Chrome · Permissions
CVE-2025-12911
Logic Error in Permissions
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
third_party/blink/renderer/core/html/html_permission_element.ccthird_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-decoration-ref.htmlthird_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-decoration-tentative.html
Patch
From 9344dfce9c3a39fd2f6757d3b20390a86f5e5298 Mon Sep 17 00:00:00 2001
From: Thomas Nguyen <tungnh@chromium.org>
Date: Sat, 28 Jun 2025 01:42:47 -0700
Subject: [PATCH] [PEPC] Disallow text-decoration CSS property
The CSS Text Decoration Module Level 3 spec (https://drafts.csswg.org/css-text-decor-3/#decorating-box) says PEPC's internal container needs `display: inline-box`. That doesn't work with our current layout, so we'll just reset the base text-decoration to get the same result.
Bug: 423670839
Change-Id: I53b574d2bc2c9e0e03b62a145cce3f682466866e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6681790
Reviewed-by: Joey Arhar <jarhar@chromium.org>
Commit-Queue: Thomas Nguyen <tungnh@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1480204}
---
diff --git a/third_party/blink/renderer/core/html/html_permission_element.cc b/third_party/blink/renderer/core/html/html_permission_element.cc
index 9a7084c..1e57769 100644
--- a/third_party/blink/renderer/core/html/html_permission_element.cc
+++ b/third_party/blink/renderer/core/html/html_permission_element.cc
@@ -959,6 +959,11 @@
builder.SetBorderRightWidth(builder.FontSize());
}
+ // The base `text-decoration` property must be reset for each `<permission>`
+ // element. This prevents any `text-decoration` from a parent element from
+ // being propagated to the `<permission>` element.
+ builder.SetBaseTextDecorationData(nullptr);
+
// Cursor only allows 'pointer' (default) and 'not-allowed'. No custom images.
builder.ClearCursorList();
if (builder.Cursor() != ECursor::kNotAllowed) {
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-decoration-ref.html b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-decoration-ref.html
new file mode 100644
index 0000000..c420d08
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-decoration-ref.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<body>
+ <div>
+ <permission type="camera"></permission>
+ </div>
+</body>
+</html>
\ No newline at end of file
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-decoration-tentative.html b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-decoration-tentative.html
new file mode 100644
index 0000000..be4bd04
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-decoration-tentative.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<link rel="match" href="text-decoration-ref.html">
+<link rel="help" href="https://github.com/WICG/PEPC/blob/main/explainer.md#locking-the-pepc-style">
+<body>
+ <style>
+ permission {
+ text-decoration: underline;
+ }
+ div {
+ text-decoration: underline;
+ }
+ </style>
+ <div>
+ <permission type="camera"></permission>
+ </div>
+</body>
+</html>
\ No newline at end of file
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-decoration-ref.html b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-decoration-ref.html
new file mode 100644
index 0000000..c420d08
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-decoration-ref.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<body>
+ <div>
+ <permission type="camera"></permission>
+ </div>
+</body>
+</html>
\ No newline at end of file
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-decoration-tentative.html b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-decoration-tentative.html
new file mode 100644
index 0000000..be4bd04
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-decoration-tentative.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<link rel="match" href="text-decoration-ref.html">
+<link rel="help" href="https://github.com/WICG/PEPC/blob/main/explainer.md#locking-the-pepc-style">
+<body>
+ <style>
+ permission {
+ text-decoration: underline;
+ }
+ div {
+ text-decoration: underline;
+ }
+ </style>
+ <div>
+ <permission type="camera"></permission>
+ </div>
+</body>
+</html>
\ No newline at end of file
Loading diff…
Original Bug Report
reported by sa...@gmail.com
Permission element inner div with style text-decoration-line: line-through; and text-decoration-thickness can be abused if no element in the parent chain has any text-decoration-line: line-through; and text-decoration-thickness are set.
This bug is similar to https://issues.chromium.org/issues/398803201, when text-decoration-line: line-through; and text-decoration-thickness: are embedded in a tag above the <permission> tag, for example a div or something else, this affects the <permission> tag, thus covering the text in the <permission> tag. if style text-decoration-line: line-through; and text-decoration-thickness embedded directly in the <permission> tag are not affected. The impact is that sites can potentially trick users to trigger permission prompts even if the permission is currently in a DENY state for that origin. (It does not however bypass the permission prompt in any way)
references for some css that can and cannot be embedded in the <permission> tag: https://developer.chrome.com/blog/permission-element-origin-trial?hl=en
References
On This Page