From e527dc0c98c520274dfb1444fca33e67c31d96c9 Mon Sep 17 00:00:00 2001
From: Mike West <mkwst@chromium.org>
Date: Mon, 10 Aug 2026 14:33:59 -0700
Subject: [PATCH] [Extensions] Verify that `no-cors` redirects don't leak `SameSite` cookies.

Prior to https://crrev.com/c0edd277235be, it was possible for extensions
to bypass `SameSite=Strict` without host permissions. That CL
accidentally fixed this issue, which is excellent! But we should lock in
the behavior with tests, which this CL provides.

Bug: 503464711
Change-Id: I15be2ffbbe2daf180644b3524f247542acd5f8d3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8136859
Reviewed-by: Reilly Grant <reillyg@chromium.org>
Commit-Queue: Charlie Reis <creis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1676728}
---
diff --git a/chrome/browser/extensions/extension_cookies_test_helper.cc b/chrome/browser/extensions/extension_cookies_test_helper.cc
index e51d2b6..4291152 100644
--- a/chrome/browser/extensions/extension_cookies_test_helper.cc
+++ b/chrome/browser/extensions/extension_cookies_test_helper.cc
@@ -109,6 +109,42 @@
   return result;
 }
 
+std::string ExtensionCookiesTestHelper::FetchCookiesNoCors(
+    content::RenderFrameHost* frame,
+    const GURL& url) {
+  const char kScriptTemplate[] = R"(
+      fetch($1, {method: 'GET', mode: 'no-cors', credentials: 'include'})
+        .then(() => window.domAutomationController.send('done'))
+        .catch((err) => window.domAutomationController.send('err: ' + err));)";
+  content::DOMMessageQueue messages(frame);
+  content::ExecuteScriptAsync(frame,
+                              content::JsReplace(kScriptTemplate, url.spec()));
+
+  net::test_server::ControllableHttpResponse& http_response =
+      GetNextCookieResponse();
+  http_response.WaitForRequest();
+
+  std::string cookie_header;
+  auto it = http_response.http_request()->headers.find(
+      net::HttpRequestHeaders::kCookie);
+  if (it != http_response.http_request()->headers.end()) {
+    cookie_header = it->second;
+  }
+
+  http_response.Send(
+      "HTTP/1.1 200 OK\r\n"
+      "Content-Type: text/plain; charset=utf-8\r\n"
+      "Content-Length: 0\r\n"
+      "\r\n");
+  http_response.Done();
+
+  std::string result;
+  if (!messages.PopMessage(&result)) {
+    EXPECT_TRUE(messages.WaitForMessage(&result));
+  }
+  return cookie_header;
+}
+
 std::string ExtensionCookiesTestHelper::NavigateChildAndGetCookies(
     content::RenderFrameHost* frame,
     const std::string& host) {
diff --git a/chrome/browser/extensions/extension_cookies_test_helper.h b/chrome/browser/extensions/extension_cookies_test_helper.h
index 86dd9a01..59dcb07e 100644
--- a/chrome/browser/extensions/extension_cookies_test_helper.h
+++ b/chrome/browser/extensions/extension_cookies_test_helper.h
@@ -11,6 +11,7 @@
 
 #include "base/memory/raw_ref.h"
 
+class GURL;
 class Profile;
 
 namespace content {
@@ -91,6 +92,13 @@
   std::string FetchCookies(content::RenderFrameHost* frame,
                            const std::string& host);
 
+  // Issues a `mode: 'no-cors'` fetch against `url` from `frame`. `url` must
+  // resolve (possibly via redirects) to `kFetchCookiesPath` on this test
+  // server. Returns the Cookie header observed on the wire by consuming the
+  // next slot in the response pool.
+  std::string FetchCookiesNoCors(content::RenderFrameHost* frame,
+                                 const GURL& url);
+
   // Triggers a `frame`-initiated navigation of `frame` to `host`. Returns
   // the cookies that were sent on that navigation request (read from the
   // navigated child's body).
diff --git a/chrome/browser/extensions/extension_cookies_browsertest.cc b/chrome/browser/extensions/extension_cookies_browsertest.cc
index d0a577d..9c750d8 100644
--- a/chrome/browser/extensions/extension_cookies_browsertest.cc
+++ b/chrome/browser/extensions/extension_cookies_browsertest.cc
@@ -281,6 +281,40 @@
   ExpectNoSameSiteCookies(cookies);
 }
 
