experience on Windows is designed with a windowed
experience in mind, and results in unintuitive behaviors when invoked
from a fullscreen context. To mitigate any risks from these behaviors,
and to ensure the optimal user experience, this change ensures that
fullscreen is exited prior to starting the Windows portion of the
'Share' flow.
Bug: 40067914
Change-Id: I36af174544f738965e988e8d0fb4b29349cad8c5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5938489
Reviewed-by: Daniel Murphy <dmurph@chromium.org>
Commit-Queue: Hoch Hochkeppel <mhochk@microsoft.com>
Reviewed-by: Amanda Baker <ambake@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#1370877}
---
diff --git a/chrome/browser/webshare/share_service_browsertest.cc b/chrome/browser/webshare/share_service_browsertest.cc
index 1c4f45a..e6a131f 100644
--- a/chrome/browser/webshare/share_service_browsertest.cc
+++ b/chrome/browser/webshare/share_service_browsertest.cc
@@ -108,6 +108,27 @@
WebShareMethod::kShare, kRepeats);
}
+#if BUILDFLAG(IS_WIN)
+IN_PROC_BROWSER_TEST_F(ShareServiceBrowserTest, Fullscreen) {
+ base::HistogramTester histogram_tester;
+ ASSERT_TRUE(embedded_test_server()->Start());
+ ASSERT_TRUE(ui_test_utils::NavigateToURL(
+ browser(), embedded_test_server()->GetURL("/webshare/index.html")));
+ content::WebContents* const web_contents =
+ browser()->tab_strip_model()->GetActiveWebContents();
+
+ ui_test_utils::FullscreenWaiter waiter(browser(), {.tab_fullscreen = true});
+ EXPECT_TRUE(
+ content::ExecJs(web_contents, "document.body.requestFullscreen();"));
+ waiter.Wait();
+ ASSERT_TRUE(web_contents->IsFullscreen());
+
+ EXPECT_EQ("share succeeded",
+ content::EvalJs(web_contents, "share_text('hello')"));
+ EXPECT_FALSE(web_contents->IsFullscreen());
+}
+#endif // BUILDFLAG(IS_WIN)
+
class SafeBrowsingShareServiceBrowserTest : public ShareServiceBrowserTest {
public:
SafeBrowsingShareServiceBrowserTest()
diff --git a/chrome/browser/webshare/share_service_impl.cc b/chrome/browser/webshare/share_service_impl.cc
index 83195cd7..f174b4bb 100644
--- a/chrome/browser/webshare/share_service_impl.cc
+++ b/chrome/browser/webshare/share_service_impl.cc
@@ -282,6 +282,12 @@
blink::mojom::ShareError result) { std::move(callback).Run(result); },
std::move(sharing_service_operation), std::move(callback)));
#elif BUILDFLAG(IS_WIN)
+ // Drop fullscreen mode so the Share UI can be easily clicked away from,
+ // without clicking back into the web contents
+ base::ScopedClosureRunner fullscreen_block =
+ web_contents->ForSecurityDropFullscreen(
+ /*display_id=*/display::kInvalidDisplayId);
+
auto share_operation = std::make_unique<webshare::ShareOperation>(
title, text, share_url, web_contents);
auto* const share_operation_ptr = share_operation.get();
@@ -289,10 +295,13 @@
std::move(files),
base::BindOnce(
[](std::unique_ptr<webshare::ShareOperation> share_operation,
- ShareCallback callback, blink::mojom::ShareError result) {
+ base::ScopedClosureRunner fullscreen_block, ShareCallback callback,
+ blink::mojom::ShareError result) {
+ fullscreen_block.RunAndReset();
std::move(callback).Run(result);
},
- std::move(share_operation), std::move(callback)));
+ std::move(share_operation), std::move(fullscreen_block),
+ std::move(callback)));
#else
NOTREACHED_IN_MIGRATION();
std::move(callback).Run(blink::mojom::ShareError::INTERNAL_ERROR);
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/chrome/browser/webshare/share_service_browsertest.cc b/chrome/browser/webshare/share_service_browsertest.cc
index 1c4f45a..e6a131f 100644
--- a/chrome/browser/webshare/share_service_browsertest.cc
+++ b/chrome/browser/webshare/share_service_browsertest.cc
@@ -108,6 +108,27 @@
WebShareMethod::kShare, kRepeats);
}
+#if BUILDFLAG(IS_WIN)
+IN_PROC_BROWSER_TEST_F(ShareServiceBrowserTest, Fullscreen) {
+ base::HistogramTester histogram_tester;
+ ASSERT_TRUE(embedded_test_server()->Start());
+ ASSERT_TRUE(ui_test_utils::NavigateToURL(
+ browser(), embedded_test_server()->GetURL("/webshare/index.html")));
+ content::WebContents* const web_contents =
+ browser()->tab_strip_model()->GetActiveWebContents();
+
+ ui_test_utils::FullscreenWaiter waiter(browser(), {.tab_fullscreen = true});
+ EXPECT_TRUE(
+ content::ExecJs(web_contents, "document.body.requestFullscreen();"));
+ waiter.Wait();
+ ASSERT_TRUE(web_contents->IsFullscreen());
+
+ EXPECT_EQ("share succeeded",
+ content::EvalJs(web_contents, "share_text('hello')"));
+ EXPECT_FALSE(web_contents->IsFullscreen());
+}
+#endif // BUILDFLAG(IS_WIN)
+
class SafeBrowsingShareServiceBrowserTest : public ShareServiceBrowserTest {
public:
SafeBrowsingShareServiceBrowserTest()
Loading diff…
Original Bug Report
reported by pu...@gmail.com
Security: [Esc] KeyPress Does Not Work in FullScreen While navigator.share Is Active
VULNERABILITY DETAILS
We Can Prevent [Esc] KeyPress in Full Screen Mode Using navigator.share
VERSION
Chrome Version: [115.0.5790.99] + [stable]
Operating System: [Windows 10]
REPRODUCTION CASE
- Open PocIndex.html
- Double Click [Click Me!] button
- Done
CREDIT INFORMATION
Reporter credit: Umar Farooq
References
On This Page