From 3995e723497838c70fbd0a6447ee4501a0f745d0 Mon Sep 17 00:00:00 2001
From: Justin Lulejian <jlulejian@chromium.org>
Date: Tue, 14 Apr 2026 17:24:24 -0700
Subject: [PATCH] [Extensions] Harden Declarative Content API against spoofed IPCs

Before this commit, a compromised renderer could spoof the
WatchedPageChange IPC message to report that a CSS selector matched on a
page. This could be used to trick ScriptInjectionTracker into granting
trust for unauthorized pages, leading to unpermitted script injection.
The issue is two-part:

1) The WatchedPageChange IPC could be for any selector and will be
considered valid.

2) Even if the WatchedPageChange IPC was an existing selector, we still
don't check if the extension has host permission before script
injection.

After this commit we address both parts:

For the WatchedPageChange IPC: we add a coarse IPC validation check in
DeclarativeContentCssConditionTracker::OnWatchedPageChanged to ensure
reported selectors are at least known globally. If not, we ignore the
unknown selector so it doesn't trigger any actions. We ignore instead of
terminate the renderer because of a possible race where the browser
might stop tracking the selector before the IPC arrives.

For the script injection: we add a host permission check before granting
script injection trust in
RequestContentScript::InstructRenderProcessToInject.

Both scenarios/parts are tested in
extension_security_exploit_browsertest.cc.

Bug: 497025738
Change-Id: Ic962c0c0e4dffa5fb6086cd32b4c3b72d235b635
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7748669
Reviewed-by: Andrea Orru <andreaorru@chromium.org>
Commit-Queue: Justin Lulejian <jlulejian@chromium.org>
Auto-Submit: Justin Lulejian <jlulejian@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1614799}
---

diff --git a/chrome/browser/extensions/api/declarative_content/content_action.cc b/chrome/browser/extensions/api/declarative_content/content_action.cc
index b1c32f5..85cd204 100644
--- a/chrome/browser/extensions/api/declarative_content/content_action.cc
+++ b/chrome/browser/extensions/api/declarative_content/content_action.cc
@@ -34,6 +34,7 @@
 #include "extensions/common/mojom/host_id.mojom.h"
 #include "extensions/common/mojom/match_origin_as_fallback.mojom-shared.h"
 #include "extensions/common/mojom/run_location.mojom-shared.h"
+#include "extensions/common/permissions/permissions_data.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "ui/gfx/image/image.h"
 #include "ui/gfx/image/image_skia.h"
@@ -374,6 +375,18 @@
 void RequestContentScript::InstructRenderProcessToInject(
     content::WebContents* contents,
     const Extension* extension) const {
+  // Verify that the extension has permission to access the page before
+  // granting trust for script injection. This prevents a compromised renderer
+  // from fully bypassing permission checks (for example: a spoofed
+  // `extensions::mojom::LocalFrameHost::WatchedPageChange` IPC bypassing the
+  // check we have for an invalid selector and getting here).
+  std::string error;
+  if (!extension->permissions_data()->CanAccessPage(
+          contents->GetLastCommittedURL(), ExtensionTabUtil::GetTabId(contents),
+          &error)) {
+    return;
+  }
+
   ScriptInjectionTracker::WillExecuteCode(base::PassKey<RequestContentScript>(),
                                           contents->GetPrimaryMainFrame(),
                                           *extension);
diff --git a/chrome/browser/extensions/api/declarative_content/declarative_content_css_condition_tracker.cc b/chrome/browser/extensions/api/declarative_content/declarative_content_css_condition_tracker.cc
index c5d2230d..2a9b8c2f 100644
--- a/chrome/browser/extensions/api/declarative_content/declarative_content_css_condition_tracker.cc
+++ b/chrome/browser/extensions/api/declarative_content/declarative_content_css_condition_tracker.cc
@@ -14,6 +14,8 @@
 #include "chrome/browser/profiles/profile.h"
 #include "content/public/browser/navigation_handle.h"
 #include "content/public/browser/render_process_host.h"
+#include "content/public/browser/web_contents.h"
+#include "extensions/browser/bad_message.h"
 #include "extensions/browser/renderer_startup_helper.h"
 #include "extensions/buildflags/buildflags.h"
 #include "extensions/common/api/declarative/declarative_constants.h"
@@ -218,7 +220,18 @@
     content::WebContents* contents,
     const std::vector<std::string>& css_selectors) {
   DCHECK(per_web_contents_tracker_.contains(contents));
-  per_web_contents_tracker_[contents]->OnWatchedPageChanged(css_selectors);
+
+  std::vector<std::string> valid_selectors;
+  for (const std::string& selector : css_selectors) {
+    // A compromised renderer might send selectors that were not requested.
+    // We ignore unrecognized selectors to avoid race conditions where a
+    // legitimate message arrives after the browser stopped watching a selector.
+    if (watched_css_selector_predicate_count_.contains(selector)) {
+      valid_selectors.push_back(selector);
+    }
+  }
+
+  per_web_contents_tracker_[contents]->OnWatchedPageChanged(valid_selectors);
 }
 
