CVE-2025-13637
Overview
Background
- Download bubble
- the desktop toolbar bubble (
DownloadBubbleRowViewrows indownload_bubble_row_view.cc) that lists recent downloads and lets the user open a file or run a quick action on it by clicking a row or pressing a key such as Enter. - `InputEventActivationProtector`
- a views helper (
input_protector_) whoseIsPossiblyUnintendedInteraction()drops input that arrives too soon after a dialog or bubble appears. The commit message gives this window as 500 ms. - `allow_key_events` parameter
- an argument to
IsPossiblyUnintendedInteraction(). When it istrue, keyboard events skip the timing check and only pointer events are checked. - Enterjacking
- a UI-redressing technique where a page gets the user to press or hold Enter. A keystroke meant for the page then lands on a newly shown browser surface and activates it.
Root Cause Analysis
Two press handlers in chrome/browser/ui/views/download/bubble/download_bubble_row_view.cc guarded activation with input_protector_->IsPossiblyUnintendedInteraction(event, /*allow_key_events=*/true). That timing check therefore applied only to mouse and tap events. The first handler leads to opening the download or its subpage. The second ends in bubble_controller_->ProcessDownloadButtonPress(...). The hunk headers do not show either enclosing function’s name. Under the old code, a key event that arrived immediately after the bubble appeared was treated as intentional. A key already held, or about to be pressed, for the web page could activate a row and open a just-downloaded file.
The patch changes both call sites to /*allow_key_events=*/false, which tightens the check: key events now get the same post-show delay as clicks and are dropped by the early return if they come too soon. The commit message calls this a partial mitigation, because 500 ms may not catch every unintended keypress.
allow_key_events=false so keystrokes are rate-limited like clicks.Attack Path
- Lure user into typing A web page gets the user to press or hold Enter, for example through a game or a fake form.
- Trigger a download While the user is typing, the page starts a download, and Chrome shows the download bubble with the new item.
- Keystroke lands on the bubble
The next Enter press goes to the newly focused bubble row. Before the patch,
IsPossiblyUnintendedInteraction(event, true)did not filter key events, so the handler continued. - Unintended open
The row handler opens the downloaded file or runs the button action through
ProcessDownloadButtonPress, without the user deliberately choosing to (the final effect depends on file type and OS handler: inferred).
Impact Assessment
Files Changed
chrome/browser/ui/views/download/bubble/download_bubble_row_view.cc
Audit Directions
- Activation protectors that exempt keysSearch for
IsPossiblyUnintendedInteraction(..., /*allow_key_events=*/true)and similar exemptions on any browser surface that can appear while web content has focus, such as permission prompts, install dialogs and file pickers. - Surfaces triggered by web contentCheck UI that a page can make appear on demand (downloads, external-protocol dialogs, payment sheets) for a default focused action that a held or repeated key could activate.
- Fixed-delay mitigationsCheck whether a fixed delay such as 500 ms is enough when the user can hold a key to autorepeat. Prefer requiring the key to go down after the surface is shown, not just measuring elapsed time.
Patch
From 8be46d66315fc47df5634d7cface5b62d7673b26 Mon Sep 17 00:00:00 2001
From: Lily Chen <chlily@chromium.org>
Date: Tue, 14 Oct 2025 13:12:42 -0700
Subject: [PATCH] Protect download bubble from unintended key events
This change considers key events when protecting the download bubble row
view from unintended user input. Clicking (or pressing Enter) on the
download bubble row view may result in opening a downloaded file. The
existing InputEventActivationProtector prevents clicks too soon after
showing the download bubble (500 ms). After this change, key events are
subject to the delay as well.
This is only a partial mitigation for a number of variants of
"enterjacking" on the download bubble, because the 500 ms delay may not
be sufficient to catch all unintended keypresses.
Bug: 392375329, 405727341, 421348748, 421877606
Change-Id: Ia6252f397966dd1d5cb539bf5c58f348effebadc
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7041986
Reviewed-by: Daniel Rubery <drubery@chromium.org>
Auto-Submit: Lily Chen <chlily@chromium.org>
Commit-Queue: Lily Chen <chlily@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1529740}
---
diff --git a/chrome/browser/ui/views/download/bubble/download_bubble_row_view.cc b/chrome/browser/ui/views/download/bubble/download_bubble_row_view.cc
index c4548ce..1e53672 100644
--- a/chrome/browser/ui/views/download/bubble/download_bubble_row_view.cc
+++ b/chrome/browser/ui/views/download/bubble/download_bubble_row_view.cc
@@ -638,7 +638,7 @@
return;
}
if (input_protector_->IsPossiblyUnintendedInteraction(
- event, /*allow_key_events=*/true)) {
+ event, /*allow_key_events=*/false)) {
return;
}
if (info_->has_subpage()) {
@@ -657,7 +657,7 @@
const ui::Event& event) {
if (!bubble_controller_ || !info_->model() ||
input_protector_->IsPossiblyUnintendedInteraction(
- event, /*allow_key_events=*/true)) {
+ event, /*allow_key_events=*/false)) {
return;
}
bubble_controller_->ProcessDownloadButtonPress(info_->model()->GetWeakPtr(),
Original Bug Report
clickjacking (enterjacking) download notification when a pip window closes
Security Bug
VULNERABILITY DETAILS when opening a popup window in the pip window and at the same time the popup window is downloading a file and the pip window is closed the focus changes to the file that has been downloaded (download notification) this causes the file to be opened
VERSION Chrome Version: Version 134.0.6981.0 (Official Build) canary (64-bit) Operating System: Windows OS
REPRODUCTION CASE
- open pocv.html
- do enter 5-6 times fastly
CREDIT INFORMATION Externally reported security bugs may appear in Chrome release notes. If this bug is included, how would you like to be credited? Reporter credit: [goes here]