[chromecast] Fix Command-line flag injection and sandbox escape in CastBrowserService [chromium/src : main]

1 view
Skip to first unread message

Simeon Anfinrud (Gerrit)

unread,
May 12, 2026, 7:53:36 PMMay 12
to Jerome Jiang, Mirko Bonadei, Sandeep Vijayasekar, Code Review Nudger, Chromium LUCI CQ, chromium...@chromium.org, android-bu...@system.gserviceaccount.com, chrome-intelligence-te...@google.com, grt+...@chromium.org, net-r...@chromium.org, cblume...@chromium.org, devtools...@chromium.org, chrome-intell...@chromium.org, penghuan...@chromium.org, mar...@chromium.org, fgal...@chromium.org, jz...@chromium.org, security-...@chromium.org, halliwe...@chromium.org
Attention needed from Sandeep Vijayasekar

Simeon Anfinrud added 1 comment

Message

Gemini says: Addressed Gerrit review comments.

1 comment

File chromecast/browser/android/junit/src/org/chromium/chromecast/shell/CastCommandLineHelperTest.java
File-level comment, Patchset 13 (Latest):
Simeon Anfinrud . resolved

Gemini says: Done. Updated the copyright year to 2026.

Open in Gerrit

Related details

Attention is currently required from:
  • Sandeep Vijayasekar
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: I92a918da640b4f3a2f9611070ecc98695f499536
Gerrit-Change-Number: 7765497
Gerrit-PatchSet: 13
Gerrit-Owner: Simeon Anfinrud <san...@chromium.org>
Gerrit-Reviewer: Sandeep Vijayasekar <sa...@google.com>
Gerrit-Reviewer: Simeon Anfinrud <san...@chromium.org>
Gerrit-CC: Code Review Nudger <android-build...@prod.google.com>
Gerrit-CC: Jerome Jiang <ji...@chromium.org>
Gerrit-CC: Mirko Bonadei <mbon...@chromium.org>
Gerrit-Attention: Sandeep Vijayasekar <sa...@google.com>
Gerrit-Comment-Date: Tue, 12 May 2026 23:53:27 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
satisfied_requirement
unsatisfied_requirement
open
diffy

Simeon Anfinrud (Gerrit)

unread,
May 14, 2026, 3:44:32 PMMay 14
to Jerome Jiang, Mirko Bonadei, Sandeep Vijayasekar, Code Review Nudger, Chromium LUCI CQ, chromium...@chromium.org, android-bu...@system.gserviceaccount.com, chrome-intelligence-te...@google.com, grt+...@chromium.org, net-r...@chromium.org, cblume...@chromium.org, devtools...@chromium.org, chrome-intell...@chromium.org, penghuan...@chromium.org, mar...@chromium.org, fgal...@chromium.org, jz...@chromium.org, security-...@chromium.org, halliwe...@chromium.org
Attention needed from Sandeep Vijayasekar

Simeon Anfinrud added 7 comments

Message

Gemini says: Addressed Gerrit review comments.

7 comments

File chromecast/browser/android/apk/CastBrowserAndroidManifest.xml.jinja2
File-level comment, Patchset 14 (Latest):
Simeon Anfinrud . resolved

Gemini says: Done. Added a custom permission `com.google.android.apps.mediashell.permission.START_CAST_BROWSER` instead of using `DUMP`.

File chromecast/browser/android/apk/src/org/chromium/chromecast/shell/CastCommandLineHelper.java
File-level comment, Patchset 14 (Latest):
Simeon Anfinrud . resolved

Gemini says: Done. Positional arguments are now allowed.

File-level comment, Patchset 14 (Latest):
Simeon Anfinrud . resolved

Gemini says: Done. The code now correctly handles dashes and empty switch names.

File-level comment, Patchset 14 (Latest):
Simeon Anfinrud . resolved

Gemini says: Done. Removed trailing whitespace.

File-level comment, Patchset 14 (Latest):
Simeon Anfinrud . resolved

Gemini says: Good catch. You are completely right, positional arguments should not be forwarded since they can be interpreted as arbitrary URLs or files to open. I have modified the loop to strictly ignore them.

File-level comment, Patchset 14 (Latest):
Simeon Anfinrud . resolved

Gemini says: Done. I added `CastCommandLineHelperTest` to `chromecast/browser/android/BUILD.gn` that thoroughly tests switch parsing, blocking unauthorized flags, and ignoring positional arguments.

File chromecast/browser/android/junit/src/org/chromium/chromecast/shell/CastCommandLineHelperTest.java
Simeon Anfinrud . resolved

Gemini says: Done. Updated the copyright year to 2026.

