3a2d2b9451901a92ac4e8f68db121b487b4b62a2  [M144-LTS][DC] Add weak_this guard in Abort()

The bug at a glance

A browser-process use-after-free reachable from the web-exposed Digital Credentials API: running update_interstitial_on_abort_callback_ can synchronously tear down the WebContents and thus the DigitalIdentityRequestImpl, after which the method keeps using this. Labeled defense-in-depth, but the described re-entrant destruction path is concrete.

An attacker invoking the Digital Credentials request flow and triggering an abort while the safety interstitial is showing could cause the request object to be freed mid-call and then reused, a classic browser-process UAF primitive. A defender cares because this sits in the privileged content/browser layer and is driven by renderer-initiated requests.

Root cause

In DigitalIdentityRequestImpl::Abort(), std::move(update_interstitial_on_abort_callback_).Run() can close a tab-modal safety-interstitial Widget; on desktop, activation observers can synchronously destroy the hosting WebContents, which destroys the DigitalIdentityRequestImpl. The original code then called CompleteRequestWithStatus() on the now-freed this, a use-after-free. The fix captures weak_ptr_factory_.GetWeakPtr() before running the callback and returns early if !weak_this afterward, mirroring the existing guard in CompleteRequestWithStatus().

Key code

WeakPtr liveness check after a callback that may destroy this

base::WeakPtr<DigitalIdentityRequestImpl> weak_this =
    weak_ptr_factory_.GetWeakPtr();
if (update_interstitial_on_abort_callback_) {
  std::move(update_interstitial_on_abort_callback_).Run();
}

if (!weak_this) {
  return;
}

Patch walkthrough

• content/browser/digital_credentials/digital_identity_request_impl.cc — Captures a WeakPtr to this before invoking update_interstitial_on_abort_callback_ and bails out if the object was destroyed during the callback, preventing the subsequent CompleteRequestWithStatus() call from operating on freed memory.

Background

DigitalIdentityRequestImpl — Browser-process implementation backing the web Digital Credentials API that mediates identity/credential requests.

update_interstitial_on_abort_callback_ — A OnceCallback that updates/dismisses the tab-modal safety interstitial when a request is aborted.

Re-entrant destruction via activation observers — Closing a tab-modal Widget can synchronously fire WebContents activation observers that destroy the WebContents and its owned helpers.

base::WeakPtr liveness guard — A common Chromium pattern to detect that this was freed by a nested callback before continuing to use it.

Vulnerability window

1. Reachability — A page invokes the Digital Credentials request flow such that the safety interstitial is shown. (inferred)
2. Trigger — Abort() runs the interstitial callback, which closes the Widget and synchronously destroys the WebContents and the DigitalIdentityRequestImpl. (inferred)
3. Primitive — Execution returns into Abort() and dereferences the freed this via CompleteRequestWithStatus(), a use-after-free.
4. Escalation — Controlled reuse of the freed allocation could turn the UAF into memory corruption in the browser process. (inferred)

Proof of concept

Conceptually: drive the Digital Credentials API to a state where the tab-modal safety interstitial is displayed, then cause an abort (e.g. request cancellation/navigation) so the interstitial-dismissal callback closes the Widget and synchronously destroys the WebContents during Abort(); the pre-fix code then touches the freed request object. No exploit code is provided.

Exploitation

1. Setup — Reach the interstitial-showing state of the digital identity request. (inferred)
2. Free — Trigger abort so the callback synchronously destroys the owning WebContents/request object. (inferred)
3. Use — Pre-fix control flow continues in Abort() and dereferences freed memory.
4. Corruption — Reclaiming the freed slot with attacker-influenced data could yield a corruption primitive. (inferred)

Detection & hunting

For defenders and detection engineers:

• weggli/grep for std::move(callback_).Run() immediately followed by use of this/members without a WeakPtr check — Hunt for callbacks that may close UI or tear down WebContents followed by continued use of the enclosing object.
• ASAN heap-use-after-free in DigitalIdentityRequestImpl::Abort frames — Run the Digital Credentials abort path under ASAN and watch for UAF reports post-callback.

Audit directions

• *content/browser Digital Credentials and other RequestImpl classes — Audit every method that runs a OnceCallback capable of closing UI/WebContents for a missing post-callback WeakPtr liveness guard.
• Tab-modal interstitial / Widget close paths — Review callers that may synchronously destroy the WebContents through activation observers while a method still holds this.