CVE-2026-113005

Medium chrome Memory Corruption 📄 Reporter bug report 🔧 Commit mapped

Overview

Medium

Severity

—

CVSS

Exploited ITW

Fixed

Fix Status

ImpactMemory corruption in Bluetooth

DescriptionMemory corruption in Bluetooth

ComponentBluetooth

Sub-componentWebBluetooth

Bug ClassMemory Corruption

Tracker503584859

Fix commit52f747427d8a (chromium/src) +178/-1

CISA KEVNot listed

CreditedGoogle

Disclosed2026-10-20

Changed Functions

Function	Change	Notes
`if` content/browser/bluetooth/web_bluetooth_service_impl.cc	modified
`TEST_F` content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc	modified

Files Changed

third_party/blink/renderer/modules/bluetooth/bluetooth_error.cc
third_party/blink/public/mojom/bluetooth/web_bluetooth.mojom
content/browser/bluetooth/web_bluetooth_service_impl.cc
content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc
content/browser/bluetooth/web_bluetooth_service_impl.h

Patch

view commit

From 52f747427d8a7ae9015092ee25ce3217ae6b0993 Mon Sep 17 00:00:00 2001
From: lukedeng <lukedeng@chromium.org>
Date: Tue, 22 Sep 2026 09:59:39 -0700
Subject: [PATCH] [WebBluetooth] Check user activation in the browser process

WebBluetooth RequestDevice and RequestScanningStart require transient
user activation, but the check was previously only performed in the
renderer before sending the Mojo IPC. Mirror the check in the
browser-side handlers so that device choosers and scanning prompts
cannot be triggered by inactive frames or without transient user
activation.

Unlike WebUSB/HID/Serial, WebBluetooth intentionally checks
HasTransientUserActivation() without consuming activation, matching
the Web Bluetooth specification and existing WPT tests.

Bug: 503584859
Change-Id: I768ea03180528b79cf582c2b8096886b940497e2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8416585
Reviewed-by: Matt Reynolds <mattreynolds@chromium.org>
Reviewed-by: Nasko Oskov <nasko@chromium.org>
Commit-Queue: Luke Deng <lukedeng@google.com>
Cr-Commit-Position: refs/heads/main@{#1702738}
---
diff --git a/content/browser/bluetooth/web_bluetooth_service_impl.cc b/content/browser/bluetooth/web_bluetooth_service_impl.cc
index aedfe3b8..272d6fc 100644
--- a/content/browser/bluetooth/web_bluetooth_service_impl.cc
+++ b/content/browser/bluetooth/web_bluetooth_service_impl.cc
@@ -856,6 +856,23 @@
     return;
   }
 
+  // Ensure the requesting document is still active and has transient user
+  // activation to prevent inactive/pending-deletion frames or compromised
+  // renderers from opening choosers without user intent.
+  if (!render_frame_host().IsActive()) {
+    std::move(callback).Run(
+        blink::mojom::WebBluetoothResult::DOCUMENT_NOT_ACTIVE,
+        /*device=*/nullptr);
+    return;
+  }
+
+  if (!render_frame_host().HasTransientUserActivation()) {
+    std::move(callback).Run(
+        blink::mojom::WebBluetoothResult::USER_ACTIVATION_REQUIRED,
+        /*device=*/nullptr);
+    return;
+  }
+
   if (!GetAdapter() &&
       !BluetoothAdapterFactoryWrapper::Get().IsLowEnergySupported()) {
     std::move(callback).Run(
@@ -1645,6 +1662,21 @@
     return;
   }
 
+  // Ensure the requesting document is still active and has transient user
+  // activation to prevent inactive/pending-deletion frames or compromised
+  // renderers from opening scanning prompts without user intent.
+  if (!render_frame_host().IsActive()) {
+    std::move(callback).Run(
+        blink::mojom::WebBluetoothResult::DOCUMENT_NOT_ACTIVE);
+    return;
+  }
+
+  if (!render_frame_host().HasTransientUserActivation()) {
+    std::move(callback).Run(
+        blink::mojom::WebBluetoothResult::USER_ACTIVATION_REQUIRED);
+    return;
+  }
+
   if (!GetAdapter() &&
       !BluetoothAdapterFactoryWrapper::Get().IsLowEnergySupported()) {
     std::move(callback).Run(
@@ -1747,6 +1779,12 @@
     return;
   }
 
