From dd2818b02583be0a2569e2a53997f08a7b48dc87 Mon Sep 17 00:00:00 2001
From: viplavkadam <viplavkadam@google.com>
Date: Tue, 07 Apr 2026 09:51:43 -0700
Subject: [PATCH] [BNPL][Clank] PaymentWindowBridge native pointer fix for Use-After-free

Making the native pointer in Java non-final and setting it zero when
the C++ object is destroyed. Guarding all JNI calls from Java to C++
with a zero-pointer check

Bug: 499018889
Change-Id: I5a2956160d15236dc96598ae132339a1eeb2d3ba
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7731228
Reviewed-by: Timofey Chudakov <tchudakov@google.com>
Reviewed-by: Vinny Persky <vinnypersky@google.com>
Commit-Queue: Viplav Kadam <viplavkadam@google.com>
Cr-Commit-Position: refs/heads/main@{#1610834}
---

diff --git a/chrome/browser/ui/android/autofill/internal/java/src/org/chromium/chrome/browser/ui/autofill/ephemeraltab/PaymentsWindowBridge.java b/chrome/browser/ui/android/autofill/internal/java/src/org/chromium/chrome/browser/ui/autofill/ephemeraltab/PaymentsWindowBridge.java
index 818265c..2db1435 100644
--- a/chrome/browser/ui/android/autofill/internal/java/src/org/chromium/chrome/browser/ui/autofill/ephemeraltab/PaymentsWindowBridge.java
+++ b/chrome/browser/ui/android/autofill/internal/java/src/org/chromium/chrome/browser/ui/autofill/ephemeraltab/PaymentsWindowBridge.java
@@ -16,7 +16,7 @@
 @JNINamespace("autofill::payments")
 @NullMarked
 class PaymentsWindowBridge {
-    private final long mNativePaymentsWindowBridge;
+    private long mNativePaymentsWindowBridge;
     private PaymentsWindowCoordinator mPaymentsWindowCoordinator;
 
     @CalledByNative
@@ -35,6 +35,11 @@
         mPaymentsWindowCoordinator.closeEphemeralTab();
     }
 
+    @CalledByNative
+    public void onNativeDestroyed() {
+        mNativePaymentsWindowBridge = 0;
+    }
+
     PaymentsWindowCoordinator getPaymentsWindowCoordinatorForTesting() {
         return mPaymentsWindowCoordinator;
     }
@@ -50,6 +55,7 @@
      * @param clickedUrl The URL that the user initiated the navigation to.
      */
     void onNavigationFinished(GURL clickedUrl) {
+        if (mNativePaymentsWindowBridge == 0) return;
         PaymentsWindowBridgeJni.get().onNavigationFinished(mNativePaymentsWindowBridge, clickedUrl);
     }
 
@@ -59,6 +65,7 @@
      * @param webContents The WebContents that is being observed.
      */
     public void onWebContentsObservationStarted(WebContents webContents) {
+        if (mNativePaymentsWindowBridge == 0) return;
         PaymentsWindowBridgeJni.get()
                 .onWebContentsObservationStarted(mNativePaymentsWindowBridge, webContents);
     }
@@ -70,6 +77,7 @@
      * imminently destroyed.
      */
     void onWebContentsDestroyed() {
+        if (mNativePaymentsWindowBridge == 0) return;
         PaymentsWindowBridgeJni.get().onWebContentsDestroyed(mNativePaymentsWindowBridge);
     }
 
diff --git a/chrome/browser/ui/android/autofill/internal/java/src/org/chromium/chrome/browser/ui/autofill/ephemeraltab/PaymentsWindowBridgeTest.java b/chrome/browser/ui/android/autofill/internal/java/src/org/chromium/chrome/browser/ui/autofill/ephemeraltab/PaymentsWindowBridgeTest.java
index a58457d..2355101 100644
--- a/chrome/browser/ui/android/autofill/internal/java/src/org/chromium/chrome/browser/ui/autofill/ephemeraltab/PaymentsWindowBridgeTest.java
+++ b/chrome/browser/ui/android/autofill/internal/java/src/org/chromium/chrome/browser/ui/autofill/ephemeraltab/PaymentsWindowBridgeTest.java
@@ -6,6 +6,7 @@
 
 import static org.junit.Assert.assertNotNull;
 import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
 
 import org.junit.Before;
 import org.junit.Rule;
@@ -81,4 +82,19 @@
 
         verify(mNativeMock).onWebContentsDestroyed(AUTOFILL_PAYMENTS_WINDOW_BRIDGE_NATIVE_POINTER);
     }
+
+    @Test
+    public void testNativeMethodsNotCalledAfterNativeDestroyed() {
+        PaymentsWindowBridgeJni.setInstanceForTesting(mNativeMock);
+
+        // Simulate native object destruction.
+        mPaymentsWindowBridge.onNativeDestroyed();
+
+        // Native method calls.
+        mPaymentsWindowBridge.onNavigationFinished(ISSUER_URL);
+        mPaymentsWindowBridge.onWebContentsObservationStarted(mMerchantWebContents);
+        mPaymentsWindowBridge.onWebContentsDestroyed();
+
+        verifyNoInteractions(mNativeMock);
+    }
 }
diff --git a/chrome/browser/ui/android/autofill/payments/payments_window_bridge.cc b/chrome/browser/ui/android/autofill/payments/payments_window_bridge.cc
index f10e3000..d18a6bf 100644
--- a/chrome/browser/ui/android/autofill/payments/payments_window_bridge.cc
+++ b/chrome/browser/ui/android/autofill/payments/payments_window_bridge.cc
@@ -27,7 +27,12 @@
       base::android::AttachCurrentThread(), reinterpret_cast<int64_t>(this));
 }
 
-PaymentsWindowBridge::~PaymentsWindowBridge() = default;
+PaymentsWindowBridge::~PaymentsWindowBridge() {
+  if (java_payments_window_bridge_) {
+    Java_PaymentsWindowBridge_onNativeDestroyed(
+        base::android::AttachCurrentThread(), java_payments_window_bridge_);
+  }
+}
 
 void PaymentsWindowBridge::OpenEphemeralTab(
     const GURL& url,