Chrome · PDFium › PDFium
CVE-2026-113022
Memory Corruption in PDFium (PDFium)
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
testing/resources/javascript/textbox_keyboard_event_expected.txttesting/resources/javascript/textbox_on_load_expected.txttesting/resources/javascript/textbox_keyboard_no_event_expected.txttesting/resources/javascript/textbox_keyboard_no_event.intesting/resources/javascript/textbox_on_load.intesting/resources/javascript/textbox_keyboard_event.evttesting/resources/javascript/textbox_keyboard_event.in
Patch
From 67e899575690dd52875592e0b3e09bff89cdaa56 Mon Sep 17 00:00:00 2001
From: Lei Zhang <thestig@chromium.org>
Date: Thu, 17 Sep 2026 16:51:48 -0700
Subject: [PATCH] Add some JavaScript tests for textboxes
- textbox_keyboard_event.in / textbox_keyboard_event.evt: Should trigger
JS due to the keyboard event.
- textbox_keyboard_no_event.in: Should not trigger JS due to the lack of
keyboard events.
- textbox_on_load.in: Should not trigger JS due to the lack of keyboard
events, but actually does.
Inputs based on AI-suggestions attached to the bug report.
Bug: 494352583
Change-Id: Ifad2e9c232d50e924da79bfd1cddfd6c032e59e8
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/158310
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
---
diff --git a/testing/resources/javascript/textbox_keyboard_event.evt b/testing/resources/javascript/textbox_keyboard_event.evt
new file mode 100644
index 0000000..f164fdd
--- /dev/null
+++ b/testing/resources/javascript/textbox_keyboard_event.evt
@@ -0,0 +1,3 @@
+mousedown,left,100,100
+mouseup,left,100,100
+charcode,65
diff --git a/testing/resources/javascript/textbox_keyboard_event.in b/testing/resources/javascript/textbox_keyboard_event.in
new file mode 100644
index 0000000..080a117
--- /dev/null
+++ b/testing/resources/javascript/textbox_keyboard_event.in
@@ -0,0 +1,55 @@
+{{header}}
+{{object 1 0}} <<
+ /Type /Catalog
+ /Pages 2 0 R
+ /AcroForm <<
+ /Fields [4 0 R]
+ /DR <<
+ /Font <<
+ /F1 5 0 R
+ >>
+ >>
+ >>
+>>
+endobj
+{{object 2 0}} <<
+ /Type /Pages
+ /Count 1
+ /Kids [3 0 R]
+>>
+endobj
+{{object 3 0}} <<
+ /Type /Page
+ /Parent 2 0 R
+ /MediaBox [0 0 200 200]
+ /Annots [4 0 R]
+>>
+endobj
+{{object 4 0}} <<
+ /Type /Annot
+ /Subtype /Widget
+ /FT /Tx
+ /T (MyField)
+ /DA (0 0 0 rg /F1 12 Tf)
+ /Rect [50 50 150 150]
+ /AA <<
+ /K 6 0 R
+ >>
+>>
+endobj
+{{object 5 0}} <<
+ /Type /Font
+ /Subtype /Type1
+ /BaseFont /Helvetica
+>>
+endobj
+{{object 6 0}} <<
+ /Type /Action
+ /S /JavaScript
+ /JS (app.alert('done'))
+>>
+endobj
+{{xref}}
+{{trailer}}
+{{startxref}}
+%%EOF
diff --git a/testing/resources/javascript/textbox_keyboard_event_expected.txt b/testing/resources/javascript/textbox_keyboard_event_expected.txt
new file mode 100644
index 0000000..daa1eca
--- /dev/null
+++ b/testing/resources/javascript/textbox_keyboard_event_expected.txt
@@ -0,0 +1 @@
+Alert: done
diff --git a/testing/resources/javascript/textbox_keyboard_no_event.in b/testing/resources/javascript/textbox_keyboard_no_event.in
new file mode 100644
index 0000000..080a117
--- /dev/null
+++ b/testing/resources/javascript/textbox_keyboard_no_event.in
@@ -0,0 +1,55 @@
+{{header}}
+{{object 1 0}} <<
+ /Type /Catalog
+ /Pages 2 0 R
+ /AcroForm <<
+ /Fields [4 0 R]
+ /DR <<
+ /Font <<
+ /F1 5 0 R
+ >>
+ >>
+ >>
+>>
+endobj
+{{object 2 0}} <<
+ /Type /Pages
+ /Count 1
+ /Kids [3 0 R]
+>>
+endobj
+{{object 3 0}} <<
+ /Type /Page
+ /Parent 2 0 R
+ /MediaBox [0 0 200 200]
+ /Annots [4 0 R]
+>>
+endobj
+{{object 4 0}} <<
+ /Type /Annot
+ /Subtype /Widget
+ /FT /Tx
+ /T (MyField)
+ /DA (0 0 0 rg /F1 12 Tf)
+ /Rect [50 50 150 150]
