From 9ac349c94b98903e8bbc2667eddd5b067fabdb9f Mon Sep 17 00:00:00 2001
From: Hayato Ito <hayato@chromium.org>
Date: Sun, 02 Aug 2026 22:55:07 -0700
Subject: [PATCH] [ServiceWorker] Filter by-UUID client operations by StorageKey

ServiceWorkerVersion::GetClient/PostMessageToClient/FocusClient/NavigateClient
compared the target client's URL-derived origin against the script URL's
origin, while GetClients (Clients#matchAll) filters by full
blink::StorageKey via IsSameOriginServiceWorkerClient. Make the by-UUID
operations consistent by comparing the client's StorageKey against the
version's key_, so that same-origin clients in a different storage
partition (third-party-partitioned iframe / fenced frame) are not
reachable. This also removes the last uses of DeprecatedGetOriginAsURL()
in this file.

Bug: 499218516
Change-Id: Iffa288dad2f75bfc3e6152ffdc604cfa90ac69f6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8177241
Commit-Queue: Hayato Ito <hayato@chromium.org>
Reviewed-by: Yoshisato Yanagisawa <yyanagisawa@chromium.org>
Reviewed-by: Hiroki Nakagawa <nhiroki@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1672504}
---

diff --git a/content/browser/service_worker/service_worker_version.cc b/content/browser/service_worker/service_worker_version.cc
index e8d3e3f7..35ca907 100644
--- a/content/browser/service_worker/service_worker_version.cc
+++ b/content/browser/service_worker/service_worker_version.cc
@@ -1825,12 +1825,10 @@
   ServiceWorkerClient* service_worker_client =
       context_->service_worker_client_owner().GetServiceWorkerClientByClientID(
           client_uuid);
-  if (!service_worker_client ||
-      service_worker_client->GetUrlForScopeMatch().DeprecatedGetOriginAsURL() !=
-          script_url_.DeprecatedGetOriginAsURL()) {
+  if (!service_worker_client || service_worker_client->key() != key_) {
     // The promise will be resolved to 'undefined'.
     // Note that we don't BadMessage here since Clients#get() can be passed an
-    // arbitrary UUID. The BadMessages for the origin mismatches below are
+    // arbitrary UUID. The BadMessages for the storage key mismatches below are
     // appropriate because the UUID is taken directly from a Client object so we
     // expect it to be valid.
     std::move(callback).Run(nullptr);
@@ -1857,7 +1855,8 @@
   ServiceWorkerClient* service_worker_client =
       context_->service_worker_client_owner().GetServiceWorkerClientByClientID(
           client_uuid);
-  if (!service_worker_client || !service_worker_client->is_execution_ready()) {
+  if (!service_worker_client || service_worker_client->key() != key_ ||
+      !service_worker_client->is_execution_ready()) {
     std::move(callback).Run(nullptr);
     return;
   }
@@ -2026,8 +2025,7 @@
     }
   }
 
-  if (service_worker_client->GetUrlForScopeMatch().DeprecatedGetOriginAsURL() !=
-      script_url_.DeprecatedGetOriginAsURL()) {
+  if (service_worker_client->key() != key_) {
     associated_interface_receiver_.ReportBadMessage(
         "Received Client#postMessage() request for a cross-origin client.");
     receiver_.reset();
@@ -2086,8 +2084,7 @@
     std::move(callback).Run(std::move(result));
     return;
   }
-  if (service_worker_client->GetUrlForScopeMatch().DeprecatedGetOriginAsURL() !=
-      script_url_.DeprecatedGetOriginAsURL()) {
+  if (service_worker_client->key() != key_) {
     associated_interface_receiver_.ReportBadMessage(
         "Received WindowClient#focus() request for a cross-origin client.");
     receiver_.reset();
@@ -2144,8 +2141,7 @@
                             std::string("The client was not found."));
     return;
   }
-  if (service_worker_client->GetUrlForScopeMatch().DeprecatedGetOriginAsURL() !=
-      script_url_.DeprecatedGetOriginAsURL()) {
+  if (service_worker_client->key() != key_) {
     associated_interface_receiver_.ReportBadMessage(
         "Received WindowClient#navigate() request for a cross-origin client.");
     receiver_.reset();
diff --git a/content/browser/service_worker/service_worker_version_unittest.cc b/content/browser/service_worker/service_worker_version_unittest.cc
index 51b7b0f0..b965e009 100644
--- a/content/browser/service_worker/service_worker_version_unittest.cc
+++ b/content/browser/service_worker/service_worker_version_unittest.cc
@@ -52,6 +52,7 @@
 #include "third_party/blink/public/common/service_worker/embedded_worker_status.h"
 #include "third_party/blink/public/common/service_worker/service_worker_router_rule.h"
 #include "third_party/blink/public/common/storage_key/storage_key.h"
+#include "third_party/blink/public/common/tokens/tokens.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_event_status.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_installed_scripts_manager.mojom.h"
@@ -1517,6 +1518,46 @@
             StartServiceWorker(version.get()));
 }
 