+  if (!render_frame_host().IsActive()) {
+    std::move(callback).Run(
+        blink::mojom::WebBluetoothResult::DOCUMENT_NOT_ACTIVE);
+    return;
+  }
+
   if (request_scanning_start_callback_) {
     std::move(callback).Run(blink::mojom::WebBluetoothResult::PROMPT_CANCELED);
     return;
@@ -1800,6 +1838,13 @@
   CHECK_CURRENTLY_ON(BrowserThread::UI, base::NotFatalUntil::M160);
   CHECK(!ble_scan_discovery_session_, base::NotFatalUntil::M160);
 
+  if (!render_frame_host().IsActive()) {
+    std::move(request_scanning_start_callback_)
+        .Run(blink::mojom::WebBluetoothResult::DOCUMENT_NOT_ACTIVE);
+    MaybeStopDiscovery();
+    return;
+  }
+
   ble_scan_discovery_session_ = std::move(session);
 
   auto scanning_client = std::make_unique<ScanningClient>(
@@ -1842,6 +1887,13 @@
     return;
   }
 
+  if (!render_frame_host().IsActive()) {
+    std::move(callback).Run(
+        blink::mojom::WebBluetoothResult::DOCUMENT_NOT_ACTIVE,
+        /*device=*/nullptr);
+    return;
+  }
+
   // Close any opened chooser before constructing a new one. Destroying the
   // chooser UI may trigger activation observers that synchronously destroy the
   // hosting WebContents (and therefore `this`). Guard with a WeakPtr.
@@ -2080,6 +2132,13 @@
     const std::string& device_address) {
   device_chooser_controller_.reset();
 
+  if (!render_frame_host().IsActive()) {
+    std::move(callback).Run(
+        blink::mojom::WebBluetoothResult::DOCUMENT_NOT_ACTIVE,
+        /*device=*/nullptr);
+    return;
+  }
+
   if (result != blink::mojom::WebBluetoothResult::SUCCESS) {
     // Errors are recorded by |device_chooser_controller_|.
     std::move(callback).Run(result, /*device=*/nullptr);
diff --git a/content/browser/bluetooth/web_bluetooth_service_impl.h b/content/browser/bluetooth/web_bluetooth_service_impl.h
index 899cb302..9abe156c 100644
--- a/content/browser/bluetooth/web_bluetooth_service_impl.h
+++ b/content/browser/bluetooth/web_bluetooth_service_impl.h
@@ -142,6 +142,16 @@
                            DestroyedDuringRequestDeviceReset);
   FRIEND_TEST_ALL_PREFIXES(WebBluetoothServiceImplTest,
                            DestroyedDuringRequestScanningStart);
+  FRIEND_TEST_ALL_PREFIXES(WebBluetoothServiceImplTest,
+                           RequestDeviceWithoutUserActivation);
+  FRIEND_TEST_ALL_PREFIXES(WebBluetoothServiceImplTest,
+                           RequestDeviceDoesNotConsumeUserActivation);
+  FRIEND_TEST_ALL_PREFIXES(WebBluetoothServiceImplTest,
+                           RequestDeviceWhenDocumentNotActive);
+  FRIEND_TEST_ALL_PREFIXES(WebBluetoothServiceImplTest,
+                           RequestScanningStartWithoutUserActivation);
+  FRIEND_TEST_ALL_PREFIXES(WebBluetoothServiceImplTest,
+                           RequestScanningStartWhenDocumentNotActive);
   FRIEND_TEST_ALL_PREFIXES(WebBluetoothServiceImplTest, PermissionAllowed);
   FRIEND_TEST_ALL_PREFIXES(WebBluetoothServiceImplTest,
                            PermissionPromptCanceled);
diff --git a/third_party/blink/public/mojom/bluetooth/web_bluetooth.mojom b/third_party/blink/public/mojom/bluetooth/web_bluetooth.mojom
index 28834f70..ea29265 100644
--- a/third_party/blink/public/mojom/bluetooth/web_bluetooth.mojom
+++ b/third_party/blink/public/mojom/bluetooth/web_bluetooth.mojom
@@ -39,7 +39,8 @@
 // RemoteServiceGetCharacteristics("service1", ...).
 
