Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports without the Chrome Security team. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: A confused deputy vulnerability in MediaLauncherActivity potentially allows a malicious local app to navigate Chrome to restricted internal chrome:// URLs. By passing a crafted URI to the exported MediaLauncherActivity, an attacker can bypass intent filtering, upgrade the intent to trusted status, and evade the unsafe URL checks.

Affected files:

• chrome/android/java/src/org/chromium/chrome/browser/media/MediaLauncherActivity.java
• chrome/android/java/src/org/chromium/chrome/browser/media/MediaViewerUtils.java
• chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
• chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDispatcher.java
• chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabIntentDataProvider.java

Estimated timestamp from git blame: 2026-01-21

Summary

A potential logic flaw in Chrome for Android allows an attacker-controlled application to bypass the internal URL security defense. This defense is designed to prevent external applications from navigating to internal schemes, protecting sensitive URLs such as chrome://settings or chrome://flags.

The vulnerability stems from a confused-deputy pattern where MediaLauncherActivity processes an untrusted intent, validates its media type using a bypassable method, and then re-dispatches it as a ’trusted’ intent originating from Chrome itself.

Technical Details

1. Entry Point: MediaLauncherActivity is an exported activity (android:exported="true") reachable by explicit intents from any installed application. It is enabled at runtime on specific devices like Android Go or enterprise-managed profiles.
2. MIME Type Validation Bypass: When MediaLauncherActivity receives an intent, it checks if the data URI is a valid media type. For a URI like customtab://x.mp4?chrome://settings, the scheme is not content://, so it extracts the file extension. The Android framework’s MimeTypeMap.getFileExtensionFromUrl() strips the query parameter and extracts .mp4. This matches video/mp4, bypassing the media check.
3. Privilege Escalation: MediaViewerUtils.getMediaViewerIntent() prepares a navigation intent based on the attacker’s data. It calls IntentUtils.addTrustedIntentExtras(intent). Since the intent targets Chrome itself (via ChromeLauncherActivity), Chrome’s internal PendingIntent authentication token is attached, marking the intent as trusted.
4. Defense Bypass: The intent is dispatched to IntentHandler.
   • IntentHandler.getUrlForCustomTab() extracts the navigation URL. For the customtab:// scheme, it returns the decoded query component. For customtab://x.mp4?chrome://settings, this yields chrome://settings.
   • LaunchIntentDispatcher calls shouldIgnoreIntentUrl(). Because the intent contains the trusted PendingIntent token, wasIntentSenderChrome(intent) returns true.
   • shouldIgnoreIntentUrl performs an early return if the sender is Chrome, skipping the intentHasUnsafeUrl() check which is the primary defense against unauthorized chrome:// navigations.
5. Navigation: The Custom Tab attempts to load the media, but because the scheme is not file://, CustomTabIntentDataProvider does not override the URL. The chrome://settings URL is loaded.

Impact

This vulnerability potentially allows an installed malicious application to force Chrome to navigate to any internal chrome://, chrome-native://, or about: URL. This bypasses the security boundary intended to keep these pages unreachable from external apps, exposing sensitive WebUI surfaces.

Potential Reproduction Steps

Note: These are suggested steps based on source code analysis; we do not have a working PoC.

1. On an Android device where MediaLauncherActivity is enabled, install a malicious app.
2. The malicious app sends an explicit intent to org.chromium.chrome.browser.media.MediaLauncherActivity.
3. Set the intent action to ACTION_VIEW and the data to Uri.parse("customtab://x.mp4?chrome://settings/clearBrowserData").
4. Execute startActivity(intent).
5. Observe that Chrome launches and navigates to the chrome://settings/clearBrowserData page without user interaction.

Suggested Fix

Add a security check within MediaLauncherActivity.onCreate() to validate incoming intents before processing them. By calling IntentHandler.shouldIgnoreIntent(input, false), Chrome will evaluate the target URL against its unsafe URL list, effectively blocking chrome:// payloads originating from external sources before they are repackaged as trusted intents.

Evaluated with Chrome root at commit: eca8648a4e1cdfdda68c495a6003059fed641955

Results so far have been promising, but there can be wrong deductions. If this proves to be a false positive, please close as WAI; data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.