From c2df61a54db1d495380fbd7dca9062e292b7d223 Mon Sep 17 00:00:00 2001
From: Bruno Braga <brunobraga@google.com>
Date: Fri, 29 May 2026 06:37:52 -0700
Subject: [PATCH] [Autofill] Fix UAF in popup views due to COM reentrancy on Windows

Fix potential Use-After-Free (UAF) vulnerabilities in Autofill popup
views on Windows.

On Windows, firing accessibility events (such as focus or selection
changes) can synchronously spin a COM message pump if assistive
technologies are active. This reentrancy window allows queued tasks
on the browser UI thread to run, which can destroy the executing
view hierarchy (e.g., by rebuilding the popup). Subsequent member
accesses on the deleted views result in UAF.

This CL introduces `views::ViewTracker` to track the lifetime of the
executing views across calls that trigger accessibility events and
aborts execution early if the view is synchronously destroyed.

Touched files:
- popup_row_with_button_view.cc: Guard key press handlers.
- popup_row_view.cc: Guard selected cell updates.
- popup_bnpl_footnote_view.cc: Guard settings link focus.
- popup_view_views.cc: Guard SetSelectedCell path.

TAG=agy
CONV=d11a46e3-2dd7-4aea-9644-0f62932c301c

Bug: 517014512, 516938039, 517023053
Change-Id: I93ce0650d32f477d5bd9a0b0d23ef20018a3e523
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7878305
Reviewed-by: Christoph Schwering <schwering@google.com>
Commit-Queue: Bruno Braga <brunobraga@google.com>
Cr-Commit-Position: refs/heads/main@{#1638448}
---

diff --git a/chrome/browser/ui/views/autofill/popup/popup_base_view.cc b/chrome/browser/ui/views/autofill/popup/popup_base_view.cc
index 5c9c09d1..77555e50 100644
--- a/chrome/browser/ui/views/autofill/popup/popup_base_view.cc
+++ b/chrome/browser/ui/views/autofill/popup/popup_base_view.cc
@@ -329,19 +329,29 @@
     // navigates into the menu, otherwise some screen readers will ignore
     // any focus events outside of the menu, including a focus event on
     // the form control itself.
-    NotifyAccessibilityEventDeprecated(ax::mojom::Event::kMenuPopupEnd, true);
-    NotifyAccessibilityEventDeprecated(ax::mojom::Event::kMenuEnd, true);
-    GetViewAccessibility().EndPopupFocusOverride();
-
-    // Also fire an accessible focus event on what currently has focus,
-    // typically the widget associated with this popup.
-    if (parent_widget_) {
-      if (views::FocusManager* focus_manager =
-              parent_widget_->GetFocusManager()) {
-        if (View* focused_view = focus_manager->GetFocusedView()) {
-          focused_view->GetViewAccessibility().FireFocusAfterMenuClose();
-        }
-      }
+    if (!TrackAndRun(
+            this,
+            [this]() {
+              NotifyAccessibilityEventDeprecated(
+                  ax::mojom::Event::kMenuPopupEnd, true);
+            },
+            [this]() {
+              NotifyAccessibilityEventDeprecated(ax::mojom::Event::kMenuEnd,
+                                                 true);
+            },
+            [this]() { GetViewAccessibility().EndPopupFocusOverride(); },
+            [this]() {
+              if (parent_widget_) {
+                if (views::FocusManager* focus_manager =
+                        parent_widget_->GetFocusManager()) {
+                  if (View* focused_view = focus_manager->GetFocusedView()) {
+                    focused_view->GetViewAccessibility()
+                        .FireFocusAfterMenuClose();
+                  }
+                }
+              }
+            })) {
+      return;
     }
   }
 
@@ -369,8 +379,18 @@
     // readers that the focus is only changing temporarily, and the screen
     // reader will restore the focus back to the appropriate textfield when the
     // menu closes.
-    NotifyAccessibilityEventDeprecated(ax::mojom::Event::kMenuStart, true);
-    NotifyAccessibilityEventDeprecated(ax::mojom::Event::kMenuPopupStart, true);
+    if (!TrackAndRun(
+            this,
+            [this]() {
+              NotifyAccessibilityEventDeprecated(ax::mojom::Event::kMenuStart,
+                                                 true);
+            },
+            [this]() {
+              NotifyAccessibilityEventDeprecated(
+                  ax::mojom::Event::kMenuPopupStart, true);
+            })) {
+      return;
+    }
 
     is_ax_menu_start_event_fired_ = true;
   }
diff --git a/chrome/browser/ui/views/autofill/popup/popup_bnpl_footnote_view.cc b/chrome/browser/ui/views/autofill/popup/popup_bnpl_footnote_view.cc
index 4f29d09..0fc1b86 100644
--- a/chrome/browser/ui/views/autofill/popup/popup_bnpl_footnote_view.cc
+++ b/chrome/browser/ui/views/autofill/popup/popup_bnpl_footnote_view.cc
@@ -120,9 +120,16 @@
     is_settings_link_selected_ = true;
     link->SetBorder(views::CreateSolidBorder(kSelectionBorderThickness,
                                              ui::kColorFocusableBorderFocused));
-    a11y_selection_delegate_->NotifyAXSelection(*this);
-    this->NotifyAccessibilityEventDeprecated(ax::mojom::Event::kFocus, true);
-    this->GetViewAccessibility().SetIsSelected(true);
+    if (!TrackAndRun(
+            this,
+            [this]() { a11y_selection_delegate_->NotifyAXSelection(*this); },
+            [this]() {
+              NotifyAccessibilityEventDeprecated(ax::mojom::Event::kFocus,
+                                                 true);
+            },
+            [this]() { GetViewAccessibility().SetIsSelected(true); })) {
+      return;
+    }
     announce_callback_.Run(std::u16string(link->GetText()), /*polite=*/false);
   }
 }
diff --git a/chrome/browser/ui/views/autofill/popup/popup_row_view.cc b/chrome/browser/ui/views/autofill/popup/popup_row_view.cc
index 333fb65..0634e7b 100644
--- a/chrome/browser/ui/views/autofill/popup/popup_row_view.cc
+++ b/chrome/browser/ui/views/autofill/popup/popup_row_view.cc
@@ -366,7 +366,11 @@
   // If the previous cell was content, set it as unselected.
   if (selected_cell_ == CellType::kContent) {
     content_view_->UpdateStyle(/*selected=*/false);
-    content_view_->GetViewAccessibility().SetIsSelected(false);
+    if (!TrackAndRun(this, [this]() {
+          content_view_->GetViewAccessibility().SetIsSelected(false);
+        })) {
+      return;
+    }
     controller_->UnselectSuggestion();
   }
 
@@ -377,18 +381,34 @@
     // is required for a11y focus working on a non-activatable popup.  Consider
     // moving `SetIsSelected()` into `NotifyAXSelection()` (and rename it) to
     // hide this API complexity from clients.
-    GetA11ySelectionDelegate().NotifyAXSelection(*this);
-    GetViewAccessibility().SetIsSelected(true);
-    NotifyAccessibilityEventDeprecated(
-        ax::mojom::Event::kSelectedChildrenChanged, true);
+    if (!TrackAndRun(
+            this,
+            [this]() { GetA11ySelectionDelegate().NotifyAXSelection(*this); },
+            [this]() { GetViewAccessibility().SetIsSelected(true); },
+            [this]() {
+              NotifyAccessibilityEventDeprecated(
+                  ax::mojom::Event::kSelectedChildrenChanged, true);
+            })) {
+      return;
+    }
     selected_cell_ = new_cell;
   } else if (new_cell == CellType::kContent) {
     controller_->SelectSuggestion(line_number_);
     content_view_->UpdateStyle(/*selected=*/true);
-    GetA11ySelectionDelegate().NotifyAXSelection(*content_view_);
-    content_view_->GetViewAccessibility().SetIsSelected(true);
-    NotifyAccessibilityEventDeprecated(
-        ax::mojom::Event::kSelectedChildrenChanged, true);
+    if (!TrackAndRun(
+            this,
+            [this]() {
+              GetA11ySelectionDelegate().NotifyAXSelection(*content_view_);
+            },
+            [this]() {
+              content_view_->GetViewAccessibility().SetIsSelected(true);
+            },
+            [this]() {
+              NotifyAccessibilityEventDeprecated(
+                  ax::mojom::Event::kSelectedChildrenChanged, true);
+            })) {
+      return;
+    }
     selected_cell_ = new_cell;
   } else {
     // Set the selected cell to none in case an invalid choice was made (e.g.
@@ -396,8 +416,13 @@
     // explicitly with `std::nullopt`.
     selected_cell_ = std::nullopt;
 
-    GetViewAccessibility().SetIsSelected(false);
-    content_view_->GetViewAccessibility().SetIsSelected(false);
+    if (!TrackAndRun(
+            this, [this]() { GetViewAccessibility().SetIsSelected(false); },
+            [this]() {
+              content_view_->GetViewAccessibility().SetIsSelected(false);
+            })) {
+      return;

diff --git a/chrome/browser/ui/views/autofill/popup/popup_view_utils_unittest.cc b/chrome/browser/ui/views/autofill/popup/popup_view_utils_unittest.cc
index 1e92c102..c6ae677 100644
--- a/chrome/browser/ui/views/autofill/popup/popup_view_utils_unittest.cc
+++ b/chrome/browser/ui/views/autofill/popup/popup_view_utils_unittest.cc
@@ -4,11 +4,13 @@
 
 #include "chrome/browser/ui/views/autofill/popup/popup_view_utils.h"
 
+#include <memory>
 #include <vector>
 
 #include "chrome/browser/ui/views/autofill/popup/popup_base_view.h"
 #include "components/autofill/core/browser/ui/popup_open_enums.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "ui/views/view.h"
 
 namespace autofill {
 
@@ -544,4 +546,16 @@
       gfx::Rect(50, 50, 100, 100), {non_overlapping_popup, kBasePopup}));
 }
 
+TEST(PopupViewsUtilsTest, TrackAndRun_Basic) {
+  auto view = std::make_unique<views::View>();
+  bool cb2_called = false;
+
+  bool survived = TrackAndRun(
+      view.get(), [&view]() { view.reset(); },
+      [&cb2_called]() { cb2_called = true; });
+
+  EXPECT_FALSE(survived);
+  EXPECT_FALSE(cb2_called);
+}
+
 }  // namespace autofill