+// Extension initiates a no-cors request to a permitted host that redirects to
+// another permitted host => SameSite cookies are sent on the redirected
+// request.
+IN_PROC_BROWSER_TEST_P(ExtensionSameSiteCookiesTest,
+                       ExtensionInitiatedNoCorsRedirectPermitted) {
+  SetCookies(ExtensionCookiesTestHelper::kOtherPermittedHost);
+  content::RenderFrameHost* frame = NavigateMainFrameToExtensionPage();
+  GURL target_url =
+      test_server()->GetURL(ExtensionCookiesTestHelper::kOtherPermittedHost,
+                            ExtensionCookiesTestHelper::kFetchCookiesPath);
+  GURL redirect_url =
+      test_server()->GetURL(ExtensionCookiesTestHelper::kPermittedHost,
+                            "/server-redirect-307?" + target_url.spec());
+  std::string cookies = helper().FetchCookiesNoCors(frame, redirect_url);
+  ExpectSameSiteCookies(cookies);
+}
+
+// Extension initiates a no-cors request to a permitted host that redirects to
+// a disallowed host => SameSite cookies are not sent on the redirected
+// request.
+IN_PROC_BROWSER_TEST_P(ExtensionSameSiteCookiesTest,
+                       ExtensionInitiatedNoCorsRedirectNotPermitted) {
+  SetCookies(ExtensionCookiesTestHelper::kNotPermittedHost);
+  content::RenderFrameHost* frame = NavigateMainFrameToExtensionPage();
+  GURL target_url =
+      test_server()->GetURL(ExtensionCookiesTestHelper::kNotPermittedHost,
+                            ExtensionCookiesTestHelper::kFetchCookiesPath);
+  GURL redirect_url =
+      test_server()->GetURL(ExtensionCookiesTestHelper::kPermittedHost,
+                            "/server-redirect-307?" + target_url.spec());
+  std::string cookies = helper().FetchCookiesNoCors(frame, redirect_url);
+  ExpectNoSameSiteCookies(cookies);
+}
+
 // Tests with one frame on an extension page which makes the request.
 
 // Extension is site_for_cookies, initiator and requested URL are permitted,

diff --git a/chrome/browser/extensions/extension_cookies_browsertest.cc b/chrome/browser/extensions/extension_cookies_browsertest.cc
index d0a577d..9c750d8 100644
--- a/chrome/browser/extensions/extension_cookies_browsertest.cc
+++ b/chrome/browser/extensions/extension_cookies_browsertest.cc
@@ -281,6 +281,40 @@
   ExpectNoSameSiteCookies(cookies);
 }
 
+// Extension initiates a no-cors request to a permitted host that redirects to
+// another permitted host => SameSite cookies are sent on the redirected
+// request.
+IN_PROC_BROWSER_TEST_P(ExtensionSameSiteCookiesTest,
+                       ExtensionInitiatedNoCorsRedirectPermitted) {
+  SetCookies(ExtensionCookiesTestHelper::kOtherPermittedHost);
+  content::RenderFrameHost* frame = NavigateMainFrameToExtensionPage();
+  GURL target_url =
+      test_server()->GetURL(ExtensionCookiesTestHelper::kOtherPermittedHost,
+                            ExtensionCookiesTestHelper::kFetchCookiesPath);
+  GURL redirect_url =
+      test_server()->GetURL(ExtensionCookiesTestHelper::kPermittedHost,
+                            "/server-redirect-307?" + target_url.spec());
+  std::string cookies = helper().FetchCookiesNoCors(frame, redirect_url);
+  ExpectSameSiteCookies(cookies);
+}
+
+// Extension initiates a no-cors request to a permitted host that redirects to
+// a disallowed host => SameSite cookies are not sent on the redirected
+// request.
+IN_PROC_BROWSER_TEST_P(ExtensionSameSiteCookiesTest,
+                       ExtensionInitiatedNoCorsRedirectNotPermitted) {
+  SetCookies(ExtensionCookiesTestHelper::kNotPermittedHost);
+  content::RenderFrameHost* frame = NavigateMainFrameToExtensionPage();
+  GURL target_url =
+      test_server()->GetURL(ExtensionCookiesTestHelper::kNotPermittedHost,
+                            ExtensionCookiesTestHelper::kFetchCookiesPath);
+  GURL redirect_url =
+      test_server()->GetURL(ExtensionCookiesTestHelper::kPermittedHost,
+                            "/server-redirect-307?" + target_url.spec());
+  std::string cookies = helper().FetchCookiesNoCors(frame, redirect_url);
+  ExpectNoSameSiteCookies(cookies);
+}
+
 // Tests with one frame on an extension page which makes the request.
 
 // Extension is site_for_cookies, initiator and requested URL are permitted,