Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: The DevTools Performance panel trace parser is vulnerable to potential prototype pollution when processing malicious trace files. An attacker-controlled ‘frameSeqId’ key can be used to mutate Object.prototype in the privileged devtools:// renderer process.

Affected files:

• third_party/devtools-frontend/src/front_end/models/trace/handlers/FramesHandler.ts
• third_party/devtools-frontend/src/front_end/models/trace/types/TraceEvents.ts
• third_party/devtools-frontend/src/front_end/panels/timeline/TimelinePanel.ts

Estimated timestamp from git blame: 2021-09-06

Summary

A potential prototype pollution vulnerability exists in the Chromium DevTools Performance panel’s trace engine. When a user imports a specially crafted trace file, the parser uses attacker-controlled keys to perform property assignments on a plain JavaScript object. This can lead to the mutation of Object.prototype within the privileged devtools:// renderer process.

Root Cause Analysis

The vulnerability resides in the TimelineFrameBeginFrameQueue class in third_party/devtools-frontend/src/front_end/models/trace/handlers/FramesHandler.ts. This class uses a plain JavaScript object ({}) as a map to track frame information:

export class TimelineFrameBeginFrameQueue {
  private mapFrames: Record<number, BeginFrameInfo> = {}; // Plain object

  setDropped(seqId: number, isDropped: boolean): void {
    if (seqId in this.mapFrames) {
      this.mapFrames[seqId].isDropped = isDropped;
    }
  }
}

The seqId parameter is derived directly from the frameSeqId field of DroppedFrame events in the trace JSON. If an attacker provides the string "__proto__" as the frameSeqId, the following occurs:

1. The check seqId in this.mapFrames (effectively "__proto__" in {}) evaluates to true because __proto__ is inherited from Object.prototype.
2. The assignment this.mapFrames[seqId].isDropped = isDropped resolves to Object.prototype.isDropped = isDropped.

This pollutes the global Object.prototype for the entire renderer process. Similar patterns exist in setPartial and in other handlers like ScriptsHandler.ts and SamplesHandler.ts where trace-derived keys are used with plain objects.

Potential Attack Vector

An attacker could distribute a malicious Performance trace file (JSON). If a user loads this file into DevTools, the prototype pollution is triggered. Given that the DevTools frontend is a complex JavaScript application running in a privileged origin (devtools://), polluting Object.prototype could potentially lead to secondary vulnerabilities such as cross-site scripting (XSS) or remote code execution (RCE) within the renderer process by overriding configuration or template properties used by the UI.

Suggested Steps to Reproduce

Note: These steps are potential/suggested as they have not been executed by our automated tools.

1. Create a trace file pollute.json with the following content:

   [
     {"name": "TracingStartedInBrowser", "ph": "I", "args": {"data": {"frames": [{"frame": "1"}]}}},
     {"name": "DroppedFrame", "ph": "I", "cat": "disabled-by-default-devtools.timeline.frame", "ts": 1000, "args": {"layerTreeId": 1, "frameSeqId": "__proto__", "hasPartialUpdate": true}}
   ]
   

2. Open Chrome DevTools and go to the Performance panel.
3. Click the Load profile button and select pollute.json.
4. Once loaded, check the console for pollution: console.log(({}).isDropped);. If the value is true, the prototype has been polluted.

Recommended Fix

The mapFrames object (and similar map objects in trace handlers) should be initialized with a null prototype to prevent access to Object.prototype properties:

private mapFrames: Record<number, BeginFrameInfo> = Object.create(null);

Alternatively, use the built-in Map class, which is designed for key-value storage and is not susceptible to prototype pollution.

Evaluated with Chrome root at commit: 1a8d40fc44df2088d5945c0bf53584038aa1614a

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

• If you are familiar with the severity guidelines, you may adjust the severity.
• If this is a false positive, and there’s no work to be done, please close as WAI.
• If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.