 // Result codes that can occur during Web Bluetooth execution.
-// Transformed to a DOMException in Source/modules/bluetooth/BluetoothError.cpp.
+// Transformed to a DOMException in
+// third_party/blink/renderer/modules/bluetooth/bluetooth_error.cc.
 //
 // These errors all produce constant message strings. If a particular message
 // needs a dynamic component, we should add a separate enum so type-checking the
@@ -56,6 +57,7 @@
   CHARACTERISTIC_NO_LONGER_EXISTS,
   PROMPT_CANCELED,
   CONNECT_DOES_NOT_EXIST,
+  DOCUMENT_NOT_ACTIVE,
   // NetworkError:
   CONNECT_ALREADY_IN_PROGRESS,
   CONNECT_AUTH_CANCELED,
@@ -113,6 +115,7 @@
   REQUEST_DEVICE_WITH_BLOCKLISTED_UUID_OR_MANUFACTURER_DATA,
   DESCRIPTOR_NO_LONGER_EXISTS,
   PERMISSIONS_POLICY_VIOLATION,
+  USER_ACTIVATION_REQUIRED,
   // NotAllowedError:
   SCANNING_BLOCKED,
 };
diff --git a/third_party/blink/renderer/modules/bluetooth/bluetooth_error.cc b/third_party/blink/renderer/modules/bluetooth/bluetooth_error.cc
index f5515ad8..05f6984 100644
--- a/third_party/blink/renderer/modules/bluetooth/bluetooth_error.cc
+++ b/third_party/blink/renderer/modules/bluetooth/bluetooth_error.cc
@@ -118,6 +118,8 @@
                 "Connection Error: Not connected.");
       MAP_ERROR(CONNECT_NON_AUTH_TIMEOUT, DOMExceptionCode::kInvalidStateError,
                 "Connection Error: Non-authentication timeout.");
+      MAP_ERROR(DOCUMENT_NOT_ACTIVE, DOMExceptionCode::kInvalidStateError,
+                "The document is not active.");
 
       // NetworkErrors:
       MAP_ERROR(CONNECT_ALREADY_IN_PROGRESS, DOMExceptionCode::kNetworkError,
@@ -224,6 +226,9 @@
       MAP_ERROR(PERMISSIONS_POLICY_VIOLATION, DOMExceptionCode::kSecurityError,
                 "Access to the feature \"bluetooth\" is disallowed by "
                 "permissions policy.");
+      MAP_ERROR(
+          USER_ACTIVATION_REQUIRED, DOMExceptionCode::kSecurityError,
+          "Must be handling a user gesture to show a permission request.");
 
       // NotAllowedErrors:
       MAP_ERROR(SCANNING_BLOCKED, DOMExceptionCode::kNotAllowedError,
diff --git a/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc b/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc
index c764d23..067eecc 100644
--- a/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc
+++ b/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc
@@ -778,6 +778,7 @@
       const blink::mojom::WebBluetoothLeScanFilter& filter,
       FakeWebBluetoothAdvertisementClient* client,
       BluetoothScanningPrompt::Event event) {
+    contents()->GetPrimaryMainFrame()->SimulateUserActivation();
     mojo::PendingAssociatedRemote<blink::mojom::WebBluetoothAdvertisementClient>
         client_remote;
     client->BindReceiver(client_remote.InitWithNewEndpointAndPassReceiver());
@@ -961,6 +962,7 @@
 };
 
 TEST_F(WebBluetoothServiceImplTest, DestroyedDuringRequestDevice) {
+  contents()->GetPrimaryMainFrame()->SimulateUserActivation();
   auto options = blink::mojom::WebBluetoothRequestDeviceOptions::New();
   options->accept_all_devices = true;
 