Open in Gerrit

Related details

Attention is currently required from:
  • Sandeep Vijayasekar
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: I92a918da640b4f3a2f9611070ecc98695f499536
Gerrit-Change-Number: 7765497
Gerrit-PatchSet: 14
Gerrit-Owner: Simeon Anfinrud <san...@chromium.org>
Gerrit-Reviewer: Sandeep Vijayasekar <sa...@google.com>
Gerrit-Reviewer: Simeon Anfinrud <san...@chromium.org>
Gerrit-CC: Code Review Nudger <android-build...@prod.google.com>
Gerrit-CC: Jerome Jiang <ji...@chromium.org>
Gerrit-CC: Mirko Bonadei <mbon...@chromium.org>
Gerrit-Attention: Sandeep Vijayasekar <sa...@google.com>
Gerrit-Comment-Date: Thu, 14 May 2026 19:44:23 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
satisfied_requirement
unsatisfied_requirement
open
diffy

Simeon Anfinrud (Gerrit)

unread,
May 20, 2026, 12:56:30 AMMay 20
to Jerome Jiang, Mirko Bonadei, Sandeep Vijayasekar, Code Review Nudger, Chromium LUCI CQ, chromium...@chromium.org, android-bu...@system.gserviceaccount.com, chrome-intelligence-te...@google.com, grt+...@chromium.org, net-r...@chromium.org, cblume...@chromium.org, devtools...@chromium.org, chrome-intell...@chromium.org, penghuan...@chromium.org, mar...@chromium.org, fgal...@chromium.org, jz...@chromium.org, security-...@chromium.org, halliwe...@chromium.org
Attention needed from Sandeep Vijayasekar

Simeon Anfinrud voted

Auto-Submit+1
Commit-Queue+1
Gerrit-Comment-Date: Wed, 20 May 2026 04:56:20 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
satisfied_requirement
unsatisfied_requirement
open
diffy

Simeon Anfinrud (Gerrit)

unread,
May 28, 2026, 8:24:38 PMMay 28
to Jerome Jiang, Mirko Bonadei, Sandeep Vijayasekar, Code Review Nudger, Chromium LUCI CQ, chromium...@chromium.org, android-bu...@system.gserviceaccount.com, chrome-intelligence-te...@google.com, grt+...@chromium.org, net-r...@chromium.org, cblume...@chromium.org, devtools...@chromium.org, chrome-intell...@chromium.org, penghuan...@chromium.org, mar...@chromium.org, fgal...@chromium.org, jz...@chromium.org, security-...@chromium.org, halliwe...@chromium.org
Attention needed from Sandeep Vijayasekar

Simeon Anfinrud voted Commit-Queue+2

Commit-Queue+2
Gerrit-Comment-Date: Fri, 29 May 2026 00:24:27 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
satisfied_requirement
unsatisfied_requirement
open
diffy

Simeon Anfinrud (Gerrit)

unread,
Jun 9, 2026, 5:27:57 PMJun 9
to Jerome Jiang, Mirko Bonadei, Sandeep Vijayasekar, Code Review Nudger, Chromium LUCI CQ, chromium...@chromium.org, android-bu...@system.gserviceaccount.com, chrome-intelligence-te...@google.com, grt+...@chromium.org, net-r...@chromium.org, cblume...@chromium.org, devtools...@chromium.org, chrome-intell...@chromium.org, penghuan...@chromium.org, mar...@chromium.org, fgal...@chromium.org, jz...@chromium.org, security-...@chromium.org, halliwe...@chromium.org
Attention needed from Sandeep Vijayasekar

Simeon Anfinrud voted Commit-Queue+1

Commit-Queue+1
Open in Gerrit

Related details

Attention is currently required from:
  • Sandeep Vijayasekar
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: I92a918da640b4f3a2f9611070ecc98695f499536
Gerrit-Change-Number: 7765497
Gerrit-PatchSet: 16
Gerrit-Owner: Simeon Anfinrud <san...@chromium.org>
Gerrit-Reviewer: Sandeep Vijayasekar <sa...@google.com>
Gerrit-Reviewer: Simeon Anfinrud <san...@chromium.org>
Gerrit-CC: Code Review Nudger <android-build...@prod.google.com>
Gerrit-CC: Jerome Jiang <ji...@chromium.org>
Gerrit-CC: Mirko Bonadei <mbon...@chromium.org>
Gerrit-Attention: Sandeep Vijayasekar <sa...@google.com>
Gerrit-Comment-Date: Tue, 09 Jun 2026 21:27:37 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
satisfied_requirement
unsatisfied_requirement
open
diffy