+// Test that GetClient() returns null when requested for a client with the same
+// origin but a different storage key.
+TEST_P(ServiceWorkerVersionTest, GetClientWithDifferentStorageKey) {
+  auto* service_worker =
+      helper_->AddNewPendingServiceWorker<FakeServiceWorker>(helper_.get());
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
+  service_worker->RunUntilInitializeGlobalScope();
+  version_->SetStatus(ServiceWorkerVersion::ACTIVATED);
+
+  ScopedServiceWorkerClient service_worker_client =
+      helper_->context()
+          ->service_worker_client_owner()
+          .CreateServiceWorkerClientForWorker(
+              helper_->mock_render_process_id(),
+              ServiceWorkerClientInfo(blink::SharedWorkerToken()));
+
+  GURL client_url = scope_.Resolve("shared_worker.js");
+  auto client_origin = url::Origin::Create(client_url);
+  auto different_top_level_origin =
+      url::Origin::Create(GURL("https://www.different.com/"));
+  auto different_storage_key = blink::StorageKey::Create(
+      client_origin, net::SchemefulSite(different_top_level_origin),
+      blink::mojom::AncestorChainBit::kCrossSite,
+      /*third_party_partitioning_allowed=*/true);
+
+  service_worker_client->UpdateUrls(client_url, different_top_level_origin,
+                                    different_storage_key);
+
+  CommittedServiceWorkerClient committed_client(
+      std::move(service_worker_client));
+  committed_client->SetExecutionReady();
+
+  base::test::TestFuture<blink::mojom::ServiceWorkerClientInfoPtr> future;
+  service_worker->host()->GetClient(committed_client->client_uuid(),
+                                    future.GetCallback());
+
+  EXPECT_TRUE(future.Get().is_null());
+}
+
 TEST_P(ServiceWorkerVersionTest,
        StartWorker_ContentSettingsDisallowsServiceWorker_FeatureEnabled) {
   base::test::ScopedFeatureList feature_list;

diff --git a/content/browser/service_worker/service_worker_version_unittest.cc b/content/browser/service_worker/service_worker_version_unittest.cc
index 51b7b0f0..b965e009 100644
--- a/content/browser/service_worker/service_worker_version_unittest.cc
+++ b/content/browser/service_worker/service_worker_version_unittest.cc
@@ -52,6 +52,7 @@
 #include "third_party/blink/public/common/service_worker/embedded_worker_status.h"
 #include "third_party/blink/public/common/service_worker/service_worker_router_rule.h"
 #include "third_party/blink/public/common/storage_key/storage_key.h"
+#include "third_party/blink/public/common/tokens/tokens.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_event_status.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_installed_scripts_manager.mojom.h"
@@ -1517,6 +1518,46 @@
             StartServiceWorker(version.get()));
 }
 
+// Test that GetClient() returns null when requested for a client with the same
+// origin but a different storage key.
+TEST_P(ServiceWorkerVersionTest, GetClientWithDifferentStorageKey) {
+  auto* service_worker =
+      helper_->AddNewPendingServiceWorker<FakeServiceWorker>(helper_.get());
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
+  service_worker->RunUntilInitializeGlobalScope();
+  version_->SetStatus(ServiceWorkerVersion::ACTIVATED);
+
+  ScopedServiceWorkerClient service_worker_client =
+      helper_->context()
+          ->service_worker_client_owner()
+          .CreateServiceWorkerClientForWorker(
+              helper_->mock_render_process_id(),
+              ServiceWorkerClientInfo(blink::SharedWorkerToken()));
+
+  GURL client_url = scope_.Resolve("shared_worker.js");
+  auto client_origin = url::Origin::Create(client_url);
+  auto different_top_level_origin =
+      url::Origin::Create(GURL("https://www.different.com/"));
+  auto different_storage_key = blink::StorageKey::Create(
+      client_origin, net::SchemefulSite(different_top_level_origin),
+      blink::mojom::AncestorChainBit::kCrossSite,
+      /*third_party_partitioning_allowed=*/true);
+
+  service_worker_client->UpdateUrls(client_url, different_top_level_origin,
+                                    different_storage_key);
+
+  CommittedServiceWorkerClient committed_client(
+      std::move(service_worker_client));
+  committed_client->SetExecutionReady();
+
+  base::test::TestFuture<blink::mojom::ServiceWorkerClientInfoPtr> future;
+  service_worker->host()->GetClient(committed_client->client_uuid(),
+                                    future.GetCallback());
+
+  EXPECT_TRUE(future.Get().is_null());
+}
+
 TEST_P(ServiceWorkerVersionTest,
        StartWorker_ContentSettingsDisallowsServiceWorker_FeatureEnabled) {
   base::test::ScopedFeatureList feature_list;