From 188e278c80a7e2bb03c0f13068163df8de5e858f Mon Sep 17 00:00:00 2001
From: Tom Anderson <thomasanderson@chromium.org>
Date: Tue, 09 Jun 2026 16:33:36 -0700
Subject: [PATCH] [Ozone] Suppress data drag during window move loop

DesktopWindowTreeHostPlatform::RunMoveLoop runs a nested event loop
allowing nestable tasks. While the loop is active, a compromised
renderer could start a data drag, release pointer grab/capture, take
ownership of the global XdndSelection selection atom, and substitute its
own DnD payload.

To protect against this, this CL introduces ScopedSuppressForWindowMove
under DesktopDragDropClientOzone, which sets the existing process-global
flag g_is_dragging. This flag is held for the duration of the window
move loop and used to reject re-entrant data drag starts.

Additionally, this CL adds a DCHECK(!g_is_dragging) in
ScopedSuppressForWindowMove to assert that a drag-and-drop session is
not already active when a window-move loop is entered.

Fixed: 518042749
Change-Id: I1dbe0fe181d7b65be457a32c4400688178bd5136
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7900333
Auto-Submit: Thomas Anderson <thomasanderson@chromium.org>
Reviewed-by: Mike Wasserman <msw@chromium.org>
Commit-Queue: Mike Wasserman <msw@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1644315}
---

diff --git a/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone.cc b/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone.cc
index d341b848..123561d 100644
--- a/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone.cc
+++ b/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone.cc
@@ -133,6 +133,13 @@
     ui::WmDragHandler* drag_handler)
     : root_window_(root_window), drag_handler_(drag_handler) {}
 
+// static
+base::AutoReset<bool>
+DesktopDragDropClientOzone::ScopedSuppressForWindowMove() {
+  DCHECK(!g_is_dragging);
+  return base::AutoReset<bool>(&g_is_dragging, true);
+}
+
 DesktopDragDropClientOzone::~DesktopDragDropClientOzone() {
   ResetDragDropTarget();
   observers_.Notify(
diff --git a/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone.h b/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone.h
index 5a14b467..b46de97 100644
--- a/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone.h
+++ b/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone.h
@@ -7,6 +7,7 @@
 
 #include <memory>
 
+#include "base/auto_reset.h"
 #include "base/functional/callback.h"
 #include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
@@ -50,6 +51,11 @@
 
   ~DesktopDragDropClientOzone() override;
 
+  // Called by the window-move (tab-drag) entry point so that a
+  // renderer-initiated data drag cannot start inside the window-move's nested
+  // kNestableTasksAllowed RunLoop. See StartDragAndDrop.
+  [[nodiscard]] static base::AutoReset<bool> ScopedSuppressForWindowMove();
+
  protected:
   friend class DesktopDragDropClientOzoneTest;
 
diff --git a/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone_unittest.cc b/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone_unittest.cc
index 769cd0b..1f6b3d5f7 100644
--- a/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone_unittest.cc
+++ b/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone_unittest.cc
@@ -591,4 +591,14 @@
   EXPECT_EQ(DragOperation::kCopy, operation);
 }
 
+TEST_F(DesktopDragDropClientOzoneTest, RejectDragDuringWindowMove) {
+  // Simulate that a window-move loop is in progress.
+  auto suppress_drag =
+      DesktopDragDropClientOzone::ScopedSuppressForWindowMove();
+
+  // Attempt to start a drag operation. It should be rejected and return kNone.
+  DragOperation operation = StartDragAndDrop(ui::DragDropTypes::DRAG_COPY);
+  EXPECT_EQ(DragOperation::kNone, operation);
+}
+
 }  // namespace views
diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc b/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc
index b953949d0..d538135 100644
--- a/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc
+++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc
@@ -770,6 +770,11 @@
     const gfx::Vector2d& drag_offset,
     Widget::MoveLoopSource source,
     Widget::MoveLoopEscapeBehavior escape_behavior) {
+  // The window-move loop runs a kNestableTasksAllowed RunLoop that pumps Mojo
+  // IPC; suppress renderer-initiated data drags for its duration so a
+  // compromised renderer in another window cannot hijack the user's gesture.
+  auto suppress_data_drag =
+      DesktopDragDropClientOzone::ScopedSuppressForWindowMove();
   auto* move_loop_handler = ui::GetWmMoveLoopHandler(*platform_window());
   if (move_loop_handler && move_loop_handler->RunMoveLoop(drag_offset)) {
     return Widget::MoveLoopResult::kSuccessful;

diff --git a/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone_unittest.cc b/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone_unittest.cc
index 769cd0b..1f6b3d5f7 100644
--- a/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone_unittest.cc
+++ b/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone_unittest.cc
@@ -591,4 +591,14 @@
   EXPECT_EQ(DragOperation::kCopy, operation);
 }
 
+TEST_F(DesktopDragDropClientOzoneTest, RejectDragDuringWindowMove) {
+  // Simulate that a window-move loop is in progress.
+  auto suppress_drag =
+      DesktopDragDropClientOzone::ScopedSuppressForWindowMove();
+
+  // Attempt to start a drag operation. It should be rejected and return kNone.
+  DragOperation operation = StartDragAndDrop(ui::DragDropTypes::DRAG_COPY);
+  EXPECT_EQ(DragOperation::kNone, operation);
+}
+
 }  // namespace views