VULNERABILITY DETAILS

A compromised process (renderer, utility, etc) can bypass the service manager's manifest enforcement and/or impersonate other services.

In services/service_manager/service_manager.cc, Instance::StartServiceWithProcess fails to enforce the client_process capability, because it passes nullptr into the validation function:

  void StartServiceWithProcess(
      const Identity& in_target,
      mojo::ScopedMessagePipeHandle service_handle,
      mojom::PIDReceiverRequest pid_receiver_request,
      StartServiceWithProcessCallback callback) override {
    Identity target = in_target;
    mojom::ConnectResult result =
        ValidateConnectParams(&target, nullptr, nullptr); <-- should pass service_handle and receiver_request
    ...
    ...
    service_manager_->Connect(std::move(params));
  }

The target identity is still validated by ValidateConnectionSpec(), but it allows the target user_id to be kRootUserID and the target service to be any service in the source's "requires" list. If the target passes this validation, ServiceManager::Connect() will be called, which will call CreateInstance(). A new Instance (with the target identity) will be created and bound to the service provided by the compromised process.

Exploit Strategy:
A compromised renderer can call StartServiceWithProcess with Identity(kRootUserID, "content_browser") to create a fake "content_browser" service running in its process. Using this new service's Connector, the renderer process can now access sensitive services (e.g. file service, preferences service, etc.).
It can also replace existing services with fake ones to intercept potentially sensitive IPC calls. The fake "content_browser" service has capabilities to create services with any user id and instance name:

  "service_manager": [
    "service_manager:client_process",
    "service_manager:instance_name",
    "service_manager:service_manager",
    "service_manager:user_id"
  ],

Note: This works even if the target identity was already created, because the following insertion will fail silently on production builds:

  auto result =
      identity_to_instance_.insert(std::make_pair(target, raw_instance));
  DCHECK(result.second);

VERSION
Chrome Version: stable
Operating System: All

REPRODUCTION CASE
Working on a PoC now, which I'll post soon.