vrp_flags: manual cross-renderer victim spawning [chromium/src : main]

0 views
Skip to first unread message

Matthew Denton (Gerrit)

unread,
Jul 27, 2026, 5:37:05 AM (6 days ago) Jul 27
to Alex Gough, Chromium LUCI CQ, chromium...@chromium.org, alexmo...@chromium.org, creis...@chromium.org, ipc-securi...@chromium.org, navigation...@chromium.org
Attention needed from Alex Gough

Matthew Denton voted Commit-Queue+1

Commit-Queue+1
Open in Gerrit

Related details

Attention is currently required from:
  • Alex Gough
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: I4bfa34ad4e5831733ea3f34e2ed52d108aaa349c
Gerrit-Change-Number: 8142640
Gerrit-PatchSet: 6
Gerrit-Owner: Matthew Denton <mpde...@chromium.org>
Gerrit-Reviewer: Alex Gough <aj...@chromium.org>
Gerrit-Reviewer: Matthew Denton <mpde...@chromium.org>
Gerrit-Attention: Alex Gough <aj...@chromium.org>
Gerrit-Comment-Date: Mon, 27 Jul 2026 09:36:50 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
satisfied_requirement
unsatisfied_requirement
open
diffy

Alex Gough (Gerrit)

unread,
Jul 28, 2026, 4:56:02 PM (5 days ago) Jul 28
to Matthew Denton, Alex Gough, Chromium LUCI CQ, chromium...@chromium.org, alexmo...@chromium.org, creis...@chromium.org, ipc-securi...@chromium.org, navigation...@chromium.org
Attention needed from Matthew Denton

Alex Gough voted and added 2 comments

Votes added by Alex Gough

Code-Review+1

2 comments

Patchset-level comments
File components/vrp_flags/vrp_flags.mojom
Line 41, Patchset 7 (Latest): kManualSpawn,
Alex Gough . unresolved

comment for the enum value

Open in Gerrit

Related details

Attention is currently required from:
  • Matthew Denton
Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement is not satisfiedCode-Owners
    • requirement satisfiedCode-Review
    • requirement is not satisfiedNo-Unresolved-Comments
    • requirement satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: I4bfa34ad4e5831733ea3f34e2ed52d108aaa349c
    Gerrit-Change-Number: 8142640
    Gerrit-PatchSet: 7
    Gerrit-Owner: Matthew Denton <mpde...@chromium.org>
    Gerrit-Reviewer: Alex Gough <aj...@chromium.org>
    Gerrit-Reviewer: Matthew Denton <mpde...@chromium.org>
    Gerrit-Attention: Matthew Denton <mpde...@chromium.org>
    Gerrit-Comment-Date: Tue, 28 Jul 2026 20:55:53 +0000
    Gerrit-HasComments: Yes
    Gerrit-Has-Labels: Yes
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy

    Matthew Denton (Gerrit)

    unread,
    Jul 29, 2026, 3:37:34 AM (4 days ago) Jul 29
    to Alex Moshchuk, Alex Gough, Chromium LUCI CQ, chromium...@chromium.org, alexmo...@chromium.org, creis...@chromium.org, ipc-securi...@chromium.org, navigation...@chromium.org
    Attention needed from Alex Moshchuk

    Matthew Denton added 1 comment

    File components/vrp_flags/vrp_flags.mojom
    Line 41, Patchset 7: kManualSpawn,
    Alex Gough . resolved

    comment for the enum value

    Matthew Denton

    Done

    Open in Gerrit

    Related details

    Attention is currently required from:
    • Alex Moshchuk
    Submit Requirements:
      • requirement satisfiedCode-Coverage
      • requirement is not satisfiedCode-Owners
      • requirement satisfiedCode-Review
      • requirement satisfiedReview-Enforcement
      Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
      Gerrit-MessageType: comment
      Gerrit-Project: chromium/src
      Gerrit-Branch: main
      Gerrit-Change-Id: I4bfa34ad4e5831733ea3f34e2ed52d108aaa349c
      Gerrit-Change-Number: 8142640
      Gerrit-PatchSet: 8
      Gerrit-Owner: Matthew Denton <mpde...@chromium.org>
      Gerrit-Reviewer: Alex Gough <aj...@chromium.org>
      Gerrit-Reviewer: Alex Moshchuk <ale...@chromium.org>
      Gerrit-Reviewer: Matthew Denton <mpde...@chromium.org>
      Gerrit-Attention: Alex Moshchuk <ale...@chromium.org>
      Gerrit-Comment-Date: Wed, 29 Jul 2026 07:37:20 +0000
      Gerrit-HasComments: Yes
      Gerrit-Has-Labels: No
      Comment-In-Reply-To: Alex Gough <aj...@chromium.org>
      satisfied_requirement
      unsatisfied_requirement
      open
      diffy

      Alex Moshchuk (Gerrit)

      unread,
      Jul 29, 2026, 2:46:14 PM (4 days ago) Jul 29
      to Matthew Denton, Alex Gough, Chromium LUCI CQ, chromium...@chromium.org, alexmo...@chromium.org, creis...@chromium.org, ipc-securi...@chromium.org, navigation...@chromium.org
      Attention needed from Matthew Denton