@@ -974,6 +976,7 @@
 }
 
 TEST_F(WebBluetoothServiceImplTest, DestroyedDuringRequestDeviceReset) {
+  contents()->GetPrimaryMainFrame()->SimulateUserActivation();
   browser_client_.bluetooth_delegate()->set_run_bluetooth_chooser_callback(
       base::BindLambdaForTesting(
           [this](RenderFrameHost* frame,
@@ -1011,6 +1014,60 @@
   EXPECT_FALSE(future2.IsReady());
 }
 
+TEST_F(WebBluetoothServiceImplTest, RequestDeviceWithoutUserActivation) {
+  auto options = blink::mojom::WebBluetoothRequestDeviceOptions::New();
+  options->accept_all_devices = true;
+
+  TestFuture<blink::mojom::WebBluetoothResult,
+             blink::mojom::WebBluetoothDevicePtr>
+      future;
+  service_ptr_->RequestDevice(std::move(options), future.GetCallback());
+  EXPECT_EQ(future.Get<0>(),
+            blink::mojom::WebBluetoothResult::USER_ACTIVATION_REQUIRED);
+  EXPECT_TRUE(future.Get<1>().is_null());
+}
+
+TEST_F(WebBluetoothServiceImplTest, RequestDeviceDoesNotConsumeUserActivation) {
+  contents()->GetPrimaryMainFrame()->SimulateUserActivation();
+
+  auto options1 = blink::mojom::WebBluetoothRequestDeviceOptions::New();
+  options1->accept_all_devices = true;
+  TestFuture<blink::mojom::WebBluetoothResult,
+             blink::mojom::WebBluetoothDevicePtr>
+      future1;
+  service_ptr_->RequestDevice(std::move(options1), future1.GetCallback());
+  EXPECT_NE(future1.Get<0>(),
+            blink::mojom::WebBluetoothResult::USER_ACTIVATION_REQUIRED);
+
+  auto options2 = blink::mojom::WebBluetoothRequestDeviceOptions::New();
+  options2->accept_all_devices = true;
+  TestFuture<blink::mojom::WebBluetoothResult,
+             blink::mojom::WebBluetoothDevicePtr>
+      future2;
+  service_ptr_->RequestDevice(std::move(options2), future2.GetCallback());
+  EXPECT_NE(future2.Get<0>(),
+            blink::mojom::WebBluetoothResult::USER_ACTIVATION_REQUIRED);
+}
+
+TEST_F(WebBluetoothServiceImplTest, RequestDeviceWhenDocumentNotActive) {
+  contents()->GetPrimaryMainFrame()->SimulateUserActivation();
+  static_cast<RenderFrameHostImpl*>(contents()->GetPrimaryMainFrame())
+      ->SetLifecycleState(
+          RenderFrameHostLifecycleStateImpl::kRunningUnloadHandlers);
+  EXPECT_FALSE(contents()->GetPrimaryMainFrame()->IsActive());
+
+  auto options = blink::mojom::WebBluetoothRequestDeviceOptions::New();
+  options->accept_all_devices = true;
+
+  TestFuture<blink::mojom::WebBluetoothResult,
+             blink::mojom::WebBluetoothDevicePtr>
+      future;
+  service_ptr_->RequestDevice(std::move(options), future.GetCallback());
+  EXPECT_EQ(future.Get<0>(),
+            blink::mojom::WebBluetoothResult::DOCUMENT_NOT_ACTIVE);
+  EXPECT_TRUE(future.Get<1>().is_null());
+}
+
 TEST_F(WebBluetoothServiceImplTest, PermissionAllowed) {
   blink::mojom::WebBluetoothLeScanFilterPtr filter = CreateScanFilter("a", "b");
   std::optional<WebBluetoothServiceImpl::ScanFilters> filters;
@@ -1028,6 +1085,7 @@
 }
 
 TEST_F(WebBluetoothServiceImplTest, DestroyedDuringRequestScanningStart) {
+  contents()->GetPrimaryMainFrame()->SimulateUserActivation();
   blink::mojom::WebBluetoothLeScanFilterPtr filter = CreateScanFilter("a", "b");
   std::optional<WebBluetoothServiceImpl::ScanFilters> filters;
 