 bool DeclarativeContentCssConditionTracker::EvaluatePredicate(
diff --git a/chrome/browser/extensions/extension_security_exploit_browsertest.cc b/chrome/browser/extensions/extension_security_exploit_browsertest.cc
index 151756f..85d5859 100644
--- a/chrome/browser/extensions/extension_security_exploit_browsertest.cc
+++ b/chrome/browser/extensions/extension_security_exploit_browsertest.cc
@@ -35,6 +35,7 @@
 #include "extensions/browser/extension_web_contents_observer.h"
 #include "extensions/browser/process_manager.h"
 #include "extensions/browser/renderer_startup_helper.h"
+#include "extensions/browser/script_injection_tracker.h"
 #include "extensions/browser/service_worker/service_worker_host.h"
 #include "extensions/common/constants.h"
 #include "extensions/common/extension_features.h"
@@ -85,6 +86,35 @@
     open_extension_mutator_ = std::move(open_extension_mutator);
   }
 
+  void SimulateWatchedPageChange(
+      const std::vector<std::string>& css_selectors) {
+    GetForwardingInterface()->WatchedPageChange(css_selectors);
+  }
+
+  using WatchedPageChangeMutator =
+      base::RepeatingCallback<void(std::vector<std::string>& css_selectors)>;
+  void SetWatchedPageChangeMutator(
+      WatchedPageChangeMutator watched_page_change_mutator) {
+    watched_page_change_mutator_ = std::move(watched_page_change_mutator);
+  }
+
+  // We cannot call `FlushForTesting()` on the receiver side because
+  // `ExtensionFrameHost` uses `content::RenderFrameHostReceiverSet` which does
+  // not expose `FlushForTesting()`. Instead, we do a Mojo round-trip by calling
+  // a method with a callback (`GetAppInstallState`) to ensure all previous
+  // messages on the pipe have been processed.
+  void FlushForTesting() {
+    base::RunLoop run_loop;
+    GetForwardingInterface()->GetAppInstallState(
+        GURL("http://example.com"),
+        base::BindOnce(
+            [](base::OnceClosure quit_closure, const std::string&) {
+              std::move(quit_closure).Run();
+            },
+            run_loop.QuitClosure()));
+    run_loop.Run();
+  }
+
  private:
   mojom::LocalFrameHost* GetForwardingInterface() override {
     return scoped_swap_impl_.old_impl();
@@ -125,9 +155,22 @@
         std::move(port_host));
   }
 
+  void WatchedPageChange(
+      const std::vector<std::string>& css_selectors) override {
+    std::vector<std::string> mutated_selectors = css_selectors;
+    content::RenderFrameHost* current_target_frame =
+        extension_frame_host_->receivers_for_testing().GetCurrentTargetFrame();
+    if (watched_page_change_mutator_ && frame_ == current_target_frame) {
+      watched_page_change_mutator_.Run(mutated_selectors);
+    }
+
+    GetForwardingInterface()->WatchedPageChange(mutated_selectors);
+  }
+
   const raw_ptr<content::RenderFrameHost> frame_ = nullptr;
   RequestMutator request_mutator_;
   OpenChannelToExtensionMutator open_extension_mutator_;
+  WatchedPageChangeMutator watched_page_change_mutator_;
   const raw_ptr<ExtensionFrameHost> extension_frame_host_ = nullptr;
   const mojo::test::ScopedSwapImplForTesting<mojom::LocalFrameHost>
       scoped_swap_impl_;
@@ -745,4 +788,174 @@
             kill_waiter.Wait());
 }
 
