vrp_flags: Add cross-renderer VRP flags [chromium/src : main]
0 views
Skip to first unread message
Matthew Denton (Gerrit)
Jul 24, 2026, 6:15:02 AM (9 days ago) Jul 24
to Alex Gough, Chromium LUCI CQ, chromium...@chromium.org, ipc-securi...@chromium.org
Attention needed from Alex Gough
Matthew Denton added 1 comment![]( "Open in Gerrit")
Patchset-level comments
File-level comment, Patchset 7:
Matthew Denton . resolved
Useful? Also see the next CL which allows the attacker to iframe or window.open a victim page.
Related details
Attention is currently required from:
- Alex Gough
Submit Requirements:
Code-Coverage
Code-Owners
Code-Review
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Alex Gough (Gerrit)
Jul 24, 2026, 12:15:00 PM (9 days ago) Jul 24
to Matthew Denton, Alex Gough, Chromium LUCI CQ, chromium...@chromium.org, ipc-securi...@chromium.org
Attention needed from Matthew Denton
Alex Gough voted and added 3 comments![]( "Open in Gerrit")
Votes added by Alex Gough
| Code-Review | +1 |
3 comments
Patchset-level comments
File-level comment, Patchset 9 (Latest):
Alex Gough . unresolved
need some docs too to advertise - e.g. in the vrp faq
File content/browser/browser_main_loop.cc
Line 70, Patchset 9 (Latest):
#include "components/vrp_flags/buildflags.h"
#if BUILDFLAG(ENABLE_VRP_FLAGS)
#include "components/vrp_flags/vrp_flags.h" // nogncheck
#include "services/network/public/cpp/network_switches.h"
#endifAlex Gough . unresolved
pop these below the non-guarded imports
File content/renderer/browser_exposed_renderer_interfaces.cc
Line 23, Patchset 9 (Latest):
#if BUILDFLAG(ENABLE_VRP_FLAGS)
#include "components/vrp_flags/vrp_flags.h" // nogncheck
#include "components/vrp_flags/vrp_flags.mojom.h" // nogncheck
#include "components/vrp_flags/vrp_flags_impl.h" // nogncheck
#endifAlex Gough . unresolved
below normal imports
Related details
Attention is currently required from:
- Matthew Denton
Submit Requirements:
Code-Coverage
Code-Owners
Code-Review
No-Unresolved-Comments
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Matthew Denton (Gerrit)
Jul 27, 2026, 5:34:25 AM (6 days ago) Jul 27
to Alex Gough, Chromium LUCI CQ, chromium...@chromium.org, ipc-securi...@chromium.org
Attention needed from Alex Gough
Matthew Denton voted and added 3 comments![]( "Open in Gerrit")
Votes added by Matthew Denton
| Commit-Queue | +1 |
need some docs too to advertise - e.g. in the vrp faq
Matthew Denton
Done
File content/browser/browser_main_loop.cc
Line 70, Patchset 9:
#include "components/vrp_flags/buildflags.h"
#if BUILDFLAG(ENABLE_VRP_FLAGS)
#include "components/vrp_flags/vrp_flags.h" // nogncheck
#include "services/network/public/cpp/network_switches.h"
#endifAlex Gough . resolved
pop these below the non-guarded imports
Matthew Denton
Done
File content/renderer/browser_exposed_renderer_interfaces.cc
Line 23, Patchset 9:
#if BUILDFLAG(ENABLE_VRP_FLAGS)
#include "components/vrp_flags/vrp_flags.h" // nogncheck
#include "components/vrp_flags/vrp_flags.mojom.h" // nogncheck
#include "components/vrp_flags/vrp_flags_impl.h" // nogncheck
#endifAttention is currently required from:
- Alex Gough
Submit Requirements:
Code-Coverage
Code-Owners
Code-Review
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Alex Gough (Gerrit)
