Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: In FontAccessManager::EnumerateLocalFonts, permission resolution for a document with an opaque origin can fall back to WebContents::GetVisibleURL(). A compromised renderer hosting an unmodified blank popup can steer the visible URL to an arbitrary victim origin via a pending navigation and borrow its persisted LOCAL_FONTS grant. Because granted permissions bypass the transient user activation requirement, an attacker could silently enumerate all installed local fonts without user interaction.

Affected files:

• content/browser/font_access/font_access_manager.cc
• components/permissions/permission_util.cc

Estimated timestamp from git blame: 2024-08-13

Summary

FontAccessManager::EnumerateLocalFonts resolves the permission status of the calling frame through PermissionController::GetPermissionStatusForCurrentDocument. During this check, PermissionUtil::GetLastCommittedOriginAsURL falls back to WebContents::GetVisibleURL() when the frame’s committed origin is opaque. A compromised renderer can exploit this fallback by opening an opaque-origin popup and initiating an uncommitted navigation to a victim origin (such as Figma or Canva) that has a persisted LOCAL_FONTS grant. When GetPermissionStatusForCurrentDocument returns GRANTED, FontAccessManager bypasses the transient user activation requirement and directly returns the full system font enumeration table.

(Note: These analysis findings and steps are theoretical/potential based on static source analysis, as our tooling environment does not execute dynamic code.)

Root Cause Analysis

1. Opaque Origin Fallback to Visible URL (components/permissions/permission_util.cc:491-497):

GURL origin = render_frame_host->GetLastCommittedOrigin().GetURL();
if (origin.is_empty() && render_frame_host->IsInPrimaryMainFrame()) {
  if (!web_contents->GetVisibleURL().is_empty()) {
    origin = web_contents->GetVisibleURL().DeprecatedGetOriginAsURL();
  }
}
return origin;

For documents with opaque origins (e.g. sandboxed popups), url::Origin::GetURL() returns an empty GURL(). If the document is in a primary main frame, the origin fallback extracts the origin from WebContents::GetVisibleURL().

2. Visible URL Steering via Pending Entry (content/browser/renderer_host/navigation_controller_impl.cc:1127-1155, 3513-3516): When a renderer initiates navigation in a new blank tab and withholds the DidAccessInitialMainDocument IPC, IsUnmodifiedBlankTab() remains true. As a result, GetVisibleEntry() returns the pending navigation entry rather than the committed entry, setting WebContents::GetVisibleURL() to the pending navigation’s target URL.

3. User Activation Bypass on Granted Permissions (content/browser/font_access/font_access_manager.cc:109-121):

auto status = permission_controller->GetPermissionStatusForCurrentDocument(
    content::PermissionDescriptorUtil::
        CreatePermissionDescriptorForPermissionType(
            blink::PermissionType::LOCAL_FONTS),
    rfh);

if (status != blink::mojom::PermissionStatus::ASK) {
  // Permission has been requested before.
  DidRequestPermission(
      std::move(callback),
      PermissionResult(status, PermissionStatusSource::UNSPECIFIED));
  return;
}

When status is GRANTED (due to the victim’s persisted grant in HostContentSettingsMap), execution jumps directly to DidRequestPermission, completely skipping the transient user activation check (rfh->HasTransientUserActivation()).

Potential Attack Steps

1. From a compromised renderer at https://evil.example, create an iframe with sandbox="allow-scripts allow-popups" and call window.open('about:blank').
2. The popup opens in the attacker’s renderer process with an opaque origin derived via SetOriginDependentStateOfNewFrame (content/browser/renderer_host/render_frame_host_impl.cc:5838-5904).
3. The compromised renderer sends a BeginNavigation IPC for the popup targeting a victim origin with a known LOCAL_FONTS grant (e.g., https://www.figma.com/) while withholding DidAccessInitialMainDocument. WebContents::GetVisibleURL() now evaluates to the victim origin.
4. Over the popup frame’s BrowserInterfaceBroker, the renderer binds blink.mojom.FontAccessManager and calls EnumerateLocalFonts().
5. The browser verifies visibility and evaluates the permission against GetVisibleURL() (https://www.figma.com/), finding the persisted grant and returning PermissionStatus::GRANTED.
6. FontAccessManager::DidRequestPermission invokes FontEnumerationCache::GetFontEnumerationData and returns a base::ReadOnlySharedMemoryRegion containing the complete list of locally installed fonts (blink::FontEnumerationTable).
7. The attacker can repeat this process across multiple candidate origins to silently probe the user’s permission state (acting as a cross-origin permission oracle).

Suggested Remediation

1. Remove or Restrict GetVisibleURL Fallback: Disallow using WebContents::GetVisibleURL() for permission lookups in PermissionUtil::GetLastCommittedOriginAsURL when the frame has an opaque origin, or ensure opaque origins never inherit permission grants from uncommitted pending navigations.
2. Validate Requesting Context in FontAccessManager: Ensure FontAccessManager::EnumerateLocalFonts explicitly rejects calls originating from opaque or sandboxed execution contexts, or enforces that the frame’s actual committed origin matches the origin evaluated for permission grants.

Evaluated with Chrome root at commit: c6718ebbf2c677c6f63691e28c7801c563f6b19c

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

• If you are familiar with the severity guidelines, you may adjust the severity.
• If this is a false positive, and there’s no work to be done, please close as WAI.
• If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.