+// Tests that a renderer sending an unrecognized selector (one the browser
+// didn't ask to watch) is ignored and does not trigger actions.
+IN_PROC_BROWSER_TEST_F(ExtensionSecurityExploitBrowserTest,
+                       WatchedPageChange_InvalidSelector_Ignored) {
+  // Install an extension that watches "div.target" and injects a script.
+  TestExtensionDir dir;
+  dir.WriteManifest(R"({
+    "name": "Extension",
+    "version": "1.0",
+    "manifest_version": 2,
+    "permissions": [ "declarativeContent", "http://foo.com/*" ],
+    "background": {"scripts": ["background.js"]}
+  })");
+  dir.WriteFile(FILE_PATH_LITERAL("background.js"), R"(
+    chrome.runtime.onInstalled.addListener(() => {
+      chrome.declarativeContent.onPageChanged.removeRules(undefined, () => {
+        chrome.declarativeContent.onPageChanged.addRules([{
+          conditions: [

diff --git a/chrome/browser/extensions/extension_security_exploit_browsertest.cc b/chrome/browser/extensions/extension_security_exploit_browsertest.cc
index 151756f..85d5859 100644
--- a/chrome/browser/extensions/extension_security_exploit_browsertest.cc
+++ b/chrome/browser/extensions/extension_security_exploit_browsertest.cc
@@ -35,6 +35,7 @@
 #include "extensions/browser/extension_web_contents_observer.h"
 #include "extensions/browser/process_manager.h"
 #include "extensions/browser/renderer_startup_helper.h"
+#include "extensions/browser/script_injection_tracker.h"
 #include "extensions/browser/service_worker/service_worker_host.h"
 #include "extensions/common/constants.h"
 #include "extensions/common/extension_features.h"
@@ -85,6 +86,35 @@
     open_extension_mutator_ = std::move(open_extension_mutator);
   }
 
+  void SimulateWatchedPageChange(
+      const std::vector<std::string>& css_selectors) {
+    GetForwardingInterface()->WatchedPageChange(css_selectors);
+  }
+
+  using WatchedPageChangeMutator =
+      base::RepeatingCallback<void(std::vector<std::string>& css_selectors)>;
+  void SetWatchedPageChangeMutator(
+      WatchedPageChangeMutator watched_page_change_mutator) {
+    watched_page_change_mutator_ = std::move(watched_page_change_mutator);
+  }
+
+  // We cannot call `FlushForTesting()` on the receiver side because
+  // `ExtensionFrameHost` uses `content::RenderFrameHostReceiverSet` which does
+  // not expose `FlushForTesting()`. Instead, we do a Mojo round-trip by calling
+  // a method with a callback (`GetAppInstallState`) to ensure all previous
+  // messages on the pipe have been processed.
+  void FlushForTesting() {
+    base::RunLoop run_loop;
+    GetForwardingInterface()->GetAppInstallState(
+        GURL("http://example.com"),
+        base::BindOnce(
+            [](base::OnceClosure quit_closure, const std::string&) {
+              std::move(quit_closure).Run();
+            },
+            run_loop.QuitClosure()));
+    run_loop.Run();
+  }
+
  private:
   mojom::LocalFrameHost* GetForwardingInterface() override {
     return scoped_swap_impl_.old_impl();
@@ -125,9 +155,22 @@
         std::move(port_host));
   }
 
+  void WatchedPageChange(
+      const std::vector<std::string>& css_selectors) override {
+    std::vector<std::string> mutated_selectors = css_selectors;
+    content::RenderFrameHost* current_target_frame =
+        extension_frame_host_->receivers_for_testing().GetCurrentTargetFrame();
+    if (watched_page_change_mutator_ && frame_ == current_target_frame) {
+      watched_page_change_mutator_.Run(mutated_selectors);
+    }
+
+    GetForwardingInterface()->WatchedPageChange(mutated_selectors);
+  }
+
   const raw_ptr<content::RenderFrameHost> frame_ = nullptr;
   RequestMutator request_mutator_;
   OpenChannelToExtensionMutator open_extension_mutator_;
+  WatchedPageChangeMutator watched_page_change_mutator_;
   const raw_ptr<ExtensionFrameHost> extension_frame_host_ = nullptr;
   const mojo::test::ScopedSwapImplForTesting<mojom::LocalFrameHost>
       scoped_swap_impl_;
@@ -745,4 +788,174 @@
             kill_waiter.Wait());
 }
 
