Chromium

VULNERABILITY DETAILS

Bitset: https://chromium-review.googlesource.com/c/chromium/src/+/3072886

DownloadInternalsUIMessageHandler::RegisterMessages add self as observer into the logger of background download service.

class DownloadInternalsUIMessageHandler : public web::WebUIIOSMessageHandler,
                                          public download::Logger::Observer {
 private:
  // WebUIIOSMessageHandler implementation.
  void RegisterMessages() override {
    // redacted ...

    if (download_service_)
      download_service_->GetLogger()->AddObserver(this); // <-- Add self as observer
  }
}

https://source.chromium.org/chromium/chromium/src/+/main:ios/chrome/browser/webui/ui_bundled/download_internals_ui.cc;l=65;drc=d236ab1a0320384b0267eec9b6765c666944984d

However, there is not RemoveObserver in ~DownloadInternalsUIMessageHandler(), so the observer will not be removed even though the object of DownloadInternalsUIMessageHandler is freed. The lifetime of DownloadInternalsUIMessageHandler object is bound with WebUI for chrome://download-internals on iOS. New tab with url: chrome://download-internals and then close it will result in a dangling observer in unchecked observers_ of download::LoggerImpl.

namespace download {

class LoggerImpl : public Logger, public LogSink {
 // redacted ...
 private:
  base::ObserverList<Observer>::Unchecked observers_;   // <-- Observers is unchecked, can not prevent UAF if observer has been freed but not removed.
};

}  // namespace download

https://source.chromium.org/chromium/chromium/src/+/main:components/download/internal/background_service/logger_impl.h;l=58;drc=8ba1bad80dc22235693a0dd41fe55c0fd2dbdabd

So when the notification happened after the object of |DownloadInternalsUIMessageHandler| is freed, UAF will be triggered.

class DownloadInternalsUIMessageHandler : public web::WebUIIOSMessageHandler,
                                          public download::Logger::Observer {
  // download::Logger::Observer implementation.
  void OnServiceDownloadChanged(
      const base::Value::Dict& service_download) override {
    web_ui()->FireWebUIListener("service-download-changed", service_download);  // <-- UAF in web_ui()
  }
}

https://source.chromium.org/chromium/chromium/src/+/main:ios/chrome/browser/webui/ui_bundled/download_internals_ui.cc;l=87;drc=d236ab1a0320384b0267eec9b6765c666944984d

Fix suggestion:

diff --git a/ios/chrome/browser/webui/ui_bundled/download_internals_ui.cc b/ios/chrome/browser/webui/ui_bundled/download_internals_ui.cc
index 9e35041dc4046..fecfe5d876062 100644
--- a/ios/chrome/browser/webui/ui_bundled/download_internals_ui.cc
+++ b/ios/chrome/browser/webui/ui_bundled/download_internals_ui.cc
@@ -34,7 +34,11 @@ class DownloadInternalsUIMessageHandler : public web::WebUIIOSMessageHandler,
   DownloadInternalsUIMessageHandler(const DownloadInternalsUIMessageHandler&) =
       delete;
   void operator=(const DownloadInternalsUIMessageHandler&) = delete;
-  ~DownloadInternalsUIMessageHandler() override = default;
+
+  ~DownloadInternalsUIMessageHandler() override {
+    if (download_service_)
+      download_service_->GetLogger()->RemoveObserver(this);
+  }
 
  private:
   // WebUIIOSMessageHandler implementation.

VERSION

• Chrome Version: 122.0.6261.62 (Official Build) stable (64 bit)
• Operating System: iOS

REPRODUCTION CASE

1. Open chrome://download-internals/ and close it
2. Open new tab with chrome://download-internals/, input any valid URL and click Download button

Another:

1. Run command nc -l 8000 on linux.
2. Open chrome://download-internals on iOS, input http://<your-ip>:8000/poc and click Download, close the tab.
3. Ctrl + C to kill nc on linux, chrome on iOS crashed.

There is a POC video in attachements.

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION

• Type of crash: browser
• Crash ID: crash/c818bdbca3b2d430

CREDIT INFORMATION

Reporter credit: ChaobinZhang