From 70b3b177f7d9116a2c181a204b9f37256fe997de Mon Sep 17 00:00:00 2001
From: Frank Liberato <liberato@chromium.org>
Date: Wed, 15 Jul 2026 10:47:58 -0700
Subject: [PATCH] Verify isTrusted for orientationchange in MediaControlsRotateToFullscreenDelegate

This CL adds an isTrusted check to the kOrientationchange event handler in MediaControlsRotateToFullscreenDelegate::Invoke, ensuring that only genuine hardware-triggered orientation changes can grant transient user activation and trigger fullscreen transitions.

Added a unit test to verify that untrusted orientationchange events are ignored.

BUG=514408247

TAG=agy

CONV=ca3e205f-82aa-4e9b-9ec6-0b80c1443cbb

Change-Id: Ibe1fde6b37867bcc6249dae5aece7ce923bc61d6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8092753
Reviewed-by: Tommy Steimel <steimel@chromium.org>
Auto-Submit: Frank Liberato <liberato@chromium.org>
Commit-Queue: Benjamin Keen <bkeen@google.com>
Reviewed-by: Benjamin Keen <bkeen@google.com>
Cr-Commit-Position: refs/heads/main@{#1662734}
---

diff --git a/third_party/blink/renderer/modules/media_controls/media_controls_rotate_to_fullscreen_delegate.cc b/third_party/blink/renderer/modules/media_controls/media_controls_rotate_to_fullscreen_delegate.cc
index 1667b39..c8bfa1a 100644
--- a/third_party/blink/renderer/modules/media_controls/media_controls_rotate_to_fullscreen_delegate.cc
+++ b/third_party/blink/renderer/modules/media_controls/media_controls_rotate_to_fullscreen_delegate.cc
@@ -112,7 +112,9 @@
     return;
   }
   if (event->type() == event_type_names::kOrientationchange) {
-    OnScreenOrientationChange();
+    if (event->isTrusted()) {
+      OnScreenOrientationChange();
+    }
     return;
   }
 
diff --git a/third_party/blink/renderer/modules/media_controls/media_controls_rotate_to_fullscreen_delegate_test.cc b/third_party/blink/renderer/modules/media_controls/media_controls_rotate_to_fullscreen_delegate_test.cc
index 538c8783..7ea0588 100644
--- a/third_party/blink/renderer/modules/media_controls/media_controls_rotate_to_fullscreen_delegate_test.cc
+++ b/third_party/blink/renderer/modules/media_controls/media_controls_rotate_to_fullscreen_delegate_test.cc
@@ -27,6 +27,7 @@
 #include "third_party/blink/renderer/modules/device_orientation/device_orientation_data.h"
 #include "third_party/blink/renderer/modules/media_controls/media_controls_impl.h"
 #include "third_party/blink/renderer/modules/screen_orientation/screen_orientation_controller.h"
+#include "third_party/blink/renderer/platform/bindings/exception_state.h"
 #include "third_party/blink/renderer/platform/heap/garbage_collected.h"
 #include "third_party/blink/renderer/platform/testing/empty_web_media_player.h"
 #include "third_party/blink/renderer/platform/testing/runtime_enabled_features_test_helpers.h"
@@ -155,8 +156,15 @@
     GetVideo().removeAttribute(html_names::kControlsAttr);
   }
 
-  void DispatchEvent(EventTarget& target, const AtomicString& type) {
-    target.DispatchEvent(*Event::Create(type));
+  void DispatchEvent(EventTarget& target,
+                     const AtomicString& type,
+                     bool is_trusted = false) {
+    Event* event = Event::Create(type);
+    if (is_trusted) {
+      target.DispatchEvent(*event);
+    } else {
+      target.dispatchEventForBindings(event, IGNORE_EXCEPTION);
+    }
   }
 
   void InitScreenAndVideo(
@@ -231,7 +239,8 @@
 void MediaControlsRotateToFullscreenDelegateTest::RotateTo(
     display::mojom::blink::ScreenOrientation new_screen_orientation) {
   GetChromeClient().MockScreenInfo().orientation_type = new_screen_orientation;
-  DispatchEvent(GetWindow(), event_type_names::kOrientationchange);
+  DispatchEvent(GetWindow(), event_type_names::kOrientationchange,
+                true /* is_trusted */);
   test::RunPendingTasks();
 }
 
