From fa454ea8264a3a10c1992a370183b91037d0c347 Mon Sep 17 00:00:00 2001
From: Peter K <pkotwicz@google.com>
Date: Mon, 20 Jul 2026 15:19:56 -0700
Subject: [PATCH] [A11y] Fix potential type confusion in BrowserAccessibilityManagerWin

This CL fixes potential type confusion in BrowserAccessibilityManagerWin::OnAtomicUpdateFinished() and
BrowserAccessibilityComWin::GetTargetFromChildID()
by using
ToBrowserAccessibilityComWin(
    BrowserAccessibility::FromAXPlatformNodeDelegate())

Bug:498885920

Change-Id: Idd3e2185e87fbaed58d8aa3f0025b5767fa0d514
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7958810
Reviewed-by: David Tseng <dtseng@chromium.org>
Commit-Queue: Peter Kotwicz <pkotwicz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1664976}
---

diff --git a/ui/accessibility/platform/ax_platform_node_delegate.cc b/ui/accessibility/platform/ax_platform_node_delegate.cc
index 1daf0aad..c65a0cb 100644
--- a/ui/accessibility/platform/ax_platform_node_delegate.cc
+++ b/ui/accessibility/platform/ax_platform_node_delegate.cc
@@ -1354,4 +1354,8 @@
   return result;
 }
 
+BrowserAccessibility* AXPlatformNodeDelegate::ToBrowserAccessibility() {
+  return nullptr;
+}
+
 }  // namespace ui
diff --git a/ui/accessibility/platform/ax_platform_node_delegate.h b/ui/accessibility/platform/ax_platform_node_delegate.h
index ca2e975..67759416 100644
--- a/ui/accessibility/platform/ax_platform_node_delegate.h
+++ b/ui/accessibility/platform/ax_platform_node_delegate.h
@@ -47,6 +47,7 @@
 struct AXActionData;
 struct AXNodeData;
 struct AXTreeData;
+class BrowserAccessibility;
 class ChildIterator;
 
 using TextAttribute = std::pair<std::string, std::string>;
@@ -664,12 +665,16 @@
   }
 
  protected:
+  friend class BrowserAccessibility;
+
   explicit AXPlatformNodeDelegate(AXNode* node);
 
   virtual std::string SubtreeToStringHelper(size_t level);
 
   virtual void NotifyAccessibilityApiUsage() const {}
 
+  virtual BrowserAccessibility* ToBrowserAccessibility();
+
   AXPlatformNodeDelegate* GetParentDelegate() const;
 
   // Given a set of Blink node IDs, get their respective platform nodes and
diff --git a/ui/accessibility/platform/browser_accessibility.cc b/ui/accessibility/platform/browser_accessibility.cc
index 88fb3ce..ee13b80b 100644
--- a/ui/accessibility/platform/browser_accessibility.cc
+++ b/ui/accessibility/platform/browser_accessibility.cc
@@ -64,9 +64,10 @@
 // static
 BrowserAccessibility* BrowserAccessibility::FromAXPlatformNodeDelegate(
     AXPlatformNodeDelegate* delegate) {
-  if (!delegate || !delegate->IsWebContent())
+  if (!delegate) {
     return nullptr;
-  return static_cast<BrowserAccessibility*>(delegate);
+  }
+  return delegate->ToBrowserAccessibility();
 }
 
 BrowserAccessibility::BrowserAccessibility(BrowserAccessibilityManager* manager,
@@ -987,6 +988,10 @@
   return result;
 }
 
+BrowserAccessibility* BrowserAccessibility::ToBrowserAccessibility() {
+  return this;
+}
+
 const std::vector<gfx::NativeViewAccessible>
 BrowserAccessibility::GetUIADirectChildrenInRange(AXPlatformNodeDelegate* start,
                                                   AXPlatformNodeDelegate* end) {
diff --git a/ui/accessibility/platform/browser_accessibility.h b/ui/accessibility/platform/browser_accessibility.h
index 7aba93b3..4ea1d42 100644
--- a/ui/accessibility/platform/browser_accessibility.h
+++ b/ui/accessibility/platform/browser_accessibility.h
@@ -488,6 +488,8 @@
 
   std::string SubtreeToStringHelper(size_t level) override;
 