@@ -1058,6 +1116,48 @@
   loop.RunUntilIdle();
 }
 
+TEST_F(WebBluetoothServiceImplTest, RequestScanningStartWithoutUserActivation) {
+  blink::mojom::WebBluetoothLeScanFilterPtr filter = CreateScanFilter("a", "b");
+  FakeWebBluetoothAdvertisementClient client;
+  mojo::PendingAssociatedRemote<blink::mojom::WebBluetoothAdvertisementClient>
+      client_remote;
+  client.BindReceiver(client_remote.InitWithNewEndpointAndPassReceiver());
+
+  auto options = blink::mojom::WebBluetoothRequestLEScanOptions::New();
+  options->filters.emplace();
+  options->filters->push_back(std::move(filter));
+
+  TestFuture<blink::mojom::WebBluetoothResult> future;
+  service_ptr_->RequestScanningStart(std::move(client_remote),
+                                     std::move(options), future.GetCallback());
+  EXPECT_EQ(future.Get(),
+            blink::mojom::WebBluetoothResult::USER_ACTIVATION_REQUIRED);
+}
+
+TEST_F(WebBluetoothServiceImplTest, RequestScanningStartWhenDocumentNotActive) {
+  contents()->GetPrimaryMainFrame()->SimulateUserActivation();
+  static_cast<RenderFrameHostImpl*>(contents()->GetPrimaryMainFrame())
+      ->SetLifecycleState(
+          RenderFrameHostLifecycleStateImpl::kRunningUnloadHandlers);
+  EXPECT_FALSE(contents()->GetPrimaryMainFrame()->IsActive());
+
+  blink::mojom::WebBluetoothLeScanFilterPtr filter = CreateScanFilter("a", "b");
+  FakeWebBluetoothAdvertisementClient client;
+  mojo::PendingAssociatedRemote<blink::mojom::WebBluetoothAdvertisementClient>
+      client_remote;
+  client.BindReceiver(client_remote.InitWithNewEndpointAndPassReceiver());
+
+  auto options = blink::mojom::WebBluetoothRequestLEScanOptions::New();
+  options->filters.emplace();
+  options->filters->push_back(std::move(filter));
+
+  TestFuture<blink::mojom::WebBluetoothResult> future;
+  service_ptr_->RequestScanningStart(std::move(client_remote),
+                                     std::move(options), future.GetCallback());
+  EXPECT_EQ(future.Get(),
+            blink::mojom::WebBluetoothResult::DOCUMENT_NOT_ACTIVE);
+}
+
 TEST_F(WebBluetoothServiceImplTest, PermissionPromptCanceled) {
   blink::mojom::WebBluetoothLeScanFilterPtr filter = CreateScanFilter("a", "b");
   std::optional<WebBluetoothServiceImpl::ScanFilters> filters;

Loading diff…

Regression Test / PoC

shipped with the fix

diff --git a/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc b/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc
index c764d23..067eecc 100644
--- a/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc
+++ b/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc
@@ -778,6 +778,7 @@
       const blink::mojom::WebBluetoothLeScanFilter& filter,
       FakeWebBluetoothAdvertisementClient* client,
       BluetoothScanningPrompt::Event event) {
+    contents()->GetPrimaryMainFrame()->SimulateUserActivation();
     mojo::PendingAssociatedRemote<blink::mojom::WebBluetoothAdvertisementClient>
         client_remote;
     client->BindReceiver(client_remote.InitWithNewEndpointAndPassReceiver());
@@ -961,6 +962,7 @@
 };
 
 TEST_F(WebBluetoothServiceImplTest, DestroyedDuringRequestDevice) {
+  contents()->GetPrimaryMainFrame()->SimulateUserActivation();
   auto options = blink::mojom::WebBluetoothRequestDeviceOptions::New();
   options->accept_all_devices = true;
 
@@ -974,6 +976,7 @@
 }
 
 TEST_F(WebBluetoothServiceImplTest, DestroyedDuringRequestDeviceReset) {
+  contents()->GetPrimaryMainFrame()->SimulateUserActivation();
   browser_client_.bluetooth_delegate()->set_run_bluetooth_chooser_callback(
       base::BindLambdaForTesting(
           [this](RenderFrameHost* frame,
@@ -1011,6 +1014,60 @@
   EXPECT_FALSE(future2.IsReady());
 }
 
