PatchGap
Chrome · PDF

CVE-2026-11261

Logic Error in PDF
Low chrome Logic Error 📄 Reporter bug report 🔧 Commit mapped

Overview

Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInsufficient validation of untrusted input in PDF
DescriptionInsufficient validation of untrusted input in PDF
ComponentPDF
Bug ClassLogic Error
Tracker499262832
Fix commitf1cf2f24ebff (chromium/src) +10/-8
CISA KEVNot listed
CreditedGoogle
Disclosed2026-06-02

Files Changed

  • chrome/browser/chrome_content_browser_client_receiver_bindings.cc

Patch

view commit
From f1cf2f24ebff9b5fe9a075e90d85af7e4df00792 Mon Sep 17 00:00:00 2001
From: Lei Zhang <thestig@chromium.org>
Date: Wed, 08 Apr 2026 09:09:54 -0700
Subject: [PATCH] [PDF] Only bind pdf::mojom::PdfHost for PDF renderers

Only allow renderers that legitimately need PdfHost interface access to
bind to it.

Bug: 499262832
Change-Id: Ie41c30b902bdedff49cd720b8bef2d4aa7c0a949
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7735798
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1611565}
---

diff --git a/chrome/browser/chrome_content_browser_client_receiver_bindings.cc b/chrome/browser/chrome_content_browser_client_receiver_bindings.cc
index 2856642..13d6a92 100644
--- a/chrome/browser/chrome_content_browser_client_receiver_bindings.cc
+++ b/chrome/browser/chrome_content_browser_client_receiver_bindings.cc
@@ -544,14 +544,16 @@
           },
           &render_frame_host));
 #if BUILDFLAG(ENABLE_PDF)
-  associated_registry.AddInterface<pdf::mojom::PdfHost>(base::BindRepeating(
-      [](content::RenderFrameHost* render_frame_host,
-         mojo::PendingAssociatedReceiver<pdf::mojom::PdfHost> receiver) {
-        pdf::PDFDocumentHelper::BindPdfHost(
-            std::move(receiver), render_frame_host,
-            std::make_unique<ChromePDFDocumentHelperClient>());
-      },
-      &render_frame_host));
+  if (render_frame_host.GetProcess()->IsPdf()) {
+    associated_registry.AddInterface<pdf::mojom::PdfHost>(base::BindRepeating(
+        [](content::RenderFrameHost* render_frame_host,
+           mojo::PendingAssociatedReceiver<pdf::mojom::PdfHost> receiver) {
+          pdf::PDFDocumentHelper::BindPdfHost(
+              std::move(receiver), render_frame_host,
+              std::make_unique<ChromePDFDocumentHelperClient>());
+        },
+        &render_frame_host));
+  }
 #endif  // BUILDFLAG(ENABLE_PDF)
 #if !BUILDFLAG(IS_ANDROID)
   associated_registry.AddInterface<search::mojom::EmbeddedSearchConnector>(
Loading diff…

Original Bug Report

reported by vm...@google.com

Cross-origin content spoofing in Lens via unguarded PdfHost

Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports without the security team.

Overview: A compromised subframe can bind the unguarded PdfHost interface to inject a malicious PDF helper. Contextualization features incorrectly use this helper, attributing attacker-controlled bytes to the main frame’s URL.

Affected files:

  • chrome/browser/chrome_content_browser_client_receiver_bindings.cc
  • components/pdf/browser/pdf_document_helper.cc
  • chrome/browser/ui/lens/lens_search_contextualization_controller.cc
  • chrome/browser/ui/contextual_search/tab_contextualization_controller.cc

Estimated timestamp from git blame: 2025-09-08

Root Cause

Initial logic and frame tree registrations are validated. The pdf::mojom::PdfHost interface is registered unconditionally for all RenderFrameHosts in chrome_content_browser_client_receiver_bindings.cc without origin or MIME type restrictions.

Potential Vulnerability Mechanism

  1. A compromised subframe establishes its context and binds pdf::mojom::PdfHost, injecting a PDFDocumentHelper.
  2. Standard contextualization processing is applied when the user interacts with Google Lens or Tab Contextualization on the main page.
  3. The pipeline jumps directly to PDFDocumentHelper::MaybeGetForWebContents(). This method iterates over all frames and immediately returns the attacker’s injected helper.
  4. The contextualization controllers extract the attacker’s payload via GetPdfBytes(), completely bypassing legitimate main-frame text extraction.
  5. The final payload is constructed in LensOverlayQueryController::CreatePageContentPayload(), directly combining the attacker’s bytes with the main frame’s URL, effectively spoofing the trusted origin to the AI backend.

Note: These are potential steps as our tooling agent cannot execute live code to provide a working PoC.

Suggested Fix

Modify MaybeGetForWebContents() to only return a PDFDocumentHelper if it belongs to the primary main frame. Alternatively, require the contextualization controllers (like LensSearchContextualizationController and TabContextualizationController) to explicitly verify that the main frame’s MIME type is application/pdf before entering the PDF extraction path, similar to the existing logic in PageContextFetcher.

Evaluated with Chrome root at commit: ff3d2b74fa39431785bd60e51463b08fcc71ee33

Results so far have been promising, but there can be wrong deductions. If this proves to be a false positive, please close as WAI; data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.

View on issue tracker
On This Page