Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in WebRTC’s CroppingWindowCapturer on Windows. During a window capture operation, the window coordinates are validated and cached before the full-screen capture occurs, but the post-capture verification fails to check if the window moved in the interim. If an attacker-controlled sharing window is moved between these steps, it can crop the screen using stale coordinates, potentially exposing pixels from underlying native windows.

Affected files:

• third_party/webrtc/modules/desktop_capture/cropping_window_capturer.cc
• third_party/webrtc/modules/desktop_capture/cropping_window_capturer_win.cc

Estimated timestamp from git blame: 2026-04-27

Bug Description and Root Cause

A potential position Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the WebRTC CroppingWindowCapturer component on Windows.

During CaptureFrame() in third_party/webrtc/modules/desktop_capture/cropping_window_capturer.cc (line 48), the capturer queries and caches the crop-rectangle in last_window_rect_ before triggering the full-screen pixel capture:

void CroppingWindowCapturer::CaptureFrame() {
  if (ShouldUseScreenCapturer()) {
    // We record the window position here at capture time; it may differ at
    // frame delivery time.
    last_window_rect_ = GetWindowRectInVirtualScreen();
    ...
    screen_capturer_->CaptureFrame();
  } else {
    window_capturer_->CaptureFrame();
  }
}

However, during the post-capture callback OnCaptureResult() (line 90), the sanity check re-reads the live window position (via ShouldUseScreenCapturer()) and verifies its visibility and Z-order at that new location, but it never compares this new position against the cached last_window_rect_:

void CroppingWindowCapturer::OnCaptureResult(
    DesktopCapturer::Result result,
    std::unique_ptr<DesktopFrame> screen_frame) {
  if (!ShouldUseScreenCapturer()) { // Re-reads live rect, updates window_region_rect_, runs IsTopWindow()
    ...
    window_capturer_->CaptureFrame();
    return;
  }
  ...
  std::unique_ptr<DesktopFrame> cropped_frame =
      CreateCroppedDesktopFrame(std::move(screen_frame), last_window_rect_); // Crops full-screen using STALE last_window_rect_
  ...
}

Because ShouldUseScreenCapturer() overwrites the internal window_region_rect_ with the live coordinates but no logic verifies that last_window_rect_ still matches the updated window rect, a window translation (such as moving the sharing window via programmatic JavaScript APIs) that occurs between the caching step and the screen capture step will go completely undetected. The capturer then crops the screen frame using the stale coordinates, potentially leaking the pixels of whatever application window was previously covered by the sharing window.

Potential Attack Scenario / Trigger Steps

Note: The following are suggested/potential steps to trigger the vulnerability. Our tooling agent does not currently have the capability to run code or compile POCs to verify this behavior live.

1. Setup: A victim native application window (e.g., containing sensitive personal or financial information) is positioned at screen region A.
2. Targeting: An attacker-controlled web page opens a popup window and positions it at region A so that it completely covers the victim window and is topmost.
3. Initiating Media Capture: The attacker triggers getDisplayMedia({video: true}) and induces the user to select the attacker’s popup window in the picker UI.
4. Timing the Race:
   • At T0, CaptureFrame() runs. ShouldUseScreenCapturer() checks the popup, storing coordinates A.
   • At T1, last_window_rect_ is cached as A.
   • Immediately after this (and before the pixel grab completes), the attacker’s page calls popup.moveTo(B) to shift the popup to region B (an empty or non-sensitive desktop area). This exposes the victim window at region A.
   • At T3, the screen capturer performs the virtual screen pixel acquisition. Region A now contains the pixels of the exposed victim window.
   • At T4, OnCaptureResult() executes and calls ShouldUseScreenCapturer(). It queries the popup’s live coordinates (now B), confirms that the popup is visible and topmost at B, and succeeds.
   • At T5, CreateCroppedDesktopFrame crops the captured virtual screen using the stale coordinates A.
5. Impact: The pixels of the victim window at region A are delivered to the attacker’s media stream, potentially disclosing cross-window pixel data without explicit user consent.

Suggested Fix

In CroppingWindowCapturer::OnCaptureResult(), after the second ShouldUseScreenCapturer() call succeeds, compare the newly-read window rect (converted to virtual screen coordinates) against last_window_rect_. If they differ (meaning the window moved during capture), discard the screen frame and fall back to capturing via the window capturer or return a temporary error:

  if (!ShouldUseScreenCapturer()) {
    RTC_LOG(LS_INFO) << "Window no longer on top when ScreenCapturer finishes";
    window_capturer_->CaptureFrame();
    return;
  }

  DesktopRect current_window_rect = GetWindowRectInVirtualScreen();
  if (current_window_rect != last_window_rect_) {
    RTC_LOG(LS_WARNING) << "Window moved during capture";
    window_capturer_->CaptureFrame();
    return;
  }

Evaluated with Chrome root at commit: b1520ef4a76878853a31f0943b565e42060edec8

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

• If you are familiar with the severity guidelines, you may adjust the severity.
• If this is a false positive, and there’s no work to be done, please close as WAI.
• If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.