From f7d4aed5f74244c2f81129f4b1a1e9d953c8b269 Mon Sep 17 00:00:00 2001
From: Tianyi Hu <oscarhuthu@gmail.com>
Date: Thu, 09 Apr 2026 08:15:44 -0700
Subject: [PATCH] Use opaque initiator_origin for _unfencedTop navigations

RenderFrameHostImpl::OpenURL() forwards the renderer-supplied
params->initiator_origin to NavigateFromFrameProxy() for
_unfencedTop navigations from fenced frames. The code contains
a commented-out declaration (url::Origin initiator_origin;) that
was intended to replace the renderer value with an opaque origin,
but was never activated.

Uncomment the opaque origin declaration and pass it to
NavigateFromFrameProxy() instead of params->initiator_origin.
A default-constructed url::Origin is opaque, so the destination
will see Sec-Fetch-Site: cross-site — matching the fenced frame
privacy model requirement. Non-fenced-frame navigations are
unaffected because they do not enter the is_unfenced_top_navigation
code path.

Bug: 487564032, 40221940
Change-Id: I7d5767f345e90e6dadf8d9c2f39c71d15cff6103
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7607320
Commit-Queue: Xiaochen Zhou <xiaochenzh@chromium.org>
Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Reviewed-by: Xiaochen Zhou <xiaochenzh@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1612246}
---

diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
index e89e4c1e..e0bdcb8 100644
--- a/content/browser/renderer_host/render_frame_host_impl.cc
+++ b/content/browser/renderer_host/render_frame_host_impl.cc
@@ -9990,13 +9990,14 @@
     // current entry but don't, due to this line.
     bool should_replace_current_entry = false;
 
-    // TODO(crbug.com/40221940): Null out the initiator origin, frame token, and
-    // site instance.
-    // We use an opaque `initiator_origin` in order to avoid leaking
-    // information from the fenced frame to its embedder. (The navigation will
-    // be treated as cross-origin unconditionally.) We don't need to provide a
-    // `source_site_instance`.
-    // url::Origin initiator_origin;
+    // Use an opaque initiator_origin to prevent the fenced frame's
+    // origin from leaking to the destination of the _unfencedTop
+    // navigation via Sec-Fetch-Site and related request headers.
+    // The fenced frame privacy model requires that the embedder
+    // cannot identify the content of the fenced frame; passing the
+    // renderer-supplied params->initiator_origin would violate this.
+    // See crbug.com/40221940.
+    url::Origin initiator_origin;
 
     // TODO(crbug.com/40193166): Resolve the discussion of download policy.
     blink::NavigationDownloadPolicy download_policy;
@@ -10007,7 +10008,7 @@
     target_frame->frame_tree_node()->navigator().NavigateFromFrameProxy(
         target_frame, validated_params_url,
         base::OptionalToPtr(params->initiator_frame_token),
-        GetProcess()->GetDeprecatedID(), params->initiator_origin,
+        GetProcess()->GetDeprecatedID(), initiator_origin,
         params->initiator_base_url, GetSiteInstance(), content::Referrer(),
         ui::PAGE_TRANSITION_LINK, should_replace_current_entry, download_policy,
         "GET",
diff --git a/content/browser/security_exploit_browsertest.cc b/content/browser/security_exploit_browsertest.cc
index 5518ee4..f20a708 100644
--- a/content/browser/security_exploit_browsertest.cc
+++ b/content/browser/security_exploit_browsertest.cc
@@ -3113,6 +3113,56 @@
   EXPECT_EQ(bad_message::RFH_FOCUS_ACROSS_FENCED_BOUNDARY, kill_waiter.Wait());
 }
 