+// Tests that a renderer sending an unrecognized selector (one the browser
+// didn't ask to watch) is ignored and does not trigger actions.
+IN_PROC_BROWSER_TEST_F(ExtensionSecurityExploitBrowserTest,
+                       WatchedPageChange_InvalidSelector_Ignored) {
+  // Install an extension that watches "div.target" and injects a script.
+  TestExtensionDir dir;
+  dir.WriteManifest(R"({
+    "name": "Extension",
+    "version": "1.0",
+    "manifest_version": 2,
+    "permissions": [ "declarativeContent", "http://foo.com/*" ],
+    "background": {"scripts": ["background.js"]}
+  })");
+  dir.WriteFile(FILE_PATH_LITERAL("background.js"), R"(
+    chrome.runtime.onInstalled.addListener(() => {
+      chrome.declarativeContent.onPageChanged.removeRules(undefined, () => {
+        chrome.declarativeContent.onPageChanged.addRules([{
+          conditions: [
+            new chrome.declarativeContent.PageStateMatcher({
+              css: ["div.target"]
+            })
+          ],
+          actions: [
+            new chrome.declarativeContent.RequestContentScript({
+              js: ["script.js"]
+            })
+          ]
+        }]);
+      });
+    });
+  )");
+  dir.WriteFile(FILE_PATH_LITERAL("script.js"), "console.log('injected');");
+
+  const Extension* extension = LoadExtension(dir.UnpackedPath());
+  ASSERT_TRUE(extension);
+
+  // Navigate to a test page on foo.com where the extension has permission.
+  GURL test_page_url =
+      embedded_test_server()->GetURL("foo.com", "/title1.html");
+  auto* web_contents = GetActiveWebContents();
+  ASSERT_TRUE(NavigateToURL(web_contents, test_page_url));
+  content::RenderFrameHost* main_frame = web_contents->GetPrimaryMainFrame();
+
+  // Prepare to intercept WatchedPageChange.
+  auto interceptor =
+      std::make_unique<ExtensionFrameHostInterceptor>(main_frame);
+
+  // Simulate a spoofed IPC with a selector the browser didn't ask to watch.
+  std::vector<std::string> spoofed_selectors = {"div.spoofed"};
+  interceptor->SimulateWatchedPageChange(spoofed_selectors);
+  interceptor->FlushForTesting();
+
+  // Verify that `ScriptInjectionTracker` doesn't show injection for the
+  // extension.
+  EXPECT_FALSE(ScriptInjectionTracker::DidProcessRunContentScriptFromExtension(
+      *main_frame->GetProcess(), extension->id()));
+
+  // Now simulate a valid selector to prove it *would* work.
+  std::vector<std::string> valid_selectors = {"div.target"};
+  interceptor->SimulateWatchedPageChange(valid_selectors);
+  interceptor->FlushForTesting();
+
+  // Verify that `ScriptInjectionTracker` does show injection now.
+  EXPECT_TRUE(ScriptInjectionTracker::DidProcessRunContentScriptFromExtension(
+      *main_frame->GetProcess(), extension->id()));
+}
+
+// Tests that a renderer cannot trigger content script injection on a page the
+// extension has no permission for, even if it spoofs a valid CSS selector. This
+// is a regression test for crbug.com/497025738 and exercises the host
+// permission check in `RequestContentScript::InstructRenderProcessToInject`.
+//
+// High-level flow:
+// 1. Install Extension A that watches "div.target" on google.com. This makes
+//    the selector globally known to the browser's CSS condition tracker. This
+//    allows a compromised renderer to pass the check we have for valid
+//    selectors on the `extensions::mojom::LocalFrameHost::WatchedPageChange`
+//    IPC.
+// 2. Install Extension B that has a declarative rule to inject a script when
+//    "div.target" matches, but Extension B only has host permission for