+TEST_F(WebBluetoothServiceImplTest, RequestDeviceWithoutUserActivation) {
+  auto options = blink::mojom::WebBluetoothRequestDeviceOptions::New();
+  options->accept_all_devices = true;
+
+  TestFuture<blink::mojom::WebBluetoothResult,
+             blink::mojom::WebBluetoothDevicePtr>
+      future;
+  service_ptr_->RequestDevice(std::move(options), future.GetCallback());
+  EXPECT_EQ(future.Get<0>(),
+            blink::mojom::WebBluetoothResult::USER_ACTIVATION_REQUIRED);
+  EXPECT_TRUE(future.Get<1>().is_null());
+}
+
+TEST_F(WebBluetoothServiceImplTest, RequestDeviceDoesNotConsumeUserActivation) {
+  contents()->GetPrimaryMainFrame()->SimulateUserActivation();
+
+  auto options1 = blink::mojom::WebBluetoothRequestDeviceOptions::New();
+  options1->accept_all_devices = true;
+  TestFuture<blink::mojom::WebBluetoothResult,
+             blink::mojom::WebBluetoothDevicePtr>
+      future1;
+  service_ptr_->RequestDevice(std::move(options1), future1.GetCallback());
+  EXPECT_NE(future1.Get<0>(),
+            blink::mojom::WebBluetoothResult::USER_ACTIVATION_REQUIRED);
+
+  auto options2 = blink::mojom::WebBluetoothRequestDeviceOptions::New();
+  options2->accept_all_devices = true;
+  TestFuture<blink::mojom::WebBluetoothResult,
+             blink::mojom::WebBluetoothDevicePtr>
+      future2;
+  service_ptr_->RequestDevice(std::move(options2), future2.GetCallback());
+  EXPECT_NE(future2.Get<0>(),
+            blink::mojom::WebBluetoothResult::USER_ACTIVATION_REQUIRED);
+}
+
+TEST_F(WebBluetoothServiceImplTest, RequestDeviceWhenDocumentNotActive) {
+  contents()->GetPrimaryMainFrame()->SimulateUserActivation();
+  static_cast<RenderFrameHostImpl*>(contents()->GetPrimaryMainFrame())
+      ->SetLifecycleState(
+          RenderFrameHostLifecycleStateImpl::kRunningUnloadHandlers);
+  EXPECT_FALSE(contents()->GetPrimaryMainFrame()->IsActive());
+
+  auto options = blink::mojom::WebBluetoothRequestDeviceOptions::New();
+  options->accept_all_devices = true;
+
+  TestFuture<blink::mojom::WebBluetoothResult,
+             blink::mojom::WebBluetoothDevicePtr>
+      future;
+  service_ptr_->RequestDevice(std::move(options), future.GetCallback());
+  EXPECT_EQ(future.Get<0>(),
+            blink::mojom::WebBluetoothResult::DOCUMENT_NOT_ACTIVE);
+  EXPECT_TRUE(future.Get<1>().is_null());
+}
+
 TEST_F(WebBluetoothServiceImplTest, PermissionAllowed) {
   blink::mojom::WebBluetoothLeScanFilterPtr filter = CreateScanFilter("a", "b");
   std::optional<WebBluetoothServiceImpl::ScanFilters> filters;
@@ -1028,6 +1085,7 @@
 }
 
 TEST_F(WebBluetoothServiceImplTest, DestroyedDuringRequestScanningStart) {
+  contents()->GetPrimaryMainFrame()->SimulateUserActivation();
   blink::mojom::WebBluetoothLeScanFilterPtr filter = CreateScanFilter("a", "b");
   std::optional<WebBluetoothServiceImpl::ScanFilters> filters;
 
