Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports without the Chrome Security team. Please see go/chrome-ai-generated-security-bugs-faq for more information.

Overview: A potential Use-After-Free exists in the iOS browser process within CredentialSuggestionBottomSheetMediator. The mediator stores raw pointers to PasswordForm objects that are freed during cross-document navigation, and subsequently dereferences them if the user interacts with the persistent bottom sheet.

Affected files:

• ios/chrome/browser/passwords/bottom_sheet/coordinator/credential_suggestion_bottom_sheet_mediator.mm
• components/password_manager/ios/shared_password_controller.mm
• ios/chrome/browser/autofill/model/bottom_sheet/autofill_bottom_sheet_tab_helper.mm
• ios/chrome/browser/passwords/bottom_sheet/coordinator/credential_suggestion_bottom_sheet_mediator_base.mm
• ios/chrome/browser/browser_view/ui_bundled/browser_coordinator.mm

Estimated timestamp from git blame: 2024-02-29

Summary

A potential use-after-free (UAF) vulnerability exists in the browser process of Chrome for iOS. The CredentialSuggestionBottomSheetMediator incorrectly maintains raw pointers to PasswordForm objects. These objects are destroyed during same-tab cross-document navigations, but the bottom sheet UI is not automatically dismissed. If a user interacts with the bottom sheet after a navigation has occurred, the application dereferences these dangling pointers, leading to a UAF and a potential arbitrary memory read.

Technical Details

When the password bottom sheet is triggered on iOS for a page containing credentials received via Google Password Sharing (where sharing_notification_displayed is false), CredentialSuggestionBottomSheetMediator::fetchCredentialsForForm:webState: is called.

This method retrieves suggestions from PasswordManager::GetBestMatches, which returns a base::span<const password_manager::PasswordForm> pointing to the internal std::vector<PasswordForm> best_matches_ inside FormFetcherImpl. The mediator then stores raw pointers to the shared credentials in its std::vector<const password_manager::PasswordForm*> _sharedUnnotifiedForms member variable.

When a cross-document navigation occurs in the same tab, SharedPasswordController::webState:didFinishNavigation: detects the navigation and calls PasswordManager::DidNavigateMainFrame. This resets the password cache (password_form_cache_.Clear()), which destroys all PasswordFormManager and FormFetcherImpl objects associated with the previous page. The best_matches_ vector is destructed, freeing the memory.

The vulnerability exists because the credential bottom sheet is not dismissed upon same-tab navigation. The mediator only dismisses the sheet on tab switches (via WebStateListObserving).

When the victim subsequently interacts with the persistent sheet (e.g., swiping it away or selecting ‘Use Keyboard’), the mediator calls -markSharedPasswordNotificationsDisplayed. This method iterates through _sharedUnnotifiedForms and performs a copy-construction:

password_manager::PasswordForm updatedForm = *form;

Since form is a dangling pointer, this results in a UAF read. The PasswordForm struct contains numerous complex members like std::u16string and std::string. The copy constructor will attempt to read string sizes and pointers from the freed memory, leading to an arbitrary memory read primitive. The corrupted object is then passed to PasswordStoreInterface::UpdateLogin.

Note: MiraclePtr (BackupRefPtr) does not protect against this issue because the dangling pointers are bare const T* elements within a std::vector, not raw_ptr<>.

Potential Reproduction Steps

Please note: These are theoretical steps as we do not have a working Proof of Concept.

1. An attacker (who must be a member of the victim’s Google Family Group) shares a password for https://attacker.example with the victim.
2. The victim opens https://attacker.example in iOS Chrome. The page contains a login form and a script designed to trigger navigation after a short delay (e.g., setTimeout(() => location.href = '/next', 2000)).
3. The victim taps a password field, triggering the password bottom sheet. The mediator populates _sharedUnnotifiedForms with raw pointers to the shared credential.
4. The page’s timer fires and a cross-document navigation commits. This destroys the PasswordFormManager and frees the PasswordForm objects in memory. The bottom sheet remains visible on screen.
5. The victim interacts with the bottom sheet (e.g., dismisses it by swiping down).
6. The mediator attempts to mark the notification as displayed, dereferencing the dangling pointer in the browser process.

Suggested Fix

To fix this issue, _sharedUnnotifiedForms should not store raw pointers to memory owned by the Password Manager cache. Instead, it should store independent copies of the PasswordForm objects, or store a unique identifier (like the form’s primary key) that can be used to safely look up or update the form in the Password Store later. Additionally, it is highly recommended to update the coordinator or mediator to dismiss the bottom sheet when a same-tab cross-document navigation occurs, by implementing web::WebStateObserver.

Evaluated with Chrome root at commit: 7353d249d9cacf9c7218e1d7b8a39cf39c72d646

Results so far have been promising, but there can be wrong deductions. If this proves to be a false positive, please close as WAI; data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.