Simeon Anfinrud (Gerrit)

unread,
Jun 10, 2026, 4:03:42 PMJun 10
to Jerome Jiang, Mirko Bonadei, Sandeep Vijayasekar, Code Review Nudger, Chromium LUCI CQ, chromium...@chromium.org, android-bu...@system.gserviceaccount.com, feature-me...@chromium.org, jshin...@chromium.org, storage...@chromium.org, chrome-intelligence-te...@google.com, grt+...@chromium.org, net-r...@chromium.org, cblume...@chromium.org, devtools...@chromium.org, chrome-intell...@chromium.org, penghuan...@chromium.org, mar...@chromium.org, fgal...@chromium.org, jz...@chromium.org, security-...@chromium.org, halliwe...@chromium.org
Attention needed from Sandeep Vijayasekar

Simeon Anfinrud voted and added 1 comment

Votes added by Simeon Anfinrud

Auto-Submit+1

1 comment

File chromecast/browser/android/junit/src/org/chromium/chromecast/shell/CastCommandLineHelperTest.java
Line 27, Patchset 18 (Latest): CommandLine.reset();
Simeon Anfinrud . unresolved

resetForTesting()

Open in Gerrit

Related details

Attention is currently required from:
  • Sandeep Vijayasekar
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: I92a918da640b4f3a2f9611070ecc98695f499536
Gerrit-Change-Number: 7765497
Gerrit-PatchSet: 18
Gerrit-Owner: Simeon Anfinrud <san...@chromium.org>
Gerrit-Reviewer: Sandeep Vijayasekar <sa...@google.com>
Gerrit-Reviewer: Simeon Anfinrud <san...@chromium.org>
Gerrit-CC: Code Review Nudger <android-build...@prod.google.com>
Gerrit-CC: Jerome Jiang <ji...@chromium.org>
Gerrit-CC: Mirko Bonadei <mbon...@chromium.org>
Gerrit-Attention: Sandeep Vijayasekar <sa...@google.com>
Gerrit-Comment-Date: Wed, 10 Jun 2026 20:03:29 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
satisfied_requirement
unsatisfied_requirement
open
diffy

Simeon Anfinrud (Gerrit)

unread,
Jun 18, 2026, 8:21:23 PM (8 days ago) Jun 18
to Jerome Jiang, Mirko Bonadei, Sandeep Vijayasekar, Code Review Nudger, Chromium LUCI CQ, chromium...@chromium.org, android-bu...@system.gserviceaccount.com, feature-me...@chromium.org, jshin...@chromium.org, storage...@chromium.org, chrome-intelligence-te...@google.com, grt+...@chromium.org, net-r...@chromium.org, cblume...@chromium.org, devtools...@chromium.org, chrome-intell...@chromium.org, penghuan...@chromium.org, mar...@chromium.org, fgal...@chromium.org, jz...@chromium.org, security-...@chromium.org, halliwe...@chromium.org
Attention needed from Sandeep Vijayasekar

Simeon Anfinrud voted and added 1 comment

Votes added by Simeon Anfinrud

Auto-Submit+1

1 comment

File chromecast/browser/android/junit/src/org/chromium/chromecast/shell/CastCommandLineHelperTest.java
Line 27, Patchset 18: CommandLine.reset();
Simeon Anfinrud . resolved

resetForTesting()

Simeon Anfinrud

Done

Open in Gerrit

Related details

Attention is currently required from:
  • Sandeep Vijayasekar
Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement satisfiedCode-Owners
    • requirement is not satisfiedCode-Review
    • requirement is not satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: I92a918da640b4f3a2f9611070ecc98695f499536
    Gerrit-Change-Number: 7765497
    Gerrit-PatchSet: 20
    Gerrit-Owner: Simeon Anfinrud <san...@chromium.org>
    Gerrit-Reviewer: Sandeep Vijayasekar <sa...@google.com>
    Gerrit-Reviewer: Simeon Anfinrud <san...@chromium.org>
    Gerrit-CC: Code Review Nudger <android-build...@prod.google.com>
    Gerrit-CC: Jerome Jiang <ji...@chromium.org>
    Gerrit-CC: Mirko Bonadei <mbon...@chromium.org>
    Gerrit-Attention: Sandeep Vijayasekar <sa...@google.com>
    Gerrit-Comment-Date: Fri, 19 Jun 2026 00:21:04 +0000
    Gerrit-HasComments: Yes
    Gerrit-Has-Labels: Yes
    Comment-In-Reply-To: Simeon Anfinrud <san...@chromium.org>
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy

