Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports without the Chrome Security team. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: A diagnostic check in the Android keyboard accessory implementation potentially logs cleartext passwords when an origin mismatch is detected. This results in sensitive user credentials being written to the Android system log (logcat) and included in crash reports uploaded to Google.

Affected files:

• chrome/browser/keyboard_accessory/android/password_accessory_controller_impl.cc

Estimated timestamp from git blame: 2024-11-05

Summary

A potential security vulnerability in PasswordAccessoryControllerImpl on Android may cause cleartext passwords to be leaked to system logs and crash reporting telemetry. When a defensive origin check fails during a password-filling operation, a diagnostic log message is generated that includes the plaintext password being protected.

Root Cause Analysis

In chrome/browser/keyboard_accessory/android/password_accessory_controller_impl.cc, the method EnsureAcknowledgementBeforeFilling performs a security check to ensure that the currently focused frame origin matches the origin associated with a selected suggestion. If this check fails, the code triggers a DUMP_WILL_BE_NOTREACHED() macro:

// chrome/browser/keyboard_accessory/android/password_accessory_controller_impl.cc:984
if (!AppearsInSuggestions(selection, origin)) {
  DUMP_WILL_BE_NOTREACHED()
      << "Tried to fill '" << selection.display_text() << "' into " << origin;
  return;
}

For password suggestions, selection.display_text() is populated with the user’s plaintext password during the construction of the accessory sheet field (lines 129-138):

// chrome/browser/keyboard_accessory/android/password_accessory_controller_impl.cc:133
.SetDisplayText(credential.password()) // Contains cleartext password

While the field is marked as obfuscated for UI purposes, the underlying string passed to the logging macro remains in cleartext.

Potential Disclosure Channels

When the DUMP_WILL_BE_NOTREACHED() branch is hit in official release builds, the following occurs:

1. Android System Log (logcat): The message, including the plaintext password, is emitted to the system log via __android_log_write. This data is preserved in system logs and can be accessed by privileged applications or local attackers with log access.
2. Crash Reporting Telemetry: The diagnostic message is stored in the Logging-NOTREACHED_MESSAGE crash key and copied to a stack buffer. When crash reporting is enabled, this information is included in a minidump that is uploaded to Google’s crash servers via base::debug::DumpWithoutCrashing().

Potential Attack Vector

An attacker could potentially trigger this leak by inducing a focus race. A suggested sequence of events is:

1. A user visits a legitimate site (Origin A) and prepares to use a saved password via the keyboard accessory.
2. A malicious cross-origin subframe (Origin B) on the same page waits for the accessory to appear.
3. Just as the user taps the password chip, the subframe executes window.focus() or element.focus() to steal focus.
4. The browser detects that the focused frame (Origin B) does not match the credential (Origin A), triggering the DUMP_WILL_BE_NOTREACHED() macro and logging the plaintext password.

Suggested Fix

Modify the diagnostic log message in EnsureAcknowledgementBeforeFilling to remove the sensitive selection.display_text() value. If logging is required for debugging, use a non-sensitive identifier or simply log that a mismatch occurred without including the credential content.

Evaluated with Chrome root at commit: b3153093eb3c78c3e88ccf562bcbc20437a04b0e

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

• If you are familiar with the severity guidelines, you may adjust the severity.
• If this is a false positive, and there’s no work to be done, please close as WAI.
• If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.