Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports without the Chrome Security team.

Overview: CastWebViewDefault::OpenURLFromTab drops navigation provenance data by calling a 4-argument LoadURL overload, causing renderer-initiated navigations to be treated as browser-initiated. This potentially allows a compromised Chromecast renderer to spoof navigation headers and bypass Fetch Metadata protections. Because Chromecast disables Site Isolation, attackers could exploit this to steal sensitive cross-origin data.

Affected files:

• chromecast/browser/cast_web_view_default.cc

Estimated timestamp from git blame: 2024-03-28

Description

There is a potential navigation provenance laundering vulnerability in the Chromecast browser implementation. CastWebViewDefault::OpenURLFromTab in chromecast/browser/cast_web_view_default.cc serves as the WebContentsDelegate::OpenURLFromTab implementation. When a renderer process initiates a navigation via an OpenURL IPC, it routes to this delegate method.

The implementation incorrectly passes the navigation to the controller using the 4-argument LoadURL overload:

auto navigation_handle = source->GetController().LoadURL(
    params.url, params.referrer, params.transition, params.extra_headers);

This specific LoadURL method (in NavigationControllerImpl) creates a default LoadURLParams object where is_renderer_initiated is hardcoded to false and initiator_origin is std::nullopt. Crucially, while the provenance is discarded, the renderer-supplied params.extra_headers are forwarded. This causes the browser to treat an untrusted renderer-initiated navigation as a highly trusted, browser-initiated navigation (e.g., as if the user typed it into the omnibox).

Potential Exploitation Steps

Note: These are suggested steps based on static code analysis. Our tooling does not yet have the ability to run code or produce a working proof-of-concept.

If an attacker compromises a renderer process in a Chromecast (cast_shell) environment, they could potentially exploit this bug to steal cross-origin data through the following sequence:

1. Craft IPC payload: The compromised renderer constructs a blink::mojom::OpenURLParams IPC payload targeting a sensitive cross-origin GET endpoint (e.g., https://bank.com/api/data).
2. Spoof Headers: The attacker includes a spoofed Origin header in the extra_headers field.
3. Bypass Browser Validation: The browser receives the IPC. Because the navigation is laundered into a “browser-initiated” navigation by CastWebViewDefault, security checks in AddAdditionalRequestHeaders (which normally strip unexpected Origin headers on renderer-initiated GET requests) are bypassed. The spoofed Origin header remains intact.
4. Bypass Fetch Metadata: The Network Service computes the Sec-Fetch-Site header. Because initiator_origin is now std::nullopt, it is treated as a user-initiated top-level navigation, and the network service emits Sec-Fetch-Site: none instead of cross-site.
5. Server Response: The target server receives the request with a trusted Origin and Sec-Fetch-Site: none. Believing it to be a legitimate, user-initiated navigation, it bypasses CSRF and resource isolation protections and returns sensitive data.
6. Data Theft: Strict Site Isolation is globally disabled on Chromecast (CastContentBrowserClient::ShouldEnableStrictSiteIsolation returns false). Consequently, the browser may reuse the existing (compromised) renderer process for the new cross-origin document. The attacker’s persistent code in the compromised process can then read the sensitive response directly from process memory.

Suggested Fix

Update CastWebViewDefault::OpenURLFromTab to use LoadURLWithParams and pass a correctly initialized LoadURLParams object that preserves the provenance from OpenURLParams.

content::NavigationController::LoadURLParams load_params(params);
auto navigation_handle = source->GetController().LoadURLWithParams(load_params);

Evaluated with Chrome root at commit: 096fc8fdbfacf2546485756d03f160a3d04fcc9b

Results so far have been promising, but there can be wrong deductions. If this proves to be a false positive, please close as WAI; data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.