From 8c0e7738e64fc12dd1869b11a0e7d21bc6b5c70c Mon Sep 17 00:00:00 2001
From: Vikram Pasupathy <vpasupathy@chromium.org>
Date: Fri, 25 Sep 2026 11:38:50 -0700
Subject: [PATCH] Require user activation for Pointer Lock while in tab fullscreen

PointerLockController::RequestToLockPointer() previously skipped the
user-activation and post-Esc cooldown checks whenever the tab was in
HTML fullscreen.

Because WebContents::IsFullscreen() is tab-scoped, this exemption
applied to every frame in the tab regardless of which frame obtained the
user activation to enter fullscreen, allowing an embedded cross-origin
iframe to silently lock the pointer without a user gesture.

Drop the tab-fullscreen exemption so that a pointer-lock request must
carry its own transient user activation (or come from a target that
previously unlocked itself), and so that the post-Esc cooldown is
honored even while the tab is fullscreen.

Bug: 506148052
Change-Id: I58166868cae38274c5151a3590ddecf3acd77af8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8422256
Reviewed-by: Frank Liberato <liberato@chromium.org>
Commit-Queue: Vikram Pasupathy <vpasupathy@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1704993}
---
diff --git a/chrome/browser/ui/exclusive_access/pointer_lock_controller.cc b/chrome/browser/ui/exclusive_access/pointer_lock_controller.cc
index 4d2687f..eebf155 100644
--- a/chrome/browser/ui/exclusive_access/pointer_lock_controller.cc
+++ b/chrome/browser/ui/exclusive_access/pointer_lock_controller.cc
@@ -50,12 +50,11 @@
   DCHECK(!IsPointerLocked());
 
   // To prevent misbehaving sites from constantly re-locking the pointer, the
-  // lock-requesting page must have transient user activation and it must not
+  // lock-requesting frame must have transient user activation and it must not
   // request for a lock within |kEffectiveUserEscapeDuration| time since the
-  // user successfully escaped from a previous lock.  Exceptions are when the
-  // page has unlocked (i.e. not the user), or if we're in tab fullscreen (which
-  // requires its own transient user activation).
-  if (!last_unlocked_by_target && !web_contents->IsFullscreen()) {
+  // user successfully escaped from a previous lock. The only exception is when
+  // the target frame previously unlocked itself (i.e. not the user).
+  if (!last_unlocked_by_target) {
     if (!user_gesture) {
       web_contents->GotResponseToPointerLockRequest(
           blink::mojom::PointerLockResult::kRequiresUserGesture);
diff --git a/chrome/browser/ui/exclusive_access/pointer_lock_controller_browsertest.cc b/chrome/browser/ui/exclusive_access/pointer_lock_controller_browsertest.cc
index 83b82f9..44bc85d 100644
--- a/chrome/browser/ui/exclusive_access/pointer_lock_controller_browsertest.cc
+++ b/chrome/browser/ui/exclusive_access/pointer_lock_controller_browsertest.cc
@@ -187,3 +187,36 @@
                   ->pointer_lock_controller()
                   ->IsPointerLocked());
 }
+
+IN_PROC_BROWSER_TEST_F(PointerLockControllerTest,
+                       PointerLockInFullscreenRequiresUserGesture) {
+  EnterActiveTabFullscreen();
+
+  // A pointer lock request without user gesture must be rejected even while
+  // in tab fullscreen (crbug.com/506148052).
+  RequestToLockPointer(/*user_gesture=*/false,
+                       /*last_unlocked_by_target=*/false);
+  EXPECT_FALSE(GetExclusiveAccessManager()
+                   ->pointer_lock_controller()
+                   ->IsPointerLocked());
+
+  // With a user gesture, pointer lock is granted.
+  RequestToLockPointer(/*user_gesture=*/true,
+                       /*last_unlocked_by_target=*/false);
+  EXPECT_TRUE(GetExclusiveAccessManager()
+                  ->pointer_lock_controller()
+                  ->IsPointerLocked());
+
+  // An immediate re-lock attempt within the post-escape cooldown period
+  // must be rejected even with a user gesture while in fullscreen.
+  SendEscapeToExclusiveAccessManager();
+  EXPECT_FALSE(GetExclusiveAccessManager()
+                   ->pointer_lock_controller()
+                   ->IsPointerLocked());
+
+  RequestToLockPointer(/*user_gesture=*/true,
+                       /*last_unlocked_by_target=*/false);
+  EXPECT_FALSE(GetExclusiveAccessManager()
+                   ->pointer_lock_controller()
+                   ->IsPointerLocked());
+}

diff --git a/chrome/browser/ui/exclusive_access/pointer_lock_controller_browsertest.cc b/chrome/browser/ui/exclusive_access/pointer_lock_controller_browsertest.cc
index 83b82f9..44bc85d 100644
--- a/chrome/browser/ui/exclusive_access/pointer_lock_controller_browsertest.cc
+++ b/chrome/browser/ui/exclusive_access/pointer_lock_controller_browsertest.cc
@@ -187,3 +187,36 @@
                   ->pointer_lock_controller()
                   ->IsPointerLocked());
 }
+
+IN_PROC_BROWSER_TEST_F(PointerLockControllerTest,
+                       PointerLockInFullscreenRequiresUserGesture) {
+  EnterActiveTabFullscreen();
+
+  // A pointer lock request without user gesture must be rejected even while
+  // in tab fullscreen (crbug.com/506148052).
+  RequestToLockPointer(/*user_gesture=*/false,
+                       /*last_unlocked_by_target=*/false);
+  EXPECT_FALSE(GetExclusiveAccessManager()
+                   ->pointer_lock_controller()
+                   ->IsPointerLocked());
+
+  // With a user gesture, pointer lock is granted.
+  RequestToLockPointer(/*user_gesture=*/true,
+                       /*last_unlocked_by_target=*/false);
+  EXPECT_TRUE(GetExclusiveAccessManager()
+                  ->pointer_lock_controller()
+                  ->IsPointerLocked());
+
+  // An immediate re-lock attempt within the post-escape cooldown period
+  // must be rejected even with a user gesture while in fullscreen.
+  SendEscapeToExclusiveAccessManager();
+  EXPECT_FALSE(GetExclusiveAccessManager()
+                   ->pointer_lock_controller()
+                   ->IsPointerLocked());
+
+  RequestToLockPointer(/*user_gesture=*/true,
+                       /*last_unlocked_by_target=*/false);
+  EXPECT_FALSE(GetExclusiveAccessManager()
+                   ->pointer_lock_controller()
+                   ->IsPointerLocked());
+}