@@ -1058,6 +1116,48 @@
   loop.RunUntilIdle();
 }
 
+TEST_F(WebBluetoothServiceImplTest, RequestScanningStartWithoutUserActivation) {
+  blink::mojom::WebBluetoothLeScanFilterPtr filter = CreateScanFilter("a", "b");
+  FakeWebBluetoothAdvertisementClient client;
+  mojo::PendingAssociatedRemote<blink::mojom::WebBluetoothAdvertisementClient>
+      client_remote;
+  client.BindReceiver(client_remote.InitWithNewEndpointAndPassReceiver());
+
+  auto options = blink::mojom::WebBluetoothRequestLEScanOptions::New();
+  options->filters.emplace();
+  options->filters->push_back(std::move(filter));
+
+  TestFuture<blink::mojom::WebBluetoothResult> future;
+  service_ptr_->RequestScanningStart(std::move(client_remote),
+                                     std::move(options), future.GetCallback());
+  EXPECT_EQ(future.Get(),
+            blink::mojom::WebBluetoothResult::USER_ACTIVATION_REQUIRED);
+}
+
+TEST_F(WebBluetoothServiceImplTest, RequestScanningStartWhenDocumentNotActive) {
+  contents()->GetPrimaryMainFrame()->SimulateUserActivation();
+  static_cast<RenderFrameHostImpl*>(contents()->GetPrimaryMainFrame())
+      ->SetLifecycleState(
+          RenderFrameHostLifecycleStateImpl::kRunningUnloadHandlers);
+  EXPECT_FALSE(contents()->GetPrimaryMainFrame()->IsActive());
+
+  blink::mojom::WebBluetoothLeScanFilterPtr filter = CreateScanFilter("a", "b");
+  FakeWebBluetoothAdvertisementClient client;
+  mojo::PendingAssociatedRemote<blink::mojom::WebBluetoothAdvertisementClient>
+      client_remote;
+  client.BindReceiver(client_remote.InitWithNewEndpointAndPassReceiver());
+
+  auto options = blink::mojom::WebBluetoothRequestLEScanOptions::New();
+  options->filters.emplace();
+  options->filters->push_back(std::move(filter));
+
+  TestFuture<blink::mojom::WebBluetoothResult> future;
+  service_ptr_->RequestScanningStart(std::move(client_remote),
+                                     std::move(options), future.GetCallback());
+  EXPECT_EQ(future.Get(),
+            blink::mojom::WebBluetoothResult::DOCUMENT_NOT_ACTIVE);
+}
+
 TEST_F(WebBluetoothServiceImplTest, PermissionPromptCanceled) {
   blink::mojom::WebBluetoothLeScanFilterPtr filter = CreateScanFilter("a", "b");
   std::optional<WebBluetoothServiceImpl::ScanFilters> filters;

Loading diff…

Original Bug Report

reported by fe...@google.com

Systemic User Activation bypass in WebBluetooth via Mojo

Pasting the entirety of http://b/495429423 but bug is about the 1 specific instance in the title.

Flapjack (go/flapjack), an LLM-powered static analysis tool, has identified the following potential security issue.

Overview: Several sensitive Mojo interfaces in the browser process fail to properly verify transient user activation before displaying UI choosers or pickers. A compromised renderer can bypass Blink’s security checks and directly invoke these interfaces to trigger dialogs without genuine user intent. When combined with an ‘Enter key holding’ social engineering attack, this can lead to unauthorized file system write access or hardware device access.

Affected files:

content/browser/file_system_access/file_system_access_manager_impl.cc
content/browser/usb/web_usb_service_impl.cc
content/browser/bluetooth/web_bluetooth_service_impl.cc
content/browser/serial/serial_service.cc
content/browser/hid/hid_service.cc
chrome/browser/webshare/share_service_impl.cc
content/browser/contacts/contacts_manager_impl.cc
content/browser/presentation/presentation_service_impl.cc

Estimated timestamp from git blame: 2025-12-23

Summary

There is a potential systemic vulnerability across multiple browser-side Mojo interface implementations where transient user activation is either improperly verified or entirely unchecked before displaying sensitive UI elements (like file pickers and device choosers).

Chrome’s security architecture (User Activation v2) dictates that the browser process must be the authoritative source of truth for user activation. While Blink (the renderer) performs checks before sending these Mojo messages, a compromised renderer can bypass the Blink bindings and call the Mojo methods directly. Without robust browser-side enforcement, an attacker can forcefully display these dialogs and potentially exploit them via social engineering.

