Chrome · Extensions › Platform>Extensions
CVE-2025-0446
Logic Error in Extensions (Platform>Extensions)
Low
watch
CVSS 4.3
chrome
Logic Error
📄 Reporter bug report
🔧 Commit mapped
🧬 Security UI spoofable via occlusion late-binding timing or geometry
Overview
Low
Severity
4.3
CVSS
No
Exploited ITW
Fixed
Fix Status
Background
- `extensions::SecurityDialogTracker`
- A singleton that records which
views::Widgetinstances are security-sensitive dialogs so the extension UI can avoid painting over them. - Extension bubble
- The
views::BubbleDialogDelegateViewthat a browser-action or page-action extension renders, which is normally z-ordered above other browser dialogs. - FedCM account selection dialog
- The WebID identity-provider account chooser rendered by
AccountSelectionBubbleViewandAccountSelectionModalView, used to authorize federated sign-in. - PWA install dialog
- The
PWAConfirmationBubbleViewprompt that asks the user to confirm installing a Progressive Web App.
Root Cause Analysis
When a FedCM account selection dialog or a PWA installation dialog was shown, its backing views::Widget was never registered with extensions::SecurityDialogTracker, so the tracker treated these prompts as ordinary, non-sensitive UI. Because the tracker is what suppresses extension bubbles from rendering above security-sensitive surfaces, an extension bubble could be painted on top of one of these dialogs and overlap or spoof its trusted contents. The security invariant that user-consequential confirmation dialogs must be occlusion-protected from extension-controlled UI was therefore violated for these two dialog families.
The fix restores the invariant by calling extensions::SecurityDialogTracker::GetInstance()->AddSecurityDialog() on each dialog’s widget at construction/show time, in PWAConfirmationBubbleView, AccountSelectionBubbleView, and AccountSelectionModalView. Once registered, the extension bubble logic refuses to draw above these widgets, so a malicious extension can no longer overlay them.
The fix works because it plugs the specific dialogs into the pre-existing occlusion-protection mechanism rather than changing the mechanism itself.
Key insight
The core mistake was that two high-stakes confirmation dialogs were simply never enrolled in the existing
extensions::SecurityDialogTracker protection, leaving them occludable by extension UI; the fix addresses it by registering each dialog’s views::Widget via AddSecurityDialog().Attack Path
- Install malicious extension A user installs an extension that has an action bubble it can display at will over the current browser window.
- Trigger a sensitive dialog The attacker (or a cooperating site) causes a FedCM account chooser or a PWA install prompt to appear, e.g. by initiating federated sign-in or an app install.
- Overlay the extension bubble The extension renders its bubble, which is z-ordered above the unprotected dialog because the dialog was never marked security-sensitive.
- Spoof or misdirect The overlay hides or alters portions of the trusted prompt, tricking the user into clicking a button (e.g. confirming sign-in or install) they did not intend.
- Consent captured The user’s misdirected interaction grants federated identity or installs an app, completing the deception.
Impact Assessment
An attacker with an installed extension gains the ability to visually spoof or occlude trusted browser confirmation dialogs, causing users to unknowingly approve federated sign-ins or PWA installations. The attack occurs in the browser-process UI layer and requires the victim to have installed the malicious extension and to encounter one of the affected dialogs. The gain is user deception and unintended consent rather than direct memory corruption, consistent with the LogicError / inappropriate-implementation classification.
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifchrome/browser/ui/views/webid/account_selection_bubble_view.cc |
modified |
Files Changed
chrome/browser/ui/views/web_apps/pwa_confirmation_bubble_view.ccchrome/browser/ui/views/webid/account_selection_bubble_view.ccchrome/browser/ui/views/webid/account_selection_modal_view.cc
Audit Directions
- Unregistered consequential dialogsEnumerate other confirmation, permission, or authentication dialogs (e.g. payment, permission prompts, download confirmations) and verify each calls
SecurityDialogTracker::AddSecurityDialog()on itsviews::Widget. - New dialog widget creation sitesAudit every
views::DialogDelegate::CreateDialogWidgetand bubble construction path introduced later to ensure security-sensitive prompts are enrolled at creation time, not left to default z-ordering. - Occlusion of trusted UI by extensionsReview any UI surface that extension-controlled bubbles, popups, or windows can be z-ordered above, checking whether that surface conveys a trust decision that could be spoofed.
Patch
From e0674d25b198c5240d276c9cb823bad1a67604d0 Mon Sep 17 00:00:00 2001
From: Keren Zhu <kerenzhu@chromium.org>
Date: Fri, 08 Nov 2024 19:22:50 +0000
Subject: [PATCH] Mark some dialogs as security-sensitive for extension
This CL marks the FedCM account selection dialog and the PWAs
installation dialog as security-sensitive for extensions. This
effectively prevents the extension bubble from rendering above these
dialogs, so that a malicious extension cannot trick users into
interacting with them.
Fixed: 376497151, 359949844
Change-Id: I74448a677523da74d83d1c05d5d5da8e0ee3b29c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5995850
Code-Coverage: findit-for-me@appspot.gserviceaccount.com <findit-for-me@appspot.gserviceaccount.com>
Commit-Queue: Keren Zhu <kerenzhu@chromium.org>
Reviewed-by: Allen Bauer <kylixrd@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1380525}
---
diff --git a/chrome/browser/ui/views/web_apps/pwa_confirmation_bubble_view.cc b/chrome/browser/ui/views/web_apps/pwa_confirmation_bubble_view.cc
index 0eb1638..04d932b 100644
--- a/chrome/browser/ui/views/web_apps/pwa_confirmation_bubble_view.cc
+++ b/chrome/browser/ui/views/web_apps/pwa_confirmation_bubble_view.cc
@@ -16,6 +16,7 @@
#include "chrome/browser/feature_engagement/tracker_factory.h"
#include "chrome/browser/ui/browser_finder.h"
#include "chrome/browser/ui/views/chrome_layout_provider.h"
+#include "chrome/browser/ui/views/extensions/security_dialog_tracker.h"
#include "chrome/browser/ui/views/page_action/page_action_icon_view.h"
#include "chrome/browser/ui/views/web_apps/web_app_info_image_source.h"
#include "chrome/browser/ui/views/web_apps/web_app_views_utils.h"
@@ -188,6 +189,11 @@
ok_button->SetProperty(views::kElementIdentifierKey,
PWAConfirmationBubbleView::kInstallButton);
}
+
+ // Mark PWA install dialogs as security-sensitive for extension.
+ // This prevents extension bubbles from obsecuring a PWA install dialog.
+ extensions::SecurityDialogTracker::GetInstance()->AddSecurityDialog(
+ GetWidget());
}
bool PWAConfirmationBubbleView::OnCloseRequested(
diff --git a/chrome/browser/ui/views/webid/account_selection_bubble_view.cc b/chrome/browser/ui/views/webid/account_selection_bubble_view.cc
index a041be0..20550b2 100644
--- a/chrome/browser/ui/views/webid/account_selection_bubble_view.cc
+++ b/chrome/browser/ui/views/webid/account_selection_bubble_view.cc
@@ -18,6 +18,7 @@
#include "chrome/browser/ui/monogram_utils.h"
#include "chrome/browser/ui/passwords/ui_utils.h"
#include "chrome/browser/ui/views/controls/hover_button.h"
+#include "chrome/browser/ui/views/extensions/security_dialog_tracker.h"
#include "chrome/browser/ui/views/webid/account_selection_view_base.h"
#include "chrome/browser/ui/views/webid/fedcm_account_selection_view_desktop.h"
#include "chrome/browser/ui/views/webid/webid_utils.h"
@@ -230,6 +231,8 @@
return;
}
+ extensions::SecurityDialogTracker::GetInstance()->AddSecurityDialog(widget);
+
// Add the widget observer, if available. It is null in tests.
if (widget_observer_) {
widget->AddObserver(widget_observer_);
diff --git a/chrome/browser/ui/views/webid/account_selection_modal_view.cc b/chrome/browser/ui/views/webid/account_selection_modal_view.cc
index 90cc4f9..4e449126 100644
--- a/chrome/browser/ui/views/webid/account_selection_modal_view.cc
+++ b/chrome/browser/ui/views/webid/account_selection_modal_view.cc
@@ -18,6 +18,7 @@
#include "chrome/browser/net/system_network_context_manager.h"
#include "chrome/browser/ui/monogram_utils.h"
#include "chrome/browser/ui/views/controls/hover_button.h"
+#include "chrome/browser/ui/views/extensions/security_dialog_tracker.h"
#include "chrome/browser/ui/views/webid/account_selection_view_base.h"
#include "chrome/browser/ui/views/webid/fedcm_account_selection_view_desktop.h"
#include "chrome/browser/ui/views/webid/webid_utils.h"
@@ -196,6 +197,8 @@
views::Widget::GetWidgetForNativeWindow(top_level_native_window);
views::Widget* widget = views::DialogDelegate::CreateDialogWidget(
this, /*context=*/nullptr, /*parent=*/top_level_widget->GetNativeView());
+ extensions::SecurityDialogTracker::GetInstance()->AddSecurityDialog(widget);
+
widget->Show();
UpdateDialogPosition();
Loading diff…
Original Bug Report
reported by sa...@gmail.com
Extension popup can render over PWA prompts
VULNERABILITY DETAILS This vulnerability is almost the same as https://issues.chromium.org/issues/40058873 but it occurs on PWA prompt
VERSION Chrome Version: 129.0.6657.0 (Official Build) canary (64-bit) Operating System: Windows 10
REPRODUCTION CASE
-
Install attached extension: manifest-keyboard.json + bg-keyboard.js + popup.html. Rename the manifest file to manifest.json
-
Reload manifest-keyboard.json extension using chrome://extensions Press Ctrl+A when requested by the attacker page.
-
Click the Web page then Press Ctrl+A when requested by the attacker page.
CREDIT INFORMATION Externally reported security bugs may appear in Chrome release notes. If this bug is included, how would you like to be credited? Reporter credit: [goes here]
References
On This Page