Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports without the Chrome Security team.

Overview: A compromised renderer process can permanently disable the delivery of specific extension events (such as management.onInstalled) profile-wide. By registering a listener with a malformed filter via Mojo, the event is marked as filtered but fails to be cleaned up, causing subsequent legitimate events to be silently dropped.

Affected files:

• extensions/browser/event_listener_map.cc
• extensions/browser/event_router.cc
• extensions/common/event_filter.cc

Estimated timestamp from git blame: 2026-02-02

Summary

A vulnerability in the Chrome extension event dispatching system allows a compromised renderer process to permanently ‘blackhole’ (silently drop) any extension event for all extensions in the current profile. This can be used to disable critical security features, enterprise monitoring, and auditing extensions that rely on events like management.onInstalled or runtime.onStartup.

Vulnerability Details

The vulnerability stems from a state mismatch in extensions::EventListenerMap when handling malformed event filters provided over Mojo.

1. Registration via Mojo

The extensions::mojom::EventRouter interface is bound as an associated interface for all renderer processes, making it accessible to a compromised web page or extension process. A compromised renderer can call AddFilteredListenerForMainThread, providing an arbitrary event name (e.g., management.onInstalled) and a malformed filter dictionary (e.g., {"url":[{"invalid_key":"x"}]}). To bypass the IsExtensionEnabled check in EventRouter::AddFilteredEventListener, the attacker can use the is_listener_url union member instead of an extension ID.

2. State Poisoning

In EventListenerMap::AddListener, the code attempts to parse the filter by calling EventFilter::AddEventMatcher. Because the filter contains an invalid key, the parser (URLMatcherFactory::CreateFromURLFilterDictionary) fails, and AddEventMatcher returns -1 to indicate an error.

The listener is correctly assigned a matcher_id_ of -1. However, EventListenerMap::AddListener unconditionally executes filtered_events_.insert(listener->event_name()) regardless of the parsing failure. The event is now marked as a ‘filtered event’ within the profile.

// extensions/browser/event_listener_map.cc
if (listener->filter()) {
  // AddEventMatcher returns -1 on malformed filter
  MatcherID id = event_filter_.AddEventMatcher(listener->event_name(), ...);
  listener->set_matcher_id(id); // Set to -1
  // ...
  // Unconditionally inserts event name
  filtered_events_.insert(listener->event_name()); 
}

3. Failed Cleanup

When the attacker terminates the renderer (or explicitly removes the listener), EventListenerMap::CleanupListener is called. This function contains an early return if the matcher_id is -1:

void EventListenerMap::CleanupListener(EventListener* listener) {
  if (listener->matcher_id() == -1) {
    return;
  }
  // ... code to erase from filtered_events_ if it was the last listener
}

Because the poisoned listener has a matcher_id_ of -1, the entry in filtered_events_ is never removed. The event name remains permanently ‘filtered’ for the lifetime of the browser session.

4. Event Blackholing

When the browser attempts to dispatch the poisoned event, EventListenerMap::GetEventListeners checks IsFilteredEvent(event). Since the event name is permanently stuck in filtered_events_, the code takes the filtered path, exclusively querying EventFilter::MatchEvent.

Most security-sensitive events (like management.onInstalled) do not support filters, and legitimate extensions listen for them without a filter. Listeners without filters are never added to the EventFilter. Consequently, MatchEvent returns empty, and the event is silently dropped, bypassing security monitoring.

Potential Reproduction Steps

Note: These are suggested steps based on static analysis.

1. From a compromised renderer (e.g., a normal web page), obtain the extensions.mojom.EventRouter associated interface.
2. Call AddFilteredListenerForMainThread with event_name="management.onInstalled", a malformed filter (e.g., {"url":[{"invalid_key":"x"}]}), and use listener_owner.listener_url set to any valid URL to bypass extension ID validation.
3. Terminate the renderer process to trigger listener cleanup.
4. Observe that management.onInstalled events are no longer delivered to any extension in the profile.

Suggested Fix

In EventListenerMap::AddListener, verify that EventFilter::AddEventMatcher succeeded before modifying the state:

if (listener->filter()) {
  // ...
  MatcherID id = event_filter_.AddEventMatcher(...);
  if (id == -1) {
    // Handle error, do not add to filtered_events_ or listeners_by_matcher_id_
    return false; 
  }
  listener->set_matcher_id(id);
  listeners_by_matcher_id_[id] = listener.get();
  filtered_events_.insert(listener->event_name());
}

Additionally, consider validating the listener_owner in EventRouter::AddFilteredEventListener to ensure URLs are authorized for the calling process.

Evaluated with Chrome root at commit: 096fc8fdbfacf2546485756d03f160a3d04fcc9b

Results so far have been promising, but there can be wrong deductions. If this proves to be a false positive, please close as WAI; data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.