+ /AA <<
+ /K 6 0 R
+ >>
+>>
+endobj
+{{object 5 0}} <<
+ /Type /Font
+ /Subtype /Type1
+ /BaseFont /Helvetica
+>>
+endobj
+{{object 6 0}} <<
+ /Type /Action
+ /S /JavaScript
+ /JS (app.alert('done'))
+>>
+endobj
+{{xref}}
+{{trailer}}
+{{startxref}}
+%%EOF
diff --git a/testing/resources/javascript/textbox_keyboard_no_event_expected.txt b/testing/resources/javascript/textbox_keyboard_no_event_expected.txt
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/testing/resources/javascript/textbox_keyboard_no_event_expected.txt
diff --git a/testing/resources/javascript/textbox_on_load.in b/testing/resources/javascript/textbox_on_load.in
new file mode 100644
index 0000000..fbe5b26
--- /dev/null
+++ b/testing/resources/javascript/textbox_on_load.in
@@ -0,0 +1,74 @@
+{{header}}
+{{object 1 0}} <<
+ /Type /Catalog
+ /Pages 2 0 R
+ /AcroForm <<
+ /Fields [4 0 R 6 0 R]
+ /DR <<
+ /Font <<
+ /F1 7 0 R
+ >>
+ >>
+ >>
+ /OpenAction 8 0 R
+>>
+endobj
+{{object 2 0}} <<
+ /Type /Pages
+ /Count 1
+ /Kids [3 0 R]
+>>
+endobj
+{{object 3 0}} <<
+ /Type /Page
+ /Parent 2 0 R
+ /Annots [4 0 R 6 0 R]
+ /MediaBox [0 0 400 400]
+>>
+endobj
+{{object 4 0}} <<
+ /Type /Annot
+ /Subtype /Widget
+ /T (SubmitFormButton)
+ /FT /Btn
+ /Ff 65536
+ /Rect [150 150 250 250]
+ /AA <<
+ /D 5 0 R
+ >>
+>>
+endobj
+{{object 5 0}} <<
+ /Type /Action
+ /S /JavaScript
+ /JS (app.alert('done'))
+>>
+endobj
+{{object 6 0}} <<
+ /Type /Annot
+ /Subtype /Widget
+ /T (Field1)
+ /FT /Tx
+ /DA (0 0 0 rg /F1 12 Tf)
+ /Rect [50 300 350 340]
+ /AA <<
+ /K 5 0 R
+ >>
+>>
+endobj
+{{object 7 0}} <<
+ /Type /Font
+ /Subtype /Type1
+ /BaseFont /Helvetica
+>>
+endobj
+{{object 8 0}} <<
+ /Type /Action
+ /S /JavaScript
+ /JS (this.getField\('Field1'\).value = 'A';)
+>>
+endobj
+{{xref}}
+{{trailer}}
+{{startxref}}
+%%EOF
diff --git a/testing/resources/javascript/textbox_on_load_expected.txt b/testing/resources/javascript/textbox_on_load_expected.txt
new file mode 100644
index 0000000..daa1eca
--- /dev/null
+++ b/testing/resources/javascript/textbox_on_load_expected.txt
@@ -0,0 +1 @@
+Alert: done
Loading diff…
Original Bug Report
reported by cl...@gmail.com
PDF JavaScript Document.submitForm() can submit without a real user gesture.
VULNERABILITY DETAILS Document.submitForm() is intended to require user interaction before it can submit. However, this can be bypassed by attaching the JavaScript containing submitForm() as a field’s K action, then programmatically modifying the field in OpenAction. When a field is modified, whether it is modified programmatically or by a user, PDFium calls OnKeyStrokeCommit() and dispatches the field’s K action in a kKeyStroke event context. This makes submitForm() incorrectly treat that synthetic event path as satisfying the gesture requirement. As a result, simply opening the PDF is enough to trigger a network submission without any user click or keypress.
VERSION Chrome Version: 146.0.7680.154 (Official Build) (Stable) (64-bit) Operating System: Windows 11 26H1 Build 28000.1719
REPRODUCTION CASE The attached poc.pdf is the minimum proof of concept to reproduce this issue. When opened in a Chrome browser, whether by double-clicking, dragging to chrome window, or typing its address in the address bar, it submits itself to http://127.0.0.1:8000/ without any user interaction. Reproduction steps:
- Start a local HTTP listener, for example, on http://127.0.0.1:8000/.
- Open the PDF in Chrome’s built-in PDF viewer.
- Do not click or type anything.
- Observe that Chrome still sends the submission request.
CREDIT INFORMATION Reporter credit: Jamos Zhu, Sebastian Dowell
References
On This Page