VULNERABILITY DETAILS

The AIManager mojo interface can be obtained by the renderer. When binding the receiver, the browser will save the corresponding context to the ReceiverSet [0].

void AIManagerKeyedService::AddReceiver(
    mojo::PendingReceiver<blink::mojom::AIManager> receiver,
    AIContextBoundObjectSet::ReceiverContext context) {
  receivers_.Add(this, std::move(receiver), context); // [0]
}

Type definition of context:

  using ReceiverContext =
      std::variant<content::RenderFrameHost*, base::SupportsUserData*>; // [1]

For requests sent from a regular frame, the context here is actually a raw pointer to RenderFrameHost. However, there is no code that guarantees the consistency of the lifecycles of AIManagerKeyedService and the iframe. AIManagerKeyedService can completely outlive RenderFrameHost! If the iframe is removed before calling the functionality of AIManagerKeyedService, it will lead to a UAF.

[0] https://source.chromium.org/chromium/chromium/src/+/main:chrome/browser/ai/ai_manager_keyed_service.cc;drc=8b00b43b06712a6c61f59f2e9f9230459d2a9025;l=308

[1] https://source.chromium.org/chromium/chromium/src/+/main:chrome/browser/ai/ai_context_bound_object_set.h;drc=8b00b43b06712a6c61f59f2e9f9230459d2a9025;l=27

Vulnerability Trigger

An attacker can trigger the UAF with the following steps:

1. Bind the AIManager interface in a child frame.

2. Send this interface handle to the parent frame.

3. Remove the child frame from the parent frame.

4. Trigger an IPC call to AIManager that uses the already freed RenderFrameHost object.

Our provided POC demonstrates these steps in detail. Please refer to the code for specifics.

Exploitability Analysis

We note that this UAF is not yet protected by MiraclePtr (for details, see asan.txt):

MiraclePtr Status: NOT PROTECTED

RenderFrameHost UAF is a known vulnerability pattern that is frequently exploited to achieve sandbox escape. For specific examples, refer to case 1 and case 2.

At least on Windows, using our provided POC, it's easy to achieve full control of RenderFrameHost. Below is the crash site displayed by windbg; for a detailed backtrace, see windbg.txt.

0:046> g
(3578.20cc): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
*** WARNING: Unable to verify checksum for C:\Users\dalao\AppData\Local\Chromium\Application\130.0.6712.0\base.dll
base!absl::container_internal::raw_hash_set<absl::container_internal::FlatHashMapPolicy<const void *,std::__Cr::unique_ptr<base::SupportsUserData::Data,std::__Cr::default_delete<base::SupportsUserData::Data> > >,absl::container_internal::HashEq<const void *,void>::Hash,absl::container_internal::HashEq<const void *,void>::Eq,std::__Cr::allocator<std::__Cr::pair<const void *const,std::__Cr::unique_ptr<base::SupportsUserData::Data,std::__Cr::default_delete<base::SupportsUserData::Data> > > > >::fits_in_soo [inlined in base!absl::container_internal::raw_hash_set<absl::container_internal::FlatHashMapPolicy<const void *,std::__Cr::unique_ptr<base::SupportsUserData::Data,std::__Cr::default_delete<base::SupportsUserData::Data> > >,absl::container_internal::HashEq<const void *,void>::Hash,absl::container_internal::HashEq<const void *,void>::Eq,std::__Cr::allocator<std::__Cr::pair<const void *const,std::__Cr::unique_ptr<base::SupportsUserData::Data,std::__Cr::default_delete<base::SupportsUserData::Data> > > > >::find<const void *>+0x23]:
00007ffd`5e3fb0c3 48833901        cmp     qword ptr [rcx],1 ds:41414141`41414141=????????????????

We believe this vulnerability has extremely high exploitability, is stable, and easy to trigger. We recommend that the Chrome team fix it promptly.

BISECTION

Introduced by https://chromium.googlesource.com/chromium/src/+/d37f2ff9881443eca070192a005b9853e8a3bf74

VERSION

Chrome Version: 130.0.6712.0, HEAD + stable

Operating System: All

REPRODUCTION CASE

Host poc files on an HTTP server.

$ python copy_mojo_js_bindings.py
$ python -m http.server
$ ./chrome --enable-blink-features=MojoJS,MojoJSTest 'http://localhost:8000/poc.html'

CRASH INFORMATION

Type of crash: browser

Crash log: see asan.txt and windbg.txt

CREDIT INFORMATION

Reporter credit: DARKNAVY(@DarkNavyOrg)