From f2c344251df5af8f78971bb681e54b46c0513c33 Mon Sep 17 00:00:00 2001
From: Jordan Bayles <jophba@chromium.org>
Date: Fri, 24 Apr 2026 12:02:55 -0700
Subject: [PATCH] Fix Use-After-Free in RenderFrameHostImpl::ExitFullscreen()

The call to delegate_->ExitFullscreenMode() can synchronously destroy
the RenderFrameHostImpl object (e.g., if the tab is closed).
Subsequent calls in ExitFullscreen() then operate on the deleted object,
causing a Use-After-Free.

This CL adds a base::WeakPtr guard to detect if the object has been
destroyed and returns early if so. This is a variant of the fix for
EnterFullscreen in commit 91d5baaef742.

Bug: 505045913
Change-Id: Id2b34bea77bb80a3b6c11372cc8813a812e34a2e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7787660
Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Reviewed-by: Charlie Reis <creis@chromium.org>
Commit-Queue: Jordan Bayles <jophba@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1620376}
---

diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
index b4b82c13..8b04c91 100644
--- a/content/browser/renderer_host/render_frame_host_impl.cc
+++ b/content/browser/renderer_host/render_frame_host_impl.cc
@@ -9322,8 +9322,14 @@
 
 void RenderFrameHostImpl::ExitFullscreen() {
   base::RecordAction(base::UserMetricsAction("ExitFullscreen_API"));
+
+  base::WeakPtr<RenderFrameHostImpl> weak_ptr = GetWeakPtr();
   delegate_->ExitFullscreenMode(/*will_cause_resize=*/true);
 
+  if (!weak_ptr) {
+    return;
+  }
+
   // The previous call might change the fullscreen state. We need to make sure
   // the renderer is aware of that, which is done via the resize message.
   // Typically, this will be sent as part of the call on the |delegate_| above
diff --git a/content/browser/renderer_host/render_frame_host_impl_unittest.cc b/content/browser/renderer_host/render_frame_host_impl_unittest.cc
index dbcdb2f..09e93d6 100644
--- a/content/browser/renderer_host/render_frame_host_impl_unittest.cc
+++ b/content/browser/renderer_host/render_frame_host_impl_unittest.cc
@@ -199,6 +199,27 @@
   EXPECT_EQ(GURL(url::kAboutBlankURL), main_rfh()->GetLastCommittedURL());
 }
 
+TEST_F(RenderFrameHostImplTest, ExitFullscreenDestruction) {
+  class DestructionDelegate : public WebContentsDelegate {
+   public:
+    explicit DestructionDelegate(base::OnceClosure destruction_closure)
+        : destruction_closure_(std::move(destruction_closure)) {}
+    void ExitFullscreenModeForTab(WebContents* web_contents) override {
+      std::move(destruction_closure_).Run();
+    }
+
+   private:
+    base::OnceClosure destruction_closure_;
+  };
+
+  DestructionDelegate delegate(base::BindOnce(
+      &RenderFrameHostImplTest::DeleteContents, base::Unretained(this)));
+  contents()->SetDelegate(&delegate);
+
+  // This should not crash.
+  main_test_rfh()->ExitFullscreen();
+}
+
 // Ensures that IsolationInfo's SiteForCookies is empty and
 // that it correctly generates a StorageKey with a kCrossSite
 // AncestorChainBit when frames are nested in an A->B->A

diff --git a/content/browser/renderer_host/render_frame_host_impl_unittest.cc b/content/browser/renderer_host/render_frame_host_impl_unittest.cc
index dbcdb2f..09e93d6 100644
--- a/content/browser/renderer_host/render_frame_host_impl_unittest.cc
+++ b/content/browser/renderer_host/render_frame_host_impl_unittest.cc
@@ -199,6 +199,27 @@
   EXPECT_EQ(GURL(url::kAboutBlankURL), main_rfh()->GetLastCommittedURL());
 }
 
+TEST_F(RenderFrameHostImplTest, ExitFullscreenDestruction) {
+  class DestructionDelegate : public WebContentsDelegate {
+   public:
+    explicit DestructionDelegate(base::OnceClosure destruction_closure)
+        : destruction_closure_(std::move(destruction_closure)) {}
+    void ExitFullscreenModeForTab(WebContents* web_contents) override {
+      std::move(destruction_closure_).Run();
+    }
+
+   private:
+    base::OnceClosure destruction_closure_;
+  };
+
+  DestructionDelegate delegate(base::BindOnce(
+      &RenderFrameHostImplTest::DeleteContents, base::Unretained(this)));
+  contents()->SetDelegate(&delegate);
+
+  // This should not crash.
+  main_test_rfh()->ExitFullscreen();
+}
+
 // Ensures that IsolationInfo's SiteForCookies is empty and
 // that it correctly generates a StorageKey with a kCrossSite
 // AncestorChainBit when frames are nested in an A->B->A