      Alex Moshchuk voted Code-Review+1

      Code-Review+1
      Open in Gerrit

      Related details

      Attention is currently required from:
      • Matthew Denton
      Submit Requirements:
      • requirement satisfiedCode-Coverage
      • requirement satisfiedCode-Owners
      • requirement satisfiedCode-Review
      • requirement satisfiedReview-Enforcement
      Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
      Gerrit-MessageType: comment
      Gerrit-Project: chromium/src
      Gerrit-Branch: main
      Gerrit-Change-Id: I4bfa34ad4e5831733ea3f34e2ed52d108aaa349c
      Gerrit-Change-Number: 8142640
      Gerrit-PatchSet: 8
      Gerrit-Owner: Matthew Denton <mpde...@chromium.org>
      Gerrit-Reviewer: Alex Gough <aj...@chromium.org>
      Gerrit-Reviewer: Alex Moshchuk <ale...@chromium.org>
      Gerrit-Reviewer: Matthew Denton <mpde...@chromium.org>
      Gerrit-Attention: Matthew Denton <mpde...@chromium.org>
      Gerrit-Comment-Date: Wed, 29 Jul 2026 18:46:01 +0000
      Gerrit-HasComments: No
      Gerrit-Has-Labels: Yes
      satisfied_requirement
      open
      diffy

      Matthew Denton (Gerrit)

      unread,
      3:41 AM (4 hours ago) 3:41 AM
      to Alex Moshchuk, Alex Gough, Chromium LUCI CQ, chromium...@chromium.org, alexmo...@chromium.org, creis...@chromium.org, ipc-securi...@chromium.org, navigation...@chromium.org

      Matthew Denton voted Commit-Queue+2

      Commit-Queue+2
      Open in Gerrit

      Related details

      Attention set is empty
      Submit Requirements:
      • requirement satisfiedCode-Coverage
      • requirement satisfiedCode-Owners
      • requirement satisfiedCode-Review
      • requirement satisfiedReview-Enforcement
      Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
      Gerrit-MessageType: comment
      Gerrit-Project: chromium/src
      Gerrit-Branch: main
      Gerrit-Change-Id: I4bfa34ad4e5831733ea3f34e2ed52d108aaa349c
      Gerrit-Change-Number: 8142640
      Gerrit-PatchSet: 8
      Gerrit-Owner: Matthew Denton <mpde...@chromium.org>
      Gerrit-Reviewer: Alex Gough <aj...@chromium.org>
      Gerrit-Reviewer: Alex Moshchuk <ale...@chromium.org>
      Gerrit-Reviewer: Matthew Denton <mpde...@chromium.org>
      Gerrit-Comment-Date: Sun, 02 Aug 2026 07:40:39 +0000
      Gerrit-HasComments: No
      Gerrit-Has-Labels: Yes
      satisfied_requirement
      open
      diffy

      Matthew Denton (Gerrit)

      unread,
      3:41 AM (4 hours ago) 3:41 AM
      to Alex Moshchuk, Alex Gough, Chromium LUCI CQ, chromium...@chromium.org, alexmo...@chromium.org, creis...@chromium.org, ipc-securi...@chromium.org, navigation...@chromium.org

      Matthew Denton submitted the change

      Change information

      Commit message:
      vrp_flags: manual cross-renderer victim spawning

      Extend cross-renderer VRP flags to allow the attacker page to open the
      victim with window.open or iframes or other mechanisms.

      Key changes:
      - Implement VrpNavigationThrottle in content/browser/vrp_flags/ to intercept navigations matching registered victim ports (victim.test:<port>).
      - Register VrpNavigationThrottle in NavigationThrottleRegistryImpl for all frame navigations (main frame, popups, and OOPIF subframes).
      - Bind pending VrpFlags Mojo receivers to the target RenderProcessHost when navigation response processing begins.
      - Delete single-use VictimSpawnObserver in favor of unified NavigationThrottle
      interception for both browser-initiated and manual spawns.
      - Add browser tests covering JS window.open popups, iframe embedding, and cross-origin postMessage communication.
      Change-Id: I4bfa34ad4e5831733ea3f34e2ed52d108aaa349c
      Reviewed-by: Alex Moshchuk <ale...@chromium.org>
      Reviewed-by: Alex Gough <aj...@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#1672362}
      Files:
      • M components/vrp_flags/README.md
      • M components/vrp_flags/vrp_flags.mojom
      • M content/browser/BUILD.gn
      • M content/browser/renderer_host/navigation_throttle_registry_impl.cc
      • M content/browser/vrp_flags/vrp_flags_browsertest.cc
      • M content/browser/vrp_flags/vrp_flags_factory_impl.cc
      • A content/browser/vrp_flags/vrp_navigation_throttle.cc
      • A content/browser/vrp_flags/vrp_navigation_throttle.h
      Change size: L
      Delta: 8 files changed, 348 insertions(+), 55 deletions(-)
      Branch: refs/heads/main
      Submit Requirements:
      • requirement satisfiedCode-Review: +1 by Alex Moshchuk, +1 by Alex Gough
      Open in Gerrit
      Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
      Gerrit-MessageType: merged
      Gerrit-Project: chromium/src
      Gerrit-Branch: main
      Gerrit-Change-Id: I4bfa34ad4e5831733ea3f34e2ed52d108aaa349c
      Gerrit-Change-Number: 8142640
      Gerrit-PatchSet: 9
      open
      diffy
      satisfied_requirement
      Reply all
      Reply to author
      Forward
      0 new messages