Technical Details

File System Access API (Flawed Check): In content/browser/file_system_access/file_system_access_manager_impl.cc (FileSystemAccessManagerImpl::ChooseEntries), the code attempts to consume user activation:
```
if (GetContentClient()->browser()->IsTransientActivationRequiredForShowFileOrDirectoryPicker(WebContents::FromRenderFrameHost(rfh))) {
  FrameTreeNode::From(rfh)->UpdateUserActivationState(
      blink::mojom::UserActivationUpdateType::kConsumeTransientActivation,
      blink::mojom::UserActivationNotificationType::kNone);
}
// Execution continues regardless of the return value...
```
The method UpdateUserActivationState returns a bool indicating whether transient activation was actually present and successfully consumed. However, ChooseEntries completely ignores this return value and proceeds to show the file picker even if it evaluates to false.
Hardware APIs & Other Pickers (Missing Checks): The browser-side implementations for the following APIs do not perform any transient user activation checks before initiating their respective device choosers, relying entirely on renderer-side enforcement:
- WebUSB: WebUsbServiceImpl::GetPermission (content/browser/usb/web_usb_service_impl.cc)
- WebBluetooth: WebBluetoothServiceImpl::RequestDeviceImpl (content/browser/bluetooth/web_bluetooth_service_impl.cc)
- WebSerial: SerialService::RequestPort (content/browser/serial/serial_service.cc)
- WebHID: HidService::RequestDevice (content/browser/hid/hid_service.cc)
- Web Share: ShareServiceImpl::Share (chrome/browser/webshare/share_service_impl.cc)
- Contacts: ContactsManagerImpl::Select (content/browser/contacts/contacts_manager_impl.cc)

Potential Attack Scenario

Note: The following steps are theoretical as the Flapjack LLM agent does not execute code, but they trace the logical flow of the vulnerability based on the codebase.

Renderer Compromise & Social Engineering: An attacker compromises the sandboxed renderer process (e.g., via a V8 bug). The attacker’s webpage displays a lure (like a game) tricking the user into holding down the “Enter” key.
Mojo Invocation: Bypassing Blink’s security checks, the compromised renderer directly sends a ChooseEntries Mojo message to the browser process. It specifies a SaveFilePickerOptions targeting the user’s Downloads folder with an attacker-controlled suggested_name (e.g., malware.bat).
Browser-Side Bypass: The browser process receives the message. It calls UpdateUserActivationState(kConsumeTransientActivation). Since holding the Enter key does not constitute a valid, recent transient activation in the browser’s state, this returns false. However, because the code ignores the return value, the browser proceeds.
Dialog Steals Focus: The native OS Save File Picker dialog appears and instantly intercepts window focus.
Automatic Confirmation: Because the user is already holding the “Enter” key, the OS immediately registers an “Enter” keystroke on the newly focused dialog. This triggers the default “Save” action.
Sandbox Escape / Unauthorized Access: The dialog closes, and the browser process grants the compromised renderer a valid FileSystemAccessFileHandle for malware.bat, allowing the attacker to silently write arbitrary payloads to the user’s disk. This identical pattern can be used to silently grant access to connected USB/Bluetooth/Serial hardware.

Recommendation

All sensitive Mojo methods that trigger browser-side choosers or pickers must strictly verify that transient user activation is present in the calling frame.

For ChooseEntries, the return value of UpdateUserActivationState(kConsumeTransientActivation) must be checked, and the request should be rejected (e.g., returning kPermissionDenied) if it is false.
For the hardware and sharing APIs, a similar browser-side check to consume transient user activation must be implemented before calling RunChooser or equivalent.

Evaluated with Chrome root at commit: 9760e6c70cd33a320713361f17c6dcca85648c0f

Results from Flapjack so far have been promising, but it can be wrong in its deductions. At this time, it does not produce proof of concepts or fuzzer tests. If this proves to be a false positive, please close as WAI; data from false positives will be used to improve Flapjack’s accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.

View on issue tracker

Links in the report

http://b/495429423

References

Vendor advisory Fix commit Bug tracker NVD

On This Page