Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports without the Chrome Security team. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: The media_session_id_ member in CastMediaController is not initialized during construction, potentially leaking browser-process heap residue. This value is included in control messages sent to Cast receiver applications, which could be controlled by an attacker.

Affected files:

• chrome/browser/media/router/providers/cast/cast_media_controller.h
• chrome/browser/media/router/providers/cast/cast_media_controller.cc

Estimated timestamp from git blame: 2019-08-01

Summary

A potential information leak exists in the CastMediaController class due to an uninitialized integer member, media_session_id_. This member is serialized into JSON-based media control requests (such as play, pause, or seek) sent to third-party Cast receiver applications. Since the object is heap-allocated in the browser process and PartitionAlloc does not zero-initialize memory by default, this field may contain stale data from previous allocations.

Root Cause Analysis

In chrome/browser/media/router/providers/cast/cast_media_controller.h, the media_session_id_ member is declared without an in-class initializer:

// chrome/browser/media/router/providers/cast/cast_media_controller.h:89
int media_session_id_;

The constructor in chrome/browser/media/router/providers/cast/cast_media_controller.cc also fails to initialize this field:

// chrome/browser/media/router/providers/cast/cast_media_controller.cc:82-84
CastMediaController::CastMediaController(AppActivity* activity)
    : sender_id_("sender-" + base::NumberToString(base::RandUint64())),
      activity_(activity) {}

Initialization of this member only occurs in UpdateMediaStatus when a valid mediaSessionId is received from the Cast receiver. If the receiver intentionally omits this field, the member remains uninitialized.

Information Leak Path

The uninitialized value is read and included in outgoing messages within CreateMediaRequest:

// chrome/browser/media/router/providers/cast/cast_media_controller.cc:193-202
base::DictValue CastMediaController::CreateMediaRequest(V2MessageType type) {
  return base::DictValue()
      .Set("message",
           base::DictValue()
               .Set("mediaSessionId", media_session_id_)   // <--- Uninitialized read
               .Set("sessionId", session_id_)
               .Set("type", cast_util::EnumToString(type).value().data()))
      .Set("type", "v2_message")
      .Set("clientId", sender_id_);
}

This method is triggered when a user interacts with the Global Media Controls (GMC) UI to control a Cast session. The resulting JSON is sent over the network to the Cast receiver.

Suggested Potential Attack Steps

An attacker could potentially trigger this leak by following these steps:

1. Register and host a custom Cast receiver application.
2. Lure a user into casting to a device running this malicious receiver.
3. Upon receiving the initial MEDIA_GET_STATUS request from Chrome, have the receiver send a MEDIA_STATUS response that intentionally omits the mediaSessionId field.
4. Wait for the user to interact with media controls (e.g., clicking Pause) in the Chrome browser UI.
5. Observe and log the mediaSessionId field in the incoming command message from Chrome, which will contain 4 bytes of browser-process heap residue.

Note: These steps are based on static code analysis; we have not yet verified this with a running proof of concept.

Suggested Fix

Initialize media_session_id_ to a safe default value in the header file:

// chrome/browser/media/router/providers/cast/cast_media_controller.h
int media_session_id_ = 0;

Evaluated with Chrome root at commit: b3153093eb3c78c3e88ccf562bcbc20437a04b0e

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

• If you are familiar with the severity guidelines, you may adjust the severity.
• If this is a false positive, and there’s no work to be done, please close as WAI.
• If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.