New issue
Advanced search Search tips

Issue 835494 link

Starred by 2 users

Issue metadata

Status: WontFix
Owner: ----
Closed: Apr 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows
Pri: ----
Type: Bug-Security
Team-Security-UX



Sign in to add a comment

Security: Permission request UI spoof (repro issue 816033)

Reported by chromium...@gmail.com, Apr 20 2018

Issue description

VERSION
Chrome Version: 68.0.3401.0 (Official Build) canary (64-bit) (cohort: Clang-64)
Operating System: Windows

REPRODUCTION CASE

- Microphone permission shouldn't be allowed or blocked on chrome://settings/content/microphone

1. Set up a local webserver to host poc.html
2. Click on "Click here" button 
3. Observe the permission request stays open after navigation to another origin (with http://localhost wants to...)
 

 
Recording #4.mp4
342 KB View Download
testcase.html
314 bytes View Download

Comment 1 by vakh@chromium.org, Apr 21 2018

 Issue 835495  has been merged into this issue.

Comment 2 by vakh@chromium.org, Apr 21 2018

Similar to  issue 822957 , I am unable to reproduce this.

Comment 3 by vakh@chromium.org, Apr 21 2018

Labels: Needs-Feedback
Yes, but the problem with  Issue 822957  is that microphone permission should not be allowed or blocked to display the permission request bubble.

Screen Shot 2018-04-21 at 00.09.10.png
113 KB View Download
Project Member

Comment 5 by sheriffbot@chromium.org, Apr 21 2018

Cc: vakh@chromium.org
Labels: -Needs-Feedback
Thank you for providing more feedback. Adding the requester to the cc list.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 6 by vakh@chromium.org, Apr 23 2018

Components: UI>Browser>Permissions>Prompts
Owner: guidou@chromium.org
Status: Assigned (was: Unconfirmed)
guidou@ -- please take a look and triage as appropriate. I am unable to repro it but you might be able to. Thanks.

Comment 7 by vakh@chromium.org, Apr 23 2018

Labels: Needs-Feedback
OP -- the poc for this issue and  issue 822957  is exactly the same.
Can you please describe how the two are different?
Yeah is the same PoC in  issue 822957  and  issue 816033  as well. the problem in  issue 822957  was I didn't provide that microphone permission shouldn't be allowed or blocked on chrome://settings/content/microphone, and that's why you weren't able to repro it.

Comment 9 by vakh@chromium.org, Apr 23 2018

Still unable to repro. I'm attaching the video here.

crbug.com_835494.webm
3.2 MB View Download

Comment 10 by vakh@chromium.org, Apr 23 2018

Status: Unconfirmed (was: Assigned)
Project Member

Comment 11 by sheriffbot@chromium.org, Apr 23 2018

Labels: -Needs-Feedback
Thank you for providing more feedback. Adding the requester to the cc list.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 12 by vakh@chromium.org, Apr 23 2018

Labels: OS-Linux OS-Mac OS-Windows

Comment 13 by vakh@chromium.org, Apr 23 2018

Labels: Needs-Feedback
OP -- did I miss anything in #c9?

Is there a more reliable way to reproduce the bug? If not, I'm afraid I'll have to mark this one also as WontFix.

Comment 14 Deleted

Wired, I don't know why the first permission request bubble doesn't show on http://localhost.

Project Member

Comment 16 by sheriffbot@chromium.org, Apr 23 2018

Labels: -Needs-Feedback
Thank you for providing more feedback. Adding the requester to the cc list.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Can you please try this last test case?
testcase.html
333 bytes View Download

Comment 18 by vakh@chromium.org, Apr 23 2018

Status: WontFix (was: Unconfirmed)
Same result. I'm sorry, I'm marking it as WontFix for now.

crbug_835494-2.webm
7.2 MB View Download

Comment 19 by vakh@chromium.org, Apr 23 2018

I forgot to add: Thanks for the bug report and for persevering.

Comment 20 by vakh@chromium.org, Apr 24 2018

I just noticed that the notification bubble popup did not appear at all in the video in #c18. To be clear, the bubble did pop up when I was on localhost but went away when the page navigated to google.com
Hmm... but in #c18 you were trying to repro this on macOS, and this is doesn't repro on macOS, only Windows and Linux.

I have another way to make this clear.

1. Open Chrome on Linux.
3. Load google.com
4. Open devtools and enter: 

  var recognition = new webkitSpeechRecognition();
  recognition.start();
  navigator.webkitGetUserMedia({audio: true}, function(){}, function(){});

5. Now you can see the notification bubble popup is appears on google.com
6. Go to the Omnibox and type example.com >> Enter 
Recording #3.mp4
327 KB View Download

Comment 22 by vakh@chromium.org, Apr 24 2018

Cc: guidou@chromium.org
Components: Blink>Speech
Labels: -OS-Mac
Owner: ----
Status: Untriaged (was: WontFix)

Comment 23 by vakh@chromium.org, Apr 24 2018

I don't have access to a Linux machine at the moment so marking this back as Untriaged.
You can also try it on Windows, please in #c21 in step-6 use mixed.badssl.com instead of example.com :-)
Status: WontFix (was: Untriaged)
RE #24: Sorry, I can't reproduce a problem here using the repro steps in #17 or #21+ #24. The permissions prompt disappears immediately upon navigation to the new site.

68.0.3405.0 {"arch":"x86-64","nacl_arch":"x86-64","os":"win"}
Project Member

Comment 26 by sheriffbot@chromium.org, Aug 2

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment