Chrome · Permission Prompts › Platform>Extensions
CVE-2025-1923
Logic Error in Permission Prompts (Platform>Extensions)
Overview
Low
Severity
4.3
CVSS
No
Exploited ITW
Fixed
Fix Status
Background
- Chooser bubble
- the permission UI (
ChooserBubbleUi) that lets the user pick a device for APIs like WebUSB, Web Bluetooth, and serial before a site is granted access. - Widget z-order sublevel
- a fine-grained ordering within a z-order level that decides which overlapping top-level
views::Widgetis drawn on top when several share a level. - `ChromeWidgetSublevel::kSublevelSecurity`
- a sublevel constant intended for security-sensitive surfaces so they render above ordinary bubbles.
- `SetZOrderSublevel()`
- the
views::Widgetmethod that assigns a widget’s sublevel, controlling stacking against sibling widgets.
Root Cause Analysis
When the device chooser permission bubble was created via views::BubbleDialogDelegateView::CreateBubble(...), its widget was shown without any explicit z-order sublevel, so it inherited a default that could sit below other concurrently displayed widgets such as the extension bubble. As a result the security-relevant permission chooser could be visually occluded by another bubble, meaning the user might act on (or fail to properly see) the surface that actually grants device access, a permission-prompt spoofing/occlusion issue.
The fix adds widget->SetZOrderSublevel(ChromeWidgetSublevel::kSublevelSecurity) immediately after the widget is created and before it is shown, raising the chooser bubble into the security sublevel so it is no longer occluded by the extension bubble. This is a stacking/ordering correction, not a validation change; control flow is otherwise unchanged.
Key insight
The single mistake was creating the security-sensitive chooser bubble without assigning a security z-order sublevel, letting it be occluded by other bubbles; the fix calls
SetZOrderSublevel(ChromeWidgetSublevel::kSublevelSecurity) so the permission chooser reliably renders on top.Attack Path
- Invoke a device chooser
A site (or extension-driven flow) triggers a permission chooser such as the WebUSB device picker, creating the
ChooserBubbleUiwidget. - Surface a competing bubble Another bubble, specifically the extension bubble named in the commit, is displayed at a z-order that can overlap the chooser.
- Occlude the security prompt Pre-patch, without a security sublevel, the chooser bubble could be drawn beneath the extension bubble, hiding or partially covering the permission UI.
- Mislead the user
The user may fail to see the true chooser or interact with the overlapping surface, undermining informed consent for device access
(inferred as to any concrete spoofing/click-through exploitation).
Impact Assessment
The flaw allows the security-sensitive permission chooser bubble to be occluded by another bubble in the browser-process UI, weakening the integrity of the device-permission prompt (WebUSB and similar). The advisory classifies it as inappropriate implementation in Permission Prompts; it reports no memory corruption or in-the-wild exploitation, and any successful user deception is
(inferred). The precondition is a scenario where the chooser bubble and an occluding bubble (e.g., the extension bubble) are shown at the same time.Files Changed
chrome/browser/ui/views/permissions/chooser_bubble_ui.cc
Audit Directions
- Security surfaces without explicit sublevelAudit other permission/security bubbles and dialogs created via
BubbleDialogDelegateView::CreateBubbleto confirm they set an appropriateChromeWidgetSubleveland cannot be occluded. - Z-order/stacking of consent UIReview widgets that overlap permission prompts (extension bubbles, infobars, PWA/omnibox bubbles) for stacking rules that could hide the surface a user must act on.
- Occlusion vs. input integrityCheck that security-relevant prompts combine top-most stacking with any input-protection (occlusion/first-interaction) safeguards so a covered prompt cannot receive unintended interaction.
Patch
From 59f1d4281a72b19732f63b3232d7c31340ba857d Mon Sep 17 00:00:00 2001
From: Keren Zhu <kerenzhu@chromium.org>
Date: Tue, 28 Jan 2025 09:13:13 -0800
Subject: [PATCH] Set a higher z-order sublevel for the permission chooser bubble
This change prevents the permission chooser bubble from being occluded
by the extension bubble. This permission bubble is used to choose WebUSB
device, etc.
Bug: 382540635
Change-Id: Ib6aa62e7342fa475cc89d12fe3e9abe1439b47ef
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6204583
Reviewed-by: Caroline Rising <corising@chromium.org>
Code-Coverage: findit-for-me@appspot.gserviceaccount.com <findit-for-me@appspot.gserviceaccount.com>
Auto-Submit: Keren Zhu <kerenzhu@chromium.org>
Commit-Queue: Caroline Rising <corising@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1412341}
---
diff --git a/chrome/browser/ui/views/permissions/chooser_bubble_ui.cc b/chrome/browser/ui/views/permissions/chooser_bubble_ui.cc
index 9afd48e..75f70d3e 100644
--- a/chrome/browser/ui/views/permissions/chooser_bubble_ui.cc
+++ b/chrome/browser/ui/views/permissions/chooser_bubble_ui.cc
@@ -13,6 +13,7 @@
#include "chrome/browser/ui/browser_finder.h"
#include "chrome/browser/ui/browser_window.h"
#include "chrome/browser/ui/views/bubble_anchor_util_views.h"
+#include "chrome/browser/ui/views/chrome_widget_sublevel.h"
#include "chrome/browser/ui/views/device_chooser_content_view.h"
#include "chrome/browser/ui/views/location_bar/location_bar_bubble_delegate_view.h"
#include "chrome/browser/ui/views/title_origin_label.h"
@@ -285,6 +286,7 @@
base::OnceClosure close_closure = bubble->MakeCloseClosure();
views::Widget* widget =
views::BubbleDialogDelegateView::CreateBubble(std::move(bubble));
+ widget->SetZOrderSublevel(ChromeWidgetSublevel::kSublevelSecurity);
if (browser->window()->IsActive()) {
widget->Show();
} else {
Loading diff…
Original Bug Report
reported by ch...@gmail.com
Extension popup can appear over WebUSB permission prompt
Steps to reproduce the problem
- Install attached extension
- Click anywhere, then Press Ctrl+A
Problem Description
Similar to issue 361711121
Summary
Extension popup can appear over WebUSB permission prompt
Additional Data
Category: Security
Chrome Channel: Canary
Regression: N/A
References
On This Page