Chrome · Compositing
CVE-2025-13107
Logic Error in Compositing
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
third_party/blink/renderer/core/html/html_permission_element.ccthird_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-stroke-and-fill-ref.htmlthird_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-stroke-and-fill.tentative.html
Patch
From c5539496a8fd440a8f9ad62031184a109307efd7 Mon Sep 17 00:00:00 2001
From: Andy Paicu <andypaicu@chromium.org>
Date: Tue, 08 Jul 2025 01:46:38 -0700
Subject: [PATCH] [PEPC] Prevent -webkit-text-stroke/-webkit-text-fill on the permission element
Even though these properties are not allowed for the permission element,
it seems they get inherited to the inner text anyways. Therefore reset
them manually.
Fixed: 429440615
Change-Id: Ie17b82de959c92ba808d3c966385f31527ef2ea1
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6705900
Reviewed-by: Mason Freed <masonf@chromium.org>
Commit-Queue: Andy Paicu <andypaicu@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1483611}
---
diff --git a/third_party/blink/renderer/core/html/html_permission_element.cc b/third_party/blink/renderer/core/html/html_permission_element.cc
index 28d8b733..ac35dd0 100644
--- a/third_party/blink/renderer/core/html/html_permission_element.cc
+++ b/third_party/blink/renderer/core/html/html_permission_element.cc
@@ -981,6 +981,15 @@
}
}
}
+
+ // These webkit-prefixed properties are not supported by the permission
+ // element. But since they are inherited by default, they are passed through
+ // to the internal permission text span, even if they're not on the list of
+ // allowed CSS properties.
+ // Reset them here to avoid any side effects.
+ builder.ResetTextStrokeWidth();
+ builder.ResetTextFillColor();
+ builder.ResetTextStrokeColor();
}
void HTMLPermissionElement::DidRecalcStyle(const StyleRecalcChange change) {
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-stroke-and-fill-ref.html b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-stroke-and-fill-ref.html
new file mode 100644
index 0000000..c420d08
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-stroke-and-fill-ref.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<body>
+ <div>
+ <permission type="camera"></permission>
+ </div>
+</body>
+</html>
\ No newline at end of file
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-stroke-and-fill.tentative.html b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-stroke-and-fill.tentative.html
new file mode 100644
index 0000000..05b49508
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-stroke-and-fill.tentative.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<link rel="match" href="text-stroke-and-fill-ref.html">
+<link rel="help" href="https://github.com/WICG/PEPC/blob/main/explainer.md#locking-the-pepc-style">
+<body>
+ <style>
+ permission, div {
+ -webkit-text-stroke-width: 10px;
+ -webkit-text-stroke-color: blue;
+ -webkit-text-fill-color: red;
+ }
+ </style>
+ <div>
+ <permission type="camera"></permission>
+ </div>
+</body>
+</html>
\ No newline at end of file
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-stroke-and-fill-ref.html b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-stroke-and-fill-ref.html
new file mode 100644
index 0000000..c420d08
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-stroke-and-fill-ref.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<body>
+ <div>
+ <permission type="camera"></permission>
+ </div>
+</body>
+</html>
\ No newline at end of file
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-stroke-and-fill.tentative.html b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-stroke-and-fill.tentative.html
new file mode 100644
index 0000000..05b49508
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/permission-element/text-stroke-and-fill.tentative.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<link rel="match" href="text-stroke-and-fill-ref.html">
+<link rel="help" href="https://github.com/WICG/PEPC/blob/main/explainer.md#locking-the-pepc-style">
+<body>
+ <style>
+ permission, div {
+ -webkit-text-stroke-width: 10px;
+ -webkit-text-stroke-color: blue;
+ -webkit-text-fill-color: red;
+ }
+ </style>
+ <div>
+ <permission type="camera"></permission>
+ </div>
+</body>
+</html>
\ No newline at end of file
Loading diff…
Original Bug Report
reported by sa...@gmail.com
Permission element inner div with style -webkit-text-stroke-width: thick;font-weight: bolder; can be abused if no element in the parent chain has any -webkit-text-stroke-width: thick;font-weight: bolder; are set.
This bug is similar to https://issues.chromium.org/issues/398803201, https://issues.chromium.org/issues/423670839, https://issues.chromium.org/issues/428455319, https://issues.chromium.org/issues/429270814
when -webkit-text-stroke-width: thick;font-weight: bolder; are embedded in a tag above the <permission> tag, for example a div or something else, this affects the <permission> tag, thus covering the text in the <permission> tag. if style -webkit-text-stroke-width: thick;font-weight: bolder; embedded directly in the <permission> tag are not affected. The impact is that sites can potentially trick users to trigger permission prompts even if the permission is currently in a DENY state for that origin. (It does not however bypass the permission prompt in any way)
references for some css that can and cannot be embedded in the <permission> tag: https://developer.chrome.com/blog/permission-element-origin-trial?hl=en
References
On This Page