Jul 27, 2026, 6:20:05 PM (6 days ago) Jul 27
to Matthew Denton, Alex Gough, Chromium LUCI CQ, chromium...@chromium.org, ipc-securi...@chromium.org
Attention needed from Matthew Denton
Alex Gough voted and added 2 comments![]( "Open in Gerrit")
Votes added by Alex Gough
| Code-Review | +1 |
2 comments
Patchset-level comments
File content/browser/browser_main_loop.cc
Line 635, Patchset 10 (Latest):
command_line->AppendSwitchASCII(network::switches::kHostResolverRules,Alex Gough . unresolved
might be good to do an INFO log here
Related details
Attention is currently required from:
- Matthew Denton
Submit Requirements:
Code-Coverage
Code-Owners
Code-Review
No-Unresolved-Comments
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Matthew Denton (Gerrit)
Jul 28, 2026, 4:18:46 AM (5 days ago) Jul 28
to Dave Tapuska, Alex Gough, Chromium LUCI CQ, chromium...@chromium.org, ipc-securi...@chromium.org
Attention needed from Dave Tapuska
Matthew Denton added 2 comments![]( "Open in Gerrit")
Patchset-level comments
File-level comment, Patchset 11 (Latest):
Matthew Denton . resolved
+dtapuska@ for content/. Note that //components/vrp_flags is already a content DEP (https://source.chromium.org/search?q=components%2Fvrp_flags%20file:DEPS&ss=chromium%2Fchromium%2Fsrc:content%2F)
File content/browser/browser_main_loop.cc
Line 635, Patchset 10:
command_line->AppendSwitchASCII(network::switches::kHostResolverRules,Alex Gough . resolved
might be good to do an INFO log here
Attention is currently required from:
- Dave Tapuska
Submit Requirements:
Code-Coverage
Code-Owners
Code-Review
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Dave Tapuska (Gerrit)
Jul 28, 2026, 10:02:49 AM (5 days ago) Jul 28
to Matthew Denton, Alex Gough, Chromium LUCI CQ, chromium...@chromium.org, ipc-securi...@chromium.org
Attention needed from Matthew Denton
Dave Tapuska added 1 comment![]( "Open in Gerrit")
File content/browser/browser_main_loop.cc
Line 621, Patchset 11 (Latest):
// When VRP flags are enabled and no custom --host-resolver-rules are set,Dave Tapuska . unresolved
I'd prefer if this was just like other APIs. Something like: vrp_flags::PostEarlyInitialization(), and this code was contained inside vrp_flags directory. Is that possible?
Related details
Attention is currently required from:
- Matthew Denton
Submit Requirements:
Code-Coverage
Code-Owners
Code-Review
No-Unresolved-Comments
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Matthew Denton (Gerrit)
Jul 29, 2026, 3:23:38 AM (4 days ago) Jul 29
to android-bu...@system.gserviceaccount.com, Dave Tapuska, Alex Gough, Chromium LUCI CQ, chromium...@chromium.org, droger+w...@chromium.org, ipc-securi...@chromium.org
Attention needed from Alex Gough and Dave Tapuska
Matthew Denton voted and added 2 comments![]( "Open in Gerrit")
Votes added by Matthew Denton
| Auto-Submit | +1 |
| Commit-Queue | +1 |
2 comments
Patchset-level comments
File content/browser/browser_main_loop.cc
Line 621, Patchset 11:
// When VRP flags are enabled and no custom --host-resolver-rules are set,Dave Tapuska . resolved
I'd prefer if this was just like other APIs. Something like: vrp_flags::PostEarlyInitialization(), and this code was contained inside vrp_flags directory. Is that possible?
