Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: The network::mojom::NetworkContext interface exposes CreateNetLogExporter without an AllowedContext restriction, allowing any sandboxed process with a NetworkContext remote to invoke it. A compromised utility process, such as the Cast Mirroring Service, could potentially initiate a process-global NetLog capture. This allows the interception of cookies, credentials, and decrypted payloads across all active browser profiles.

Affected files:

• services/network/public/mojom/network_context.mojom
• services/network/net_log_exporter.cc
• services/network/network_context.cc
• chrome/browser/media/cast_mirroring_service_host.cc
• components/mirroring/mojom/resource_provider.mojom

Estimated timestamp from git blame: 2022-04-21

Summary

A potential privilege-escalation and cross-profile information-leak vulnerability exists in the Network Service’s NetLog mechanism. Specifically, the network::mojom::NetworkContext::CreateNetLogExporter Mojo interface method lacks a compile-time restriction such as [AllowedContext=sandbox.mojom.Context.kBrowser]. Consequently, a compromised sandboxed process holding a network::mojom::NetworkContext remote (e.g., the Cast Mirroring utility) can invoke it to capture and exfiltrate global network activity across all profiles and domains (including sensitive cookies, HTTP authentication headers, and raw decrypted socket bytes).

Root Cause Analysis

In services/network/public/mojom/network_context.mojom (line 1509), the CreateNetLogExporter method is defined as:

CreateNetLogExporter(pending_receiver<NetLogExporter> receiver);

Unlike highly privileged methods like GetCookieManager (line 1013) or GetDeviceBoundSessionManager (line 1805), which are restricted with [AllowedContext=sandbox.mojom.Context.kBrowser], CreateNetLogExporter has no context annotation. Under Mojo’s static analysis constraints, this omission allows any client with a NetworkContext remote to bind the NetLogExporter interface.

The sandboxed Cast Mirroring utility process runs in a restricted sandbox (kService or kHardwareVideoEncoding) but obtains a NetworkContext remote via ResourceProvider::GetNetworkContext() in components/mirroring/mojom/resource_provider.mojom (line 46):

[AllowedContext=sandbox.mojom.Context.kPrivilegedUtility]
GetNetworkContext(pending_receiver<network.mojom.NetworkContext> receiver);

Because NetworkContext is marked with [RequireContext=sandbox.mojom.Context.kPrivilegedUtility] (line 991), this binding is permitted by Mojo’s static check validator.

Once a compromised process obtains a network::mojom::NetLogExporter remote, it can invoke NetLogExporter::Start (services/network/net_log_exporter.cc, line 44). There are no privilege or validation checks on the caller-provided NetLogCaptureMode parameter. If the attacker passes NetLogCaptureMode::EVERYTHING, the Network Service registers an observer on the process-global net::NetLog singleton and iterates through all active contexts in NetworkService::CreateNetLogEntriesForActiveObjects (services/network/network_service.cc, line 637). This process successfully streams logs—including decrypted payload bytes and credentials—belonging to the user’s primary browser profile and other isolated contexts into a file descriptor provided by the attacker.

Potential Attack Steps

Note: These steps are based on static code analysis; our tooling does not currently run dynamic proof-of-concept code.

1. Establish arbitrary code execution inside the sandboxed Mirroring utility process (e.g., via a parsing vulnerability).
2. Request the restricted network::mojom::NetworkContext remote via ResourceProvider::GetNetworkContext().
3. Invoke NetworkContext::CreateNetLogExporter(exporter.BindNewPipeAndPassReceiver()).
4. Create a seekable file descriptor (such as via memfd_create on Linux, which is permitted under baseline seccomp policies) and wrap it inside a base::File object.
5. Call exporter->Start(file, {}, NetLogCaptureMode::EVERYTHING, NetLogExporter::kUnlimitedFileSize).
6. Read the captured events from the file descriptor to access cookies, authentication headers, and cleartext socket payloads from the user’s main profile context, and exfiltrate them via the utility’s network connection.

Suggested Fix

Apply the [AllowedContext=sandbox.mojom.Context.kBrowser] attribute to CreateNetLogExporter in services/network/public/mojom/network_context.mojom:

  [AllowedContext=sandbox.mojom.Context.kBrowser]
  CreateNetLogExporter(pending_receiver<NetLogExporter> receiver);

This ensures that only the browser process can request a NetLogExporter, preventing sandboxed utility or renderer processes from initiating global packet captures.

Evaluated with Chrome root at commit: b1520ef4a76878853a31f0943b565e42060edec8

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

• If you are familiar with the severity guidelines, you may adjust the severity.
• If this is a false positive, and there’s no work to be done, please close as WAI.
• If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.