+// Regression test for crbug.com/40221940: a _unfencedTop navigation from a
+// fenced frame must use an opaque initiator_origin. Previously the browser
+// forwarded the renderer-supplied initiator_origin to NavigateFromFrameProxy(),
+// leaking the fenced frame's identity to the destination via Sec-Fetch-Site.
+IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTestFencedFrames,
+                       UnfencedTopNavigationHasOpaqueInitiatorOrigin) {
+  GURL main_url(https_server()->GetURL("a.test", "/simple_page.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), main_url));
+
+  // Create a fenced frame and get its inner root RFH. Use a URL under
+  // /fenced_frames/ which has the Supports-Loading-Mode header.
+  GURL fenced_url(
+      https_server()->GetURL("a.test", "/fenced_frames/title1.html"));
+  RenderFrameHost* fenced_rfh_generic =
+      fenced_frame_test_helper().CreateFencedFrame(
+          shell()->web_contents()->GetPrimaryMainFrame(), fenced_url);
+  ASSERT_TRUE(fenced_rfh_generic);
+  RenderFrameHostImpl* fenced_rfh =
+      static_cast<RenderFrameHostImpl*>(fenced_rfh_generic);
+
+  // The destination URL for the _unfencedTop navigation.
+  GURL dest_url(https_server()->GetURL("b.test", "/simple_page.html"));
+
+  // Watch for the navigation to start so we can inspect the initiator origin.
+  TestNavigationManager nav_manager(shell()->web_contents(), dest_url);
+
+  // Inject an OpenURL IPC from the fenced frame with
+  // is_unfenced_top_navigation=true and a non-opaque initiator_origin.
+  // A compromised renderer can set initiator_origin to any origin its
+  // process hosts; VerifyInitiatorOrigin() will accept it.
+  auto params = CreateOpenURLParams(dest_url);
+  params->is_unfenced_top_navigation = true;
+  params->initiator_origin = url::Origin::Create(fenced_url);
+  ASSERT_FALSE(params->initiator_origin.opaque());
+  static_cast<mojom::FrameHost*>(fenced_rfh)->OpenURL(std::move(params));
+
+  // Wait for the navigation to reach the network.
+  ASSERT_TRUE(nav_manager.WaitForRequestStart());
+
+  // The fix replaces the renderer-supplied initiator_origin with an opaque
+  // origin before passing it to NavigateFromFrameProxy(). Verify that the
+  // navigation handle reflects the opaque origin.
+  NavigationHandle* handle = nav_manager.GetNavigationHandle();
+  ASSERT_TRUE(handle);
+  ASSERT_TRUE(handle->GetInitiatorOrigin().has_value());
+  EXPECT_TRUE(handle->GetInitiatorOrigin()->opaque())
+      << "Expected opaque initiator origin for _unfencedTop navigation, got: "
+      << handle->GetInitiatorOrigin()->Serialize();
+}
+
 namespace {
 
 // Interceptor that replaces the origin in the DidCommitProvisionalLoadParams

diff --git a/content/browser/security_exploit_browsertest.cc b/content/browser/security_exploit_browsertest.cc
index 5518ee4..f20a708 100644
--- a/content/browser/security_exploit_browsertest.cc
+++ b/content/browser/security_exploit_browsertest.cc
@@ -3113,6 +3113,56 @@
   EXPECT_EQ(bad_message::RFH_FOCUS_ACROSS_FENCED_BOUNDARY, kill_waiter.Wait());
 }
 
+// Regression test for crbug.com/40221940: a _unfencedTop navigation from a
+// fenced frame must use an opaque initiator_origin. Previously the browser
+// forwarded the renderer-supplied initiator_origin to NavigateFromFrameProxy(),
+// leaking the fenced frame's identity to the destination via Sec-Fetch-Site.
+IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTestFencedFrames,
+                       UnfencedTopNavigationHasOpaqueInitiatorOrigin) {
+  GURL main_url(https_server()->GetURL("a.test", "/simple_page.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), main_url));
+
+  // Create a fenced frame and get its inner root RFH. Use a URL under
+  // /fenced_frames/ which has the Supports-Loading-Mode header.
+  GURL fenced_url(
+      https_server()->GetURL("a.test", "/fenced_frames/title1.html"));
+  RenderFrameHost* fenced_rfh_generic =
+      fenced_frame_test_helper().CreateFencedFrame(
+          shell()->web_contents()->GetPrimaryMainFrame(), fenced_url);
+  ASSERT_TRUE(fenced_rfh_generic);
+  RenderFrameHostImpl* fenced_rfh =
+      static_cast<RenderFrameHostImpl*>(fenced_rfh_generic);
+
+  // The destination URL for the _unfencedTop navigation.
+  GURL dest_url(https_server()->GetURL("b.test", "/simple_page.html"));
+
+  // Watch for the navigation to start so we can inspect the initiator origin.
+  TestNavigationManager nav_manager(shell()->web_contents(), dest_url);
+
+  // Inject an OpenURL IPC from the fenced frame with
+  // is_unfenced_top_navigation=true and a non-opaque initiator_origin.
+  // A compromised renderer can set initiator_origin to any origin its
+  // process hosts; VerifyInitiatorOrigin() will accept it.
+  auto params = CreateOpenURLParams(dest_url);
+  params->is_unfenced_top_navigation = true;
+  params->initiator_origin = url::Origin::Create(fenced_url);
+  ASSERT_FALSE(params->initiator_origin.opaque());
+  static_cast<mojom::FrameHost*>(fenced_rfh)->OpenURL(std::move(params));
+
+  // Wait for the navigation to reach the network.
+  ASSERT_TRUE(nav_manager.WaitForRequestStart());
+
+  // The fix replaces the renderer-supplied initiator_origin with an opaque
+  // origin before passing it to NavigateFromFrameProxy(). Verify that the
+  // navigation handle reflects the opaque origin.
+  NavigationHandle* handle = nav_manager.GetNavigationHandle();
+  ASSERT_TRUE(handle);
+  ASSERT_TRUE(handle->GetInitiatorOrigin().has_value());
+  EXPECT_TRUE(handle->GetInitiatorOrigin()->opaque())
+      << "Expected opaque initiator origin for _unfencedTop navigation, got: "
+      << handle->GetInitiatorOrigin()->Serialize();
+}
+
 namespace {
 
 // Interceptor that replaces the origin in the DidCommitProvisionalLoadParams