Attention is currently required from:
- Alex Gough
- Dave Tapuska
Submit Requirements:
Code-Coverage
Code-Owners
Code-Review
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Dave Tapuska (Gerrit)
Jul 29, 2026, 9:01:40 AM (4 days ago) Jul 29
to Matthew Denton, android-bu...@system.gserviceaccount.com, Alex Gough, Chromium LUCI CQ, chromium...@chromium.org, droger+w...@chromium.org, ipc-securi...@chromium.org
Attention needed from Alex Gough and Matthew Denton
Dave Tapuska voted![]( "Open in Gerrit")
Attention is currently required from:
- Alex Gough
- Matthew Denton
Submit Requirements:
Code-Coverage
Code-Owners
Code-Review
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Matthew Denton (Gerrit)
Jul 30, 2026, 2:58:07 AM (3 days ago) Jul 30
to Dave Tapuska, android-bu...@system.gserviceaccount.com, Alex Gough, Chromium LUCI CQ, chromium...@chromium.org, droger+w...@chromium.org, ipc-securi...@chromium.org
Attention needed from Alex Gough
Matthew Denton added 1 comment![]( "Open in Gerrit")
Patchset-level comments
Matthew Denton . resolved
sorry alex need +1 one more time 😊
Related details
Attention is currently required from:
- Alex Gough
Submit Requirements:
Code-Coverage
Code-Owners
Code-Review
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Alex Gough (Gerrit)
Jul 30, 2026, 3:51:55 PM (3 days ago) Jul 30
to Matthew Denton, Alex Gough, Dave Tapuska, android-bu...@system.gserviceaccount.com, Chromium LUCI CQ, chromium...@chromium.org, droger+w...@chromium.org, ipc-securi...@chromium.org
Attention needed from Matthew Denton
Alex Gough voted Code-Review+1![]( "Open in Gerrit")
Attention is currently required from:
- Matthew Denton
Submit Requirements:
Code-Coverage
Code-Owners
Code-Review
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Matthew Denton (Gerrit)
3:41 AM (4 hours ago) 3:41 AM
to Alex Gough, Dave Tapuska, android-bu...@system.gserviceaccount.com, Chromium LUCI CQ, chromium...@chromium.org, droger+w...@chromium.org, ipc-securi...@chromium.org
Matthew Denton submitted the change![]( "Open in Gerrit")
Change information
Commit message:
vrp_flags: Add cross-renderer VRP flags
Implement initial support for renderer-to-renderer attacks in the VRP
flags binding, allowing an attacker-controlled renderer process to
request the creation of a cross-site victim renderer and obtain a bound
VrpFlags Mojo interface to it.
VRP process: attacker writes poc.html which we serve from
localhost:8000. poc.html can start a new tab pointing to
victim.test:8000/poc.html, which just resolves back to
localhost:8000/poc.html. This way pocs can remain single files and just
behave differently based on their URL (localhost or victim.test). The
attacker controls both the attacker page and the victim page in this CTF
environment to enable more realistic attack scenario, as most victim
sites will do things rather than just being static pages.
Change-Id: Ib2adbdac7dd0ee08db7dc6044410761f2ef46f53
Reviewed-by: Dave Tapuska <dtap...@chromium.org>
Auto-Submit: Matthew Denton <mpde...@chromium.org>
Reviewed-by: Alex Gough <aj...@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1672361}
Files:
- M components/vrp_flags/BUILD.gn
- M components/vrp_flags/DEPS
- M components/vrp_flags/README.md
- M components/vrp_flags/vrp_flags.cc
- M components/vrp_flags/vrp_flags.h
- M components/vrp_flags/vrp_flags.mojom
- M content/browser/browser_interface_binders.cc
- M content/browser/browser_main_loop.cc
- M content/browser/vrp_flags/vrp_flags_browsertest.cc
- M content/browser/vrp_flags/vrp_flags_factory_impl.cc
- M content/browser/vrp_flags/vrp_flags_factory_impl.h
- M content/renderer/BUILD.gn
- M content/renderer/DEPS
- M content/renderer/browser_exposed_renderer_interfaces.cc
- M docs/security/vrp-faq.md
Change size: L
Delta: 15 files changed, 374 insertions(+), 16 deletions(-)
Branch: refs/heads/main
Submit Requirements:
Code-Review: +1 by Alex Gough, +1 by Dave Tapuska
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Reply all
Reply to author
Forward
0 new messages