Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: The ChromeSigninChoiceForExtensionsPrompt dialog default-focuses the ‘Continue as <user>’ OK button and lacks keyboard input protection. An installed extension can trigger this consent prompt while a user is typing or holding the Enter key, causing an unintended confirmation on key press. This potentially allows an extension to elevate a web-only account to the browser’s primary account and obtain the user’s identity information without explicit consent.

Affected files:

• chrome/browser/ui/signin/signin_view_controller.cc

Estimated timestamp from git blame: 2024-06-17

Potential enter-keyjacking in ChromeSigninChoiceForExtensionsPrompt

Location

chrome/browser/ui/signin/signin_view_controller.cc:916-974

Summary

SigninViewController::ShowChromeSigninDialogForExtensions constructs the ChromeSigninChoiceForExtensionsPrompt dialog using ui::DialogModel::Builder. This dialog gates whether an installed extension can elevate a web-only signed-in Google account into Chrome’s primary browser account. However, the builder omits OverrideDefaultButton(), SetInitiallyFocusedField(), and SetEnableInputProtection(true).

Due to Chromium framework defaults:

1. OK is the default button & initially focused view: DialogDelegate::GetDefaultDialogButton() defaults to OK (ui/views/window/dialog_delegate.cc:191-202), and BubbleDialogModelHost::GetInitiallyFocusedView() falls through to DialogDelegate::GetInitiallyFocusedView() (ui/views/window/dialog_delegate.cc:292-317), focusing the OK button upon display (components/constrained_window/native_web_contents_modal_dialog_manager_views.cc:140-150).
2. Keyboard events bypass input protection: BubbleDialogModelHost::ShouldAllowKeyEventsDuringInputProtection() returns true because enable_input_protection_ is false (ui/views/bubble/bubble_dialog_model_host.cc:1044-1048). Consequently, DialogClientView::ButtonPressed passes allow_key_events=true to InputEventActivationProtector::IsPossiblyUnintendedInteraction(), which immediately returns false for key events (ui/views/input_event_activation_protector.cc:66-72), skipping the 500ms cooldown and repeat-filtering protection.
3. Key press executes click: On non-macOS platforms (!BUILDFLAG(IS_MAC)), PlatformStyle::kReturnClicksFocusedControl is true (ui/views/style/platform_style.h:56). ButtonController::OnKeyPressed calls NotifyClick on kOnKeyPress without filtering repeated keys (ui/views/controls/button/button_controller.cc:86-109).

Potential Steps to Trigger

(Note: These are potential/suggested steps derived from static code analysis, as our tooling currently lacks the ability to execute live browser code dynamically.)

1. Preconditions: Desktop Chrome (Windows or Linux), user is signed in to a Google account on the web (e.g. Gmail) under DICE/UNO but not signed in to the Chrome browser profile (!identity_manager->HasPrimaryAccount(signin::ConsentLevel::kSignin)), and an extension with identity and identity.email permissions and an oauth2 manifest section is installed.
2. The extension opens or targets an about:blank or chrome://newtab tab in the active window (which satisfies SigninViewController::IsNTPTab, chrome/browser/ui/signin/signin_view_controller.cc:403-410).
3. The extension prompts the user to hold or repeatedly press the Enter key (e.g., through an in-extension game or UI interaction).
4. The extension calls chrome.identity.getAuthToken({interactive: true}). This call is accepted as interactive via recent user activity (identity_get_auth_token_function.cc:1103-1131).
5. IdentityGetAuthTokenFunction::StartSigninFlow() detects DICE web-only sign-in and invokes IdentityAPI::MaybeShowChromeSigninDialog(), which routes to SigninViewController::MaybeShowChromeSigninDialogForExtensions().
6. SigninViewController synchronously activates the about:blank tab and shows the modal dialog ChromeSigninChoiceForExtensionsPrompt with focus on the OK button.
7. The user’s held/repeated Enter keystrokes immediately trigger the focused OK button on key press, bypassing input protection.
8. ok_callback executes identity_manager->GetPrimaryAccountMutator()->SetPrimaryAccount(account_id, signin::ConsentLevel::kSignin, signin_metrics::AccessPoint::kExtensions).
9. IdentityGetAuthTokenFunction::OnPrimaryAccountChanged() automatically resumes token minting, and calls to chrome.identity.getProfileUserInfo({accountStatus: 'ANY'}) return the user’s email address and GAIA ID without deliberate user consent.

Impact

• Unauthorized elevation of a web-only account to the primary browser account.
• Exposure of the user’s email address and GAIA ID to the requesting extension.
• Unlocking access to all web accounts for any installed extension querying IdentityAPI::GetAccountsWithRefreshTokensForExtensions().

Suggested Fix

In chrome/browser/ui/signin/signin_view_controller.cc:958-974, update dialog_builder to override the default button, explicitly focus the cancel button, and enable input protection:

DEFINE_LOCAL_ELEMENT_IDENTIFIER_VALUE(kCancelButtonId);

dialog_builder.SetInternalName("ChromeSigninChoiceForExtensionsPrompt")
    .SetTitle(title)
    .AddParagraph(ui::DialogModelLabel(body))
    .AddParagraph(ui::DialogModelLabel(l10n_util::GetStringUTF16(
        IDS_EXTENSION_ASKS_IDENTITY_WHILE_SIGNED_IN_WEB_ONLY_BODY_PART_2)))
    .AddOkButton(
        base::BindOnce(std::move(ok_callback)),
        ui::DialogModel::Button::Params().SetLabel(l10n_util::GetStringFUTF16(
            IDS_PROFILES_DICE_WEB_ONLY_SIGNIN_BUTTON, continue_as_text)))
    .AddCancelButton(base::DoNothing(),
                     ui::DialogModel::Button::Params()
                         .SetId(kCancelButtonId)
                         .SetLabel(l10n_util::GetStringUTF16(IDS_CANCEL)))
    .OverrideDefaultButton(ui::mojom::DialogButton::kNone)
    .SetInitiallyFocusedField(kCancelButtonId)
    .SetEnableInputProtection(true)
    .SetDialogDestroyingCallback(std::move(on_complete));

Evaluated with Chrome root at commit: c6718ebbf2c677c6f63691e28c7801c563f6b19c

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

• If you are familiar with the severity guidelines, you may adjust the severity.
• If this is a false positive, and there’s no work to be done, please close as WAI.
• If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.