Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: A potential Use-After-Free vulnerability exists in the browser process due to a dangling pointer in WidgetDelegate’s initially_focused_view. This occurs because the pointer is stored in an unprotected std::optional and is not cleared when the referenced View is destroyed. Triggering accessibility shortcuts like F6 or Alt+Shift+A can result in a virtual function call on freed memory.

Affected files:

• chrome/browser/ui/focus/browser_focus_controller_delegate_views.cc
• ui/views/widget/widget_delegate.h
• chrome/browser/ui/views/download/bubble/download_toolbar_ui_controller.cc
• ui/views/widget/widget_delegate.cc
• ui/views/window/dialog_delegate.cc

Estimated timestamp from git blame: Unknown (Google3 checkout)

Description

A potential Use-After-Free (UAF) vulnerability has been identified in the browser process, specifically within BrowserFocusControllerDelegateViews::ActivateFirstInactiveBubbleForAccessibility(). The issue stems from how WidgetDelegate manages its initially_focused_view pointer, which is used to determine focus when a bubble or dialog is activated for accessibility.

Root Cause Analysis

In ui/views/widget/widget_delegate.h, the initially_focused_view field is defined as:

std::optional<View*> initially_focused_view;

Because this pointer is wrapped in std::optional, it is not converted to raw_ptr<View> by Chromium’s automated rewriter and thus lacks MiraclePtr/BackupRefPtr protection. Furthermore, there is no mechanism (such as a ViewTracker or ViewObserver) to clear this pointer if the referenced View is destroyed during the lifetime of the delegate.

In the context of the Download Bubble, this field can be set to a child view (e.g., a button within a download row). If that download row is removed while the bubble remains open, the pointer becomes dangling.

Vulnerable Sink

The vulnerability is potentially triggered when a user presses the F6 (Rotate Pane Focus) or Alt+Shift+A (Focus Inactive Popup) keyboard shortcuts. The following code path in chrome/browser/ui/focus/browser_focus_controller_delegate_views.cc retrieves the dangling pointer and performs a virtual call:

// line 112
views::View* focusable = bubble->GetInitiallyFocusedView();
// ...
if (focusable) {
  focusable->RequestFocus(); // Virtual call on potentially freed memory
}

Potential Attack Scenario

While these steps are theoretical and have not been validated by a running proof-of-concept, an attacker could potentially trigger the vulnerability as follows:

1. Induce the browser to show the Download Bubble in an inactive state (e.g., by initiating multiple downloads from a site).
2. Cause a specific download to be removed (e.g., via interaction in another tab or automated cleanup), which destroys the associated View that was captured as the initially_focused_view.
3. The user, perhaps guided by a screen reader or keyboard navigation, presses F6 or Alt+Shift+A to focus the bubble.
4. The system attempts to call RequestFocus() on the dangling pointer, potentially allowing an attacker who has groomed the heap to gain arbitrary code execution in the unsandboxed browser process.

Suggested Fix

The initially_focused_view should be managed using a views::ViewTracker or a base::WeakPtr<views::View> to ensure the pointer is invalidated when the View is destroyed. Additionally, the kAnchoredDialogKey property should be audited to ensure it does not bypass modern memory safety protections.

Evaluated with Chrome root at commit: b3153093eb3c78c3e88ccf562bcbc20437a04b0e

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

• If you are familiar with the severity guidelines, you may adjust the severity.
• If this is a false positive, and there’s no work to be done, please close as WAI.
• If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.