From 278dea1a5010f7c4dc7eebc0e86346cda6feacf5 Mon Sep 17 00:00:00 2001
From: Alexis Hétu <sugoi@chromium.org>
Date: Tue, 16 Jun 2026 05:51:44 -0700
Subject: [PATCH] [iOS] Enforce user gesture requirements for modal passkey requests

Consolidates and enforces user gesture validation for both modal
passkey registration and assertion requests, ensuring untrusted,
gestureless JavaScript events are correctly rejected and deferred
to the renderer.

Bug: 523708527
Change-Id: Ie9c78d2647c557881ad82313ec9d7e745767acd8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7943004
Reviewed-by: Tommy Martino <tmartino@chromium.org>
Reviewed-by: Sourav Uttam Sinha <sinhasourav@google.com>
Commit-Queue: Alexis Hétu <sugoi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1647484}
---

diff --git a/components/webauthn/ios/passkey_java_script_feature.mm b/components/webauthn/ios/passkey_java_script_feature.mm
index d0724eb05..4d8c31d 100644
--- a/components/webauthn/ios/passkey_java_script_feature.mm
+++ b/components/webauthn/ios/passkey_java_script_feature.mm
@@ -89,8 +89,15 @@
   return output;
 }
 
-bool ValidateFeatureUsage(const PasskeyRequestParams& request_params) {
+bool ValidateFeatureUsage(const PasskeyRequestParams& request_params,
+                          bool has_user_interaction) {
   if (request_params.Type() == PasskeyRequestParams::RequestType::kModal) {
+    // Modal passkey registration or assertion is only allowed if it originates
+    // from a user gesture.
+    if (!has_user_interaction) {
+      return false;
+    }
+
     return base::FeatureList::IsEnabled(kIOSPasskeyModalLoginWithShim);
   } else {
     return base::FeatureList::IsEnabled(kIOSPasskeyConditionalLoginWithShim);
@@ -317,15 +324,8 @@
       return;
     }
 
-    if (!ValidateFeatureUsage(*registration_request_params)) {
-      // TODO(crbug.com/460485333): Log the error.
-      passkey_tab_helper->DeferToRenderer(std::move(*request_info),
-                                          registration_request_params->Type());
-      return;
-    }
-
-    // Passkey creation is only allowed if it originates from a user gesture.
-    if (!message.is_user_interacting()) {
+    if (!ValidateFeatureUsage(*registration_request_params,
+                              message.is_user_interacting())) {
       // TODO(crbug.com/460485333): Log the error.
       passkey_tab_helper->DeferToRenderer(std::move(*request_info),
                                           registration_request_params->Type());
@@ -349,7 +349,8 @@
       return;
     }
 
-    if (!ValidateFeatureUsage(*assertion_request_params)) {
+    if (!ValidateFeatureUsage(*assertion_request_params,
+                              message.is_user_interacting())) {
       // TODO(crbug.com/460485333): Log the error.
       passkey_tab_helper->DeferToRenderer(std::move(*request_info),
                                           assertion_request_params->Type());