+  BrowserAccessibility* ToBrowserAccessibility() override;
+
   // The UIA tree formatter needs access to GetUniqueId() to identify the
   // starting point for tree dumps.
   friend class AccessibilityTreeFormatterUia;
diff --git a/ui/accessibility/platform/browser_accessibility_com_win.cc b/ui/accessibility/platform/browser_accessibility_com_win.cc
index 9e97672..1a7cf45 100644
--- a/ui/accessibility/platform/browser_accessibility_com_win.cc
+++ b/ui/accessibility/platform/browser_accessibility_com_win.cc
@@ -28,6 +28,7 @@
 #include "ui/accessibility/ax_mode.h"
 #include "ui/accessibility/ax_role_properties.h"
 #include "ui/accessibility/platform/ax_platform.h"
+#include "ui/accessibility/platform/ax_platform_node_win.h"
 #include "ui/accessibility/platform/browser_accessibility_manager_win.h"
 #include "ui/accessibility/platform/browser_accessibility_win.h"
 #include "ui/base/win/accessibility_ids_win.h"
@@ -1865,8 +1866,13 @@
     return ToBrowserAccessibilityComWin(owner->PlatformGetChild(child_id - 1));
   }
 
-  auto* child = static_cast<BrowserAccessibilityComWin*>(
-      AXPlatformNodeWin::GetFromUniqueId(-child_id));
+  auto* platform_node = AXPlatformNodeWin::GetFromUniqueId(-child_id);
+  if (!platform_node) {
+    return nullptr;
+  }
+  auto* child = ToBrowserAccessibilityComWin(
+      BrowserAccessibility::FromAXPlatformNodeDelegate(
+          platform_node->GetDelegate()));
   if (child && child->GetOwner()->IsDescendantOf(owner)) {
     return child;
   }
diff --git a/ui/accessibility/platform/browser_accessibility_manager_win.cc b/ui/accessibility/platform/browser_accessibility_manager_win.cc
index 043ec239..b2140dd 100644
--- a/ui/accessibility/platform/browser_accessibility_manager_win.cc
+++ b/ui/accessibility/platform/browser_accessibility_manager_win.cc
@@ -63,6 +63,14 @@
 constexpr char kBrowserRootViewClassName[] = "BrowserRootView";
 constexpr char kTabClassName[] = "Tab";
 
+BrowserAccessibilityComWin* ToBrowserAccessibilityComWin(AXPlatformNode* node) {
+  if (!node) {
+    return nullptr;
+  }
+  return ::ui::ToBrowserAccessibilityComWin(
+      BrowserAccessibility::FromAXPlatformNodeDelegate(node->GetDelegate()));
+}
+
 }  // namespace
 
 // static
@@ -1067,8 +1075,9 @@
   // recomputes all of win_attributes_ other than IAccessibleText.
   auto state_scan = update_states.begin();
   for (auto* node : objs_to_update) {
-    static_cast<BrowserAccessibilityComWin*>(node)
-        ->UpdateStep1ComputeWinAttributes(&*state_scan);
+    if (auto* com_win = ToBrowserAccessibilityComWin(node)) {
+      com_win->UpdateStep1ComputeWinAttributes(&*state_scan);
+    }
     ++state_scan;
   }
 
@@ -1076,8 +1085,9 @@
   // concatenation of all of its child text nodes, so it can't run until
   // the text of all of the nodes was computed in the previous step.
   for (auto* node : objs_to_update) {
-    static_cast<BrowserAccessibilityComWin*>(node)
-        ->UpdateStep2ComputeHypertext();
+    if (auto* com_win = ToBrowserAccessibilityComWin(node)) {
+      com_win->UpdateStep2ComputeHypertext();
+    }
   }
 
   // The third step fires events on nodes based on what's changed - like
@@ -1089,7 +1099,9 @@
   // At the end, it deletes old_win_attributes_ since they're not needed
   // anymore.
   for (auto* node : objs_to_update) {
-    static_cast<BrowserAccessibilityComWin*>(node)->UpdateStep3FireEvents();
+    if (auto* com_win = ToBrowserAccessibilityComWin(node)) {
+      com_win->UpdateStep3FireEvents();
+    }
   }
 }