New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 666803 link

Starred by 1 user

Issue metadata

Status: Archived
Owner:
please use my google.com address
Closed: Nov 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 1
Type: Bug-Security

Blocking:
issue 666801



Sign in to add a comment

Double-delete possible in WiFiDisplayMediaServiceImpl / WiFiDisplaySessionServiceImpl

Project Member Reported by dcheng@chromium.org, Nov 18 2016

Issue description

WiFiDisplayMediaServiceImpl and WiFiDisplaySessionServiceImpl are owned by StrongBindings, but can invoke 'delete this'.
 

Comment 1 by mea...@chromium.org, Nov 18 2016

Labels: Security_Severity-High Security_Impact-None OS-Chrome OS-Linux OS-Mac OS-Windows
dcheng: I'm assigning high severity as it looks like this could cause a UAF. Feel free to change.

Comment 3 by roc...@chromium.org, Nov 22 2016

Labels: -OS-Linux -OS-Windows -OS-Mac
Status: Fixed (was: Assigned)
Note that this feature is only present on Chrome OS, so the other OS labels are unnecessary.

I don't think there's any reason to merge the fix, since the API is still only enabled on dev channel.
Project Member

Comment 4 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 6 by sheriffbot@chromium.org, Feb 28 2017

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 7 by dchan@google.com, Apr 17 2017

Labels: VerifyIn-59

Comment 8 by dchan@google.com, May 30 2017

Labels: VerifyIn-60

Comment 9 by dchan@chromium.org, Aug 1 2017

Labels: VerifyIn-61

Comment 10 by dchan@chromium.org, Oct 14 2017

Status: Archived (was: Fixed)

Sign in to add a comment