From 8b64a2a0d89ec6639385e6fea61c4c204a7ed3d7 Mon Sep 17 00:00:00 2001
From: Rob Pitkin <robpitkin@google.com>
Date: Thu, 07 May 2026 17:19:04 -0700
Subject: [PATCH] Web Bluetooth: Fix EXCLUDE_READS blocklist bypass in startNotifications

The Web Bluetooth specification dictates that if a characteristic's UUID
is blocklisted with EXCLUDE_READS, all read operations — including
startNotifications() — must be blocked.

While standard read requests check the blocklist,
WebBluetoothServiceImpl::RemoteCharacteristicStartNotifications lacked
this check. This allowed a malicious site to bypass the read restriction
by subscribing to notifications.

This change adds the missing check.

This change will block `startNotifications()` calls on characteristics
marked as `EXCLUDE_READS`. This might break existing web applications
that were relying on this unintended bypass.

Bug: 496411061
Change-Id: I3bd8ab14f948230e6543acde20d9f1adfdcf2df8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7823004
Reviewed-by: Matt Reynolds <mattreynolds@chromium.org>
Commit-Queue: Rob Pitkin <robpitkin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1627359}
---

diff --git a/content/browser/bluetooth/web_bluetooth_service_impl.cc b/content/browser/bluetooth/web_bluetooth_service_impl.cc
index 9a8a4ff1..a075173 100644
--- a/content/browser/bluetooth/web_bluetooth_service_impl.cc
+++ b/content/browser/bluetooth/web_bluetooth_service_impl.cc
@@ -1308,6 +1308,13 @@
     return;
   }
 
+  if (BluetoothBlocklist::Get().IsExcludedFromReads(
+          query_result.characteristic->GetUUID())) {
+    RecordStartNotificationsOutcome(UMAGATTOperationOutcome::kBlocklisted);
+    std::move(callback).Run(blink::mojom::WebBluetoothResult::BLOCKLISTED_READ);
+    return;
+  }
+
   BluetoothRemoteGattCharacteristic::Properties notify_or_indicate =
       query_result.characteristic->GetProperties() &
       (BluetoothRemoteGattCharacteristic::PROPERTY_NOTIFY |
diff --git a/content/browser/bluetooth/web_bluetooth_service_impl.h b/content/browser/bluetooth/web_bluetooth_service_impl.h
index 3798fb0..c414992 100644
--- a/content/browser/bluetooth/web_bluetooth_service_impl.h
+++ b/content/browser/bluetooth/web_bluetooth_service_impl.h
@@ -157,6 +157,8 @@
                            NoShowBluetoothScanningPromptInPrerendering);
   FRIEND_TEST_ALL_PREFIXES(WebBluetoothServiceImplTest,
                            DeferredStartNotifySession);
+  FRIEND_TEST_ALL_PREFIXES(WebBluetoothServiceImplTest,
+                           StartNotificationsBlocklisted);
   FRIEND_TEST_ALL_PREFIXES(WebBluetoothServiceImplTest, DeviceDisconnected);
   FRIEND_TEST_ALL_PREFIXES(WebBluetoothServiceImplTest,
                            DeviceGattServicesDiscoveryTimeout);
diff --git a/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc b/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc
index 309c147..42523def 100644
--- a/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc
+++ b/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc
@@ -10,14 +10,15 @@
 #include <vector>
 
 #include "base/memory/raw_ptr.h"
-#include "base/test/scoped_feature_list.h"
 #include "base/task/single_thread_task_runner.h"
 #include "base/test/bind.h"
 #include "base/test/gmock_callback_support.h"
 #include "base/test/mock_callback.h"
+#include "base/test/scoped_feature_list.h"
 #include "base/test/test_future.h"
 #include "content/browser/bluetooth/bluetooth_adapter_factory_wrapper.h"
 #include "content/browser/bluetooth/bluetooth_allowed_devices.h"
+#include "content/browser/bluetooth/bluetooth_blocklist.h"
 #include "content/browser/bluetooth/web_bluetooth_pairing_manager.h"
 #include "content/public/browser/bluetooth_delegate.h"
 #include "content/public/common/content_client.h"
@@ -1032,6 +1033,24 @@
   }
 }
 
+TEST_F(WebBluetoothServiceImplTest, StartNotificationsBlocklisted) {
+  RegisterTestCharacteristic();
+  FakeBluetoothCharacteristic& test_characteristic =
+      battery_device_bundle().characteristic();
+
+  BluetoothBlocklist::Get().Add(test_characteristic.GetUUID(),
+                                BluetoothBlocklist::Value::EXCLUDE_READS);
+
+  base::test::TestFuture<WebBluetoothResult> future;
+  service_ptr_->RemoteCharacteristicStartNotifications(
+      test_characteristic.GetIdentifier(),
+      BindCharacteristicClientAndPassRemote(), future.GetCallback());
+
+  EXPECT_EQ(future.Get(), WebBluetoothResult::BLOCKLISTED_READ);
+
+  BluetoothBlocklist::Get().ResetToDefaultValuesForTest();
+}
+
 TEST_F(WebBluetoothServiceImplTest, DeviceGattServicesDiscoveryTimeout) {
   const auto battery_device_id = AddTestDevice(battery_device_bundle());
 

diff --git a/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc b/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc
index 309c147..42523def 100644
--- a/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc
+++ b/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc
@@ -10,14 +10,15 @@
 #include <vector>
 
 #include "base/memory/raw_ptr.h"
-#include "base/test/scoped_feature_list.h"
 #include "base/task/single_thread_task_runner.h"
 #include "base/test/bind.h"
 #include "base/test/gmock_callback_support.h"
 #include "base/test/mock_callback.h"
+#include "base/test/scoped_feature_list.h"
 #include "base/test/test_future.h"
 #include "content/browser/bluetooth/bluetooth_adapter_factory_wrapper.h"
 #include "content/browser/bluetooth/bluetooth_allowed_devices.h"
+#include "content/browser/bluetooth/bluetooth_blocklist.h"
 #include "content/browser/bluetooth/web_bluetooth_pairing_manager.h"
 #include "content/public/browser/bluetooth_delegate.h"
 #include "content/public/common/content_client.h"
@@ -1032,6 +1033,24 @@
   }
 }
 
+TEST_F(WebBluetoothServiceImplTest, StartNotificationsBlocklisted) {
+  RegisterTestCharacteristic();
+  FakeBluetoothCharacteristic& test_characteristic =
+      battery_device_bundle().characteristic();
+
+  BluetoothBlocklist::Get().Add(test_characteristic.GetUUID(),
+                                BluetoothBlocklist::Value::EXCLUDE_READS);
+
+  base::test::TestFuture<WebBluetoothResult> future;
+  service_ptr_->RemoteCharacteristicStartNotifications(
+      test_characteristic.GetIdentifier(),
+      BindCharacteristicClientAndPassRemote(), future.GetCallback());
+
+  EXPECT_EQ(future.Get(), WebBluetoothResult::BLOCKLISTED_READ);
+
+  BluetoothBlocklist::Get().ResetToDefaultValuesForTest();
+}
+
 TEST_F(WebBluetoothServiceImplTest, DeviceGattServicesDiscoveryTimeout) {
   const auto battery_device_id = AddTestDevice(battery_device_bundle());