Chrome · Permissions
CVE-2025-12906
Logic Error in Permissions
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
third_party/blink/renderer/core/html/resources/permission.cssthird_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-ref.htmlthird_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-tentative.html
Patch
From 6ab0f046554dcc728e6e875de79578ae95bb3e5f Mon Sep 17 00:00:00 2001
From: Thomas Nguyen <tungnh@chromium.org>
Date: Wed, 02 Jul 2025 08:41:08 -0700
Subject: [PATCH] [PEPC] Reset CSS inherited style for permission's internal text element.
This ensures that the permission's internal text will not inherit text
style from its parent.
Bug: 428455319
Change-Id: I8d4b61efe010fd4ea24913afaaafba8b9105a80f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6696007
Commit-Queue: Thomas Nguyen <tungnh@chromium.org>
Reviewed-by: Joey Arhar <jarhar@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1481641}
---
diff --git a/third_party/blink/renderer/core/html/resources/permission.css b/third_party/blink/renderer/core/html/resources/permission.css
index 6505655..d82a9fa 100644
--- a/third_party/blink/renderer/core/html/resources/permission.css
+++ b/third_party/blink/renderer/core/html/resources/permission.css
@@ -31,6 +31,8 @@
}
permission::-internal-permission-text {
+ text-emphasis: initial !important;
+ text-shadow: initial !important;
align-items: center;
display: flex;
font-family: Arial, Helvetica, sans-serif;
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-ref.html b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-ref.html
new file mode 100644
index 0000000..6714e31
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-ref.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<link rel="help" href="https://github.com/WICG/PEPC/blob/main/explainer.md#locking-the-pepc-style">
+<body>
+ <div>
+ <permission type="camera"></permission>
+ </div>
+</body>
+</html>
\ No newline at end of file
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-tentative.html b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-tentative.html
new file mode 100644
index 0000000..f1a8d3b6
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-tentative.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<link rel="match" href="inherited-css-ref.html">
+<link rel="help" href="https://github.com/WICG/PEPC/blob/main/explainer.md#locking-the-pepc-style">
+<!-- The permission element not inherit css properties from the parent div.
+-->
+<body>
+ <style>
+ div {
+ text-emphasis: "x";
+ text-emphasis-position: over right;
+ text-shadow: 1px 1px 2px black;
+ }
+ </style>
+ <div>
+ <permission type="camera"></permission>
+ </div>
+</body>
+</html>
\ No newline at end of file
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-ref.html b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-ref.html
new file mode 100644
index 0000000..6714e31
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-ref.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<link rel="help" href="https://github.com/WICG/PEPC/blob/main/explainer.md#locking-the-pepc-style">
+<body>
+ <div>
+ <permission type="camera"></permission>
+ </div>
+</body>
+</html>
\ No newline at end of file
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-tentative.html b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-tentative.html
new file mode 100644
index 0000000..f1a8d3b6
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/inherited-css-tentative.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<link rel="match" href="inherited-css-ref.html">
+<link rel="help" href="https://github.com/WICG/PEPC/blob/main/explainer.md#locking-the-pepc-style">
+<!-- The permission element not inherit css properties from the parent div.
+-->
+<body>
+ <style>
+ div {
+ text-emphasis: "x";
+ text-emphasis-position: over right;
+ text-shadow: 1px 1px 2px black;
+ }
+ </style>
+ <div>
+ <permission type="camera"></permission>
+ </div>
+</body>
+</html>
\ No newline at end of file
Loading diff…
Original Bug Report
reported by sa...@gmail.com
Permission element inner div with style text-emphasis:꧁; and text-emphasis-position: over right; can be abused if no element in the parent chain has any text-emphasis:꧁; and text-emphasis-position: over right; are set.
This bug is similar to https://issues.chromium.org/issues/398803201, https://issues.chromium.org/issues/423670839
when text-emphasis:꧁; and text-emphasis-position: over right; are embedded in a tag above the <permission> tag, for example a div or something else, this affects the <permission> tag, thus covering the text in the <permission> tag. if style text-emphasis:꧁; and text-emphasis-position: over right; embedded directly in the <permission> tag are not affected. The impact is that sites can potentially trick users to trigger permission prompts even if the permission is currently in a DENY state for that origin. (It does not however bypass the permission prompt in any way)
references for some css that can and cannot be embedded in the <permission> tag: https://developer.chrome.com/blog/permission-element-origin-trial?hl=en
References
On This Page