From b44c42c13a5272c0ade24e338f0d3a5cc98d3844 Mon Sep 17 00:00:00 2001
From: Lei Zhang <thestig@chromium.org>
Date: Fri, 28 Aug 2026 17:48:36 -0700
Subject: [PATCH] printing: Handle initiator destruction in PrintPreviewDialogController

When creating a print preview dialog in CreatePrintPreviewDialog(),
showing the constrained web dialog synchronously exits HTML fullscreen.
This can potentially trigger the destruction of the print initiator.

To avoid UAF:
- Track both the initiator WebContents and TabInterface using
  base::WeakPtr across the ShowConstrainedWebDialog() call.
- If either gets destroyed, abort dialog creation by calling
  OnDialogCloseFromWebUI() and return nullptr.
- In PrintPreview(), check if the initiator WebContents was destroyed
  before accessing its PrintViewManager.

This is a cleaned up version of the AI-suggested fix from the bug
report.

Bug: 553928324
Change-Id: I1e36651b9a43d0da8e1963277294ddb7f85f8e2b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8308419
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1688449}
---

diff --git a/chrome/browser/printing/print_preview_dialog_controller.cc b/chrome/browser/printing/print_preview_dialog_controller.cc
index 4745f22..2767b3c 100644
--- a/chrome/browser/printing/print_preview_dialog_controller.cc
+++ b/chrome/browser/printing/print_preview_dialog_controller.cc
@@ -201,12 +201,22 @@
     return;
   }
 
-  if (!GetOrCreatePreviewDialog(initiator, params, is_pdf)) {
-    auto* print_view_manager = PrintViewManager::FromWebContents(initiator);
-    if (print_view_manager) {
-      print_view_manager->PrintPreviewDone();
-    }
+  // `initiator` can be destroyed inside GetOrCreatePreviewDialog().
+  base::WeakPtr<content::WebContents> weak_initiator = initiator->GetWeakPtr();
+  if (GetOrCreatePreviewDialog(initiator, params, is_pdf)) {
+    return;
   }
+  if (!weak_initiator) {
+    return;
+  }
+
+  auto* print_view_manager =
+      PrintViewManager::FromWebContents(weak_initiator.get());
+  if (!print_view_manager) {
+    return;
+  }
+
+  print_view_manager->PrintPreviewDone();
 }
 
 // static
@@ -441,11 +451,22 @@
     bool is_pdf) {
   base::AutoReset<bool> auto_reset(&is_creating_print_preview_dialog_, true);
 
+  // Showing the dialog synchronously exits HTML fullscreen, which can
+  // potentially destroy `initiator` and its `tab`.
+  base::WeakPtr<content::WebContents> weak_initiator = initiator->GetWeakPtr();
+  base::WeakPtr<tabs::TabInterface> weak_tab =
+      tab ? tab->GetWeakPtr() : nullptr;
+
   // The dialog delegates are deleted when the dialog is closed.
   ConstrainedWebDialogDelegate* web_dialog_delegate = ShowConstrainedWebDialog(
       initiator->GetBrowserContext(),
       std::make_unique<PrintPreviewDialogDelegate>(initiator), initiator);
 
+  if (!weak_initiator || (tab && !weak_tab)) {
+    web_dialog_delegate->OnDialogCloseFromWebUI();
+    return nullptr;
+  }
+
   WebContents* preview_dialog = web_dialog_delegate->GetWebContents();
 
   // Clear the zoom level for the print preview dialog so it isn't affected by