+//    bar.com.
+// 3. Navigate to foo.com (where Extension B has no permission).
+// 4. Simulate a compromised renderer sending a
+//    `extensions::mojom::LocalFrameHost::WatchedPageChange` IPC claiming that
+//    "div.target" matched on foo.com.
+// 5. Verify that the browser blocks the script injection of Extension B because
+//    Extension B lacks permission for foo.com, despite the selector being
+//    valid.
+IN_PROC_BROWSER_TEST_F(ExtensionSecurityExploitBrowserTest,
+                       WatchedPageChange_ValidSelector_PermissionDenied) {
+  // 1. Install Extension A to make "div.target" globally known.
+  TestExtensionDir dir_a;
+  dir_a.WriteManifest(R"({
+    "name": "Extension A",
+    "version": "1.0",
+    "manifest_version": 2,
+    "permissions": [ "declarativeContent", "http://google.com/*" ],
+    "background": {"scripts": ["background.js"]}
+  })");
+  dir_a.WriteFile(FILE_PATH_LITERAL("background.js"), R"(
+    var rule = {
+      conditions: [
+        new chrome.declarativeContent.PageStateMatcher({
+          pageUrl: { hostEquals: 'google.com' },
+          css: ['div.target']
+        })
+      ],
+      actions: [ new chrome.declarativeContent.ShowAction() ]
+    };
+    chrome.runtime.onInstalled.addListener(function() {
+      chrome.declarativeContent.onPageChanged.addRules([rule]);
+    });
+  )");
+  const Extension* extension_a = LoadExtension(dir_a.UnpackedPath());
+  ASSERT_TRUE(extension_a);
+
+  // 2. Install Extension B (target). It only has permission for bar.com.
+  TestExtensionDir dir_b;
+  dir_b.WriteManifest(R"({
+    "name": "Extension B",
+    "version": "1.0",
+    "manifest_version": 2,
+    "permissions": [ "declarativeContent", "http://bar.com/*" ],
+    "background": {"scripts": ["background.js"]}
+  })");
+  dir_b.WriteFile(FILE_PATH_LITERAL("background.js"), R"(
+    var rule = {
+      conditions: [
+        new chrome.declarativeContent.PageStateMatcher({
+          css: ['div.target']
+        })
+      ],
+      actions: [ new chrome.declarativeContent.RequestContentScript({
+        js: ["content.js"]
+      }) ]
+    };
+    chrome.runtime.onInstalled.addListener(function() {
+      chrome.declarativeContent.onPageChanged.addRules([rule]);
+    });
+  )");
+  dir_b.WriteFile(FILE_PATH_LITERAL("content.js"), R"(
+    chrome.test.sendMessage('injected');
+  )");
+  const Extension* extension_b = LoadExtension(dir_b.UnpackedPath());
+  ASSERT_TRUE(extension_b);
+
+  // Navigate to foo.com (where Extension B has no permission).
+  GURL test_page_url =
+      embedded_test_server()->GetURL("foo.com", "/title1.html");
+  auto* web_contents = GetActiveWebContents();
+  ASSERT_TRUE(NavigateToURL(web_contents, test_page_url));
+  content::RenderFrameHost* main_frame = web_contents->GetPrimaryMainFrame();
+
+  // Prepare to intercept WatchedPageChange.
+  auto interceptor =
+      std::make_unique<ExtensionFrameHostInterceptor>(main_frame);
+
+  // Simulate a spoofed IPC with a selector that is valid globally, bypassing
+  // the IPC check.
+  std::vector<std::string> spoofed_selectors = {"div.target"};
+  interceptor->SimulateWatchedPageChange(spoofed_selectors);
+  interceptor->FlushForTesting();
+
+  // Verify that `ScriptInjectionTracker` doesn't show injection for Extension B
+  // on foo.com because we've checked that the extension has host permission
+  // before allowing the script injection.
+  EXPECT_FALSE(ScriptInjectionTracker::DidProcessRunContentScriptFromExtension(
+      *main_frame->GetProcess(), extension_b->id()));
+}
+
 }  // namespace extensions