    Sandeep Vijayasekar (Gerrit)

    unread,
    Jun 22, 2026, 1:45:19 PM (4 days ago) Jun 22
    to Simeon Anfinrud, Jerome Jiang, Mirko Bonadei, Code Review Nudger, Chromium LUCI CQ, chromium...@chromium.org, android-bu...@system.gserviceaccount.com, feature-me...@chromium.org, jshin...@chromium.org, storage...@chromium.org, chrome-intelligence-te...@google.com, grt+...@chromium.org, net-r...@chromium.org, cblume...@chromium.org, devtools...@chromium.org, chrome-intell...@chromium.org, penghuan...@chromium.org, mar...@chromium.org, fgal...@chromium.org, jz...@chromium.org, security-...@chromium.org, halliwe...@chromium.org
    Attention needed from Simeon Anfinrud

    Sandeep Vijayasekar voted Code-Review+1

    Code-Review+1
    Open in Gerrit

    Related details

    Attention is currently required from:
    • Simeon Anfinrud
    Submit Requirements:
      • requirement satisfiedCode-Coverage
      • requirement satisfiedCode-Owners
      • requirement satisfiedCode-Review
      • requirement satisfiedReview-Enforcement
      Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
      Gerrit-MessageType: comment
      Gerrit-Project: chromium/src
      Gerrit-Branch: main
      Gerrit-Change-Id: I92a918da640b4f3a2f9611070ecc98695f499536
      Gerrit-Change-Number: 7765497
      Gerrit-PatchSet: 20
      Gerrit-Owner: Simeon Anfinrud <san...@chromium.org>
      Gerrit-Reviewer: Sandeep Vijayasekar <sa...@google.com>
      Gerrit-Reviewer: Simeon Anfinrud <san...@chromium.org>
      Gerrit-CC: Code Review Nudger <android-build...@prod.google.com>
      Gerrit-CC: Jerome Jiang <ji...@chromium.org>
      Gerrit-CC: Mirko Bonadei <mbon...@chromium.org>
      Gerrit-Attention: Simeon Anfinrud <san...@chromium.org>
      Gerrit-Comment-Date: Mon, 22 Jun 2026 17:45:01 +0000
      Gerrit-HasComments: No
      Gerrit-Has-Labels: Yes
      satisfied_requirement
      open
      diffy

      Simeon Anfinrud (Gerrit)

      unread,
      Jun 22, 2026, 1:46:07 PM (4 days ago) Jun 22
      to Sandeep Vijayasekar, Jerome Jiang, Mirko Bonadei, Code Review Nudger, Chromium LUCI CQ, chromium...@chromium.org, android-bu...@system.gserviceaccount.com, feature-me...@chromium.org, jshin...@chromium.org, storage...@chromium.org, chrome-intelligence-te...@google.com, grt+...@chromium.org, net-r...@chromium.org, cblume...@chromium.org, devtools...@chromium.org, chrome-intell...@chromium.org, penghuan...@chromium.org, mar...@chromium.org, fgal...@chromium.org, jz...@chromium.org, security-...@chromium.org, halliwe...@chromium.org

      Simeon Anfinrud voted Commit-Queue+2

      Commit-Queue+2
      Open in Gerrit

      Related details

      Attention set is empty
      Submit Requirements:
      • requirement satisfiedCode-Coverage
      • requirement satisfiedCode-Owners
      • requirement satisfiedCode-Review
      • requirement satisfiedReview-Enforcement
      Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
      Gerrit-MessageType: comment
      Gerrit-Project: chromium/src
      Gerrit-Branch: main
      Gerrit-Change-Id: I92a918da640b4f3a2f9611070ecc98695f499536
      Gerrit-Change-Number: 7765497
      Gerrit-PatchSet: 20
      Gerrit-Owner: Simeon Anfinrud <san...@chromium.org>
      Gerrit-Reviewer: Sandeep Vijayasekar <sa...@google.com>
      Gerrit-Reviewer: Simeon Anfinrud <san...@chromium.org>
      Gerrit-CC: Code Review Nudger <android-build...@prod.google.com>
      Gerrit-CC: Jerome Jiang <ji...@chromium.org>
      Gerrit-CC: Mirko Bonadei <mbon...@chromium.org>
      Gerrit-Comment-Date: Mon, 22 Jun 2026 17:45:38 +0000
      Gerrit-HasComments: No
      Gerrit-Has-Labels: Yes
      satisfied_requirement
      open
      diffy

      Sandeep Vijayasekar (Gerrit)

      unread,
      Jun 22, 2026, 1:46:08 PM (4 days ago) Jun 22
      to Simeon Anfinrud, Jerome Jiang, Mirko Bonadei, Code Review Nudger, Chromium LUCI CQ, chromium...@chromium.org, android-bu...@system.gserviceaccount.com, feature-me...@chromium.org, jshin...@chromium.org, storage...@chromