Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: A potential use-after-free vulnerability exists in the browser process within PrintPreviewDialogController::CreatePrintPreviewDialog. When initiating print preview from a webpage in HTML fullscreen mode, modal dialog initialization triggers a synchronous fullscreen exit whose platform event processing can destroy the initiator tab and its WebContents. The function subsequently dereferences the freed TabInterface and WebContents raw pointers without liveness verification, leading to virtual method dispatch and heap writes on freed objects.

Affected files:

• chrome/browser/printing/print_preview_dialog_controller.cc
• chrome/browser/printing/print_view_manager.cc

Estimated timestamp from git blame: 2024-10-08

Summary

PrintPreviewDialogController::CreatePrintPreviewDialog retains raw stack pointers (tabs::TabInterface* tab and content::WebContents* initiator) across a call to ShowConstrainedWebDialog(). If the initiator tab is currently in HTML element fullscreen, ShowConstrainedWebDialog() synchronously initiates a fullscreen exit (web_contents->ExitFullscreen(true)). On platforms where native fullscreen transitions process UI-thread window messages (e.g., Windows or macOS), a tab close event occurring during this transition synchronously destroys the TabModel and WebContentsImpl. Upon return, CreatePrintPreviewDialog() continues execution and accesses both pointers, leading to virtual dispatch (tab->ShowModalUI()) and memory writes (StartObserving(initiator)) on freed memory.

Vulnerability Details

1. Unguarded Stack Pointers in CreatePrintPreviewDialog: In chrome/browser/printing/print_preview_dialog_controller.cc:437-472:

WebContents* PrintPreviewDialogController::CreatePrintPreviewDialog(
    tabs::TabInterface* tab,
    content::WebContents* initiator,
    const mojom::RequestPrintPreviewParams& params,
    bool is_pdf) {
  base::AutoReset<bool> auto_reset(&is_creating_print_preview_dialog_, true);

  ConstrainedWebDialogDelegate* web_dialog_delegate = ShowConstrainedWebDialog(
      initiator->GetBrowserContext(),
      std::make_unique<PrintPreviewDialogDelegate>(initiator), initiator);
  ...
  InitiatorData data(initiator, params, is_pdf,
                     tab ? tab->ShowModalUI() : nullptr);     // (1) Virtual call on freed TabModel
  preview_dialog_map_.emplace(preview_dialog, std::move(data));
  ...
  web_contents_collection_.StartObserving(initiator);         // (2) Observer write on freed WebContentsImpl

2. Synchronous Fullscreen Exit Flow: ShowConstrainedWebDialog() (chrome/browser/ui/views/constrained_web_dialog_delegate_views.cc:525-534) creates the dialog widget and invokes constrained_window::ShowWebModalDialogViews() -> WebContentsModalDialogManager::ShowDialogWithManager() (components/web_modal/web_contents_modal_dialog_manager.cc:48-64). This calls BlockWebContentsInteraction(true), which invokes BrowserWindowModalDialogDelegate::SetWebContentsBlocked() (chrome/browser/ui/web_modal/browser_window_modal_dialog_delegate.cc:40-92):

    if (fullscreen_state.target_mode == content::FullscreenMode::kContent) {
      if (content_settings->GetContentSetting(url, url,
              ContentSettingsType::AUTOMATIC_FULLSCREEN) != CONTENT_SETTING_ALLOW) {
        web_contents->ExitFullscreen(true);
      }
    }

3. Tab Destruction During Native Message Processing: WebContentsImpl::ExitFullscreenMode() (content/browser/web_contents/web_contents_impl.cc:4984-4991) calls delegate_->ExitFullscreenModeForTab(this) to perform the native window transition. As noted in comments (// This may spin the message loop and destroy this object. See crbug.com/1506535, crbug.com/498752242), processing window messages can run a pending tab-close task (TabStripModel::CloseTabs -> dt->tab.reset()), synchronously freeing both the TabModel and WebContentsImpl.

While the scripted print preview flow (PrintViewManager::OnScriptedPrintPreviewCallback, chrome/browser/printing/print_view_manager.cc:569-579) was previously guarded against this exact scenario (crbug.com/517047197) by pre-exiting fullscreen with a weak_this check before creating the dialog, the non-scripted IPC handler (OnRequestPrintPreviewCallback, print_view_manager.cc:607-645) lacks this pre-exit.

4. Use-After-Free Sites:

• Site 1: tab->ShowModalUI() (line 462) performs a virtual function call through tab’s vtable. Inside TabModel::ShowModalUI(), ScopedTabModalUIImpl executes tab_->showing_modal_ui_ = true; and notifies modal_ui_changed_callback_list_, performing writes and callback iteration on freed memory.
• Site 2: web_contents_collection_.StartObserving(initiator) (line 468) constructs a ForwardingWebContentsObserver, calling static_cast<WebContentsImpl*>(initiator)->AddObserver(this), mutating the observer list in freed memory.
• Site 3: A dangling pointer is stored in preview_dialog_map_, triggering subsequent UAF calls during cleanup in RemovePreviewDialog().

Because tab and initiator in CreatePrintPreviewDialog are bare stack pointers, MiraclePtr (BackupRefPtr) does not protect them.

Potential Reproduction Steps

(Note: These are suggested theoretical steps as our automated analysis tooling cannot execute live binaries.)

1. Tab B opens Tab A via const a = window.open(...). Tab A opens Tab C so that a tab exists at a higher index (preventing an index out-of-bounds check during tab strip unwind).
2. Tab A enters HTML element fullscreen (document.documentElement.requestFullscreen()).
3. From a compromised renderer (or via user interaction such as Ctrl+P), Tab A sends printing::mojom::PrintManagerHost::RequestPrintPreview and signals Tab B via BroadcastChannel.
4. The browser processes PrintViewManager::OnRequestPrintPreviewCallback and calls PrintPreviewDialogController::CreatePrintPreviewDialog.
5. During ShowConstrainedWebDialog() -> ExitFullscreen(true), the native window manager spins message processing.
6. Tab B’s a.close() task executes during message processing, synchronously destroying Tab A’s TabModel and WebContentsImpl.
7. ShowConstrainedWebDialog() returns, and CreatePrintPreviewDialog executes tab->ShowModalUI() and StartObserving(initiator) on the freed objects.

Suggested Fix

1. In PrintViewManager::OnRequestPrintPreviewCallback, pre-exit fullscreen before calling dialog_controller->PrintPreview(), matching the fix applied to OnScriptedPrintPreviewCallback:

if (web_contents()->IsFullscreen()) {
  auto weak_this = weak_factory_.GetWeakPtr();
  web_contents()->ExitFullscreen(true);
  if (!weak_this) {
    return;
  }
}

2. In PrintPreviewDialogController::CreatePrintPreviewDialog, hold base::WeakPtr<tabs::TabInterface> and base::WeakPtr<content::WebContents> across ShowConstrainedWebDialog(), and verify both pointers remain valid before using them.

Evaluated with Chrome root at commit: 796d95f11afe18561709217227313319d6660322

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

• If you are familiar with the severity guidelines, you may adjust the severity.
• If this is a false positive, and there’s no work to be done, please close as WAI.
• If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.