@@ -803,4 +812,29 @@
   EXPECT_TRUE(GetVideo().IsFullscreen());
 }
 
+TEST_F(MediaControlsRotateToFullscreenDelegateTest, UntrustedEventIgnored) {
+  // Portrait screen, landscape video.
+  InitScreenAndVideo(display::mojom::blink::ScreenOrientation::kPortraitPrimary,
+                     gfx::Size(640, 480));
+  EXPECT_EQ(SimpleOrientation::kPortrait, ObservedScreenOrientation());
+  EXPECT_EQ(SimpleOrientation::kLandscape, ComputeVideoOrientation());
+
+  // Play video.
+  PlayVideo();
+  UpdateVisibilityObserver();
+
+  EXPECT_TRUE(ObservedVisibility());
+  EXPECT_FALSE(GetVideo().IsFullscreen());
+
+  // Simulate rotation in ScreenInfo but dispatch an UNTRUSTED event.
+  GetChromeClient().MockScreenInfo().orientation_type =
+      display::mojom::blink::ScreenOrientation::kLandscapePrimary;
+  DispatchEvent(GetWindow(), event_type_names::kOrientationchange,
+                false /* is_trusted */);
+  test::RunPendingTasks();
+
+  // Should NOT enter fullscreen because the event was untrusted.
+  EXPECT_FALSE(GetVideo().IsFullscreen());
+}
+
 }  // namespace blink

diff --git a/third_party/blink/renderer/modules/media_controls/media_controls_rotate_to_fullscreen_delegate_test.cc b/third_party/blink/renderer/modules/media_controls/media_controls_rotate_to_fullscreen_delegate_test.cc
index 538c8783..7ea0588 100644
--- a/third_party/blink/renderer/modules/media_controls/media_controls_rotate_to_fullscreen_delegate_test.cc
+++ b/third_party/blink/renderer/modules/media_controls/media_controls_rotate_to_fullscreen_delegate_test.cc
@@ -27,6 +27,7 @@
 #include "third_party/blink/renderer/modules/device_orientation/device_orientation_data.h"
 #include "third_party/blink/renderer/modules/media_controls/media_controls_impl.h"
 #include "third_party/blink/renderer/modules/screen_orientation/screen_orientation_controller.h"
+#include "third_party/blink/renderer/platform/bindings/exception_state.h"
 #include "third_party/blink/renderer/platform/heap/garbage_collected.h"
 #include "third_party/blink/renderer/platform/testing/empty_web_media_player.h"
 #include "third_party/blink/renderer/platform/testing/runtime_enabled_features_test_helpers.h"
@@ -155,8 +156,15 @@
     GetVideo().removeAttribute(html_names::kControlsAttr);
   }
 
-  void DispatchEvent(EventTarget& target, const AtomicString& type) {
-    target.DispatchEvent(*Event::Create(type));
+  void DispatchEvent(EventTarget& target,
+                     const AtomicString& type,
+                     bool is_trusted = false) {
+    Event* event = Event::Create(type);
+    if (is_trusted) {
+      target.DispatchEvent(*event);
+    } else {
+      target.dispatchEventForBindings(event, IGNORE_EXCEPTION);
+    }
   }
 
   void InitScreenAndVideo(
@@ -231,7 +239,8 @@
 void MediaControlsRotateToFullscreenDelegateTest::RotateTo(
     display::mojom::blink::ScreenOrientation new_screen_orientation) {
   GetChromeClient().MockScreenInfo().orientation_type = new_screen_orientation;
-  DispatchEvent(GetWindow(), event_type_names::kOrientationchange);
+  DispatchEvent(GetWindow(), event_type_names::kOrientationchange,
+                true /* is_trusted */);
   test::RunPendingTasks();
 }
 
@@ -803,4 +812,29 @@
   EXPECT_TRUE(GetVideo().IsFullscreen());
 }
 
+TEST_F(MediaControlsRotateToFullscreenDelegateTest, UntrustedEventIgnored) {
+  // Portrait screen, landscape video.
+  InitScreenAndVideo(display::mojom::blink::ScreenOrientation::kPortraitPrimary,
+                     gfx::Size(640, 480));
+  EXPECT_EQ(SimpleOrientation::kPortrait, ObservedScreenOrientation());
+  EXPECT_EQ(SimpleOrientation::kLandscape, ComputeVideoOrientation());
+
+  // Play video.
+  PlayVideo();
+  UpdateVisibilityObserver();
+
+  EXPECT_TRUE(ObservedVisibility());
+  EXPECT_FALSE(GetVideo().IsFullscreen());
+
+  // Simulate rotation in ScreenInfo but dispatch an UNTRUSTED event.
+  GetChromeClient().MockScreenInfo().orientation_type =
+      display::mojom::blink::ScreenOrientation::kLandscapePrimary;
+  DispatchEvent(GetWindow(), event_type_names::kOrientationchange,
+                false /* is_trusted */);
+  test::RunPendingTasks();
+
+  // Should NOT enter fullscreen because the event was untrusted.
+  EXPECT_FALSE(GetVideo().IsFullscreen());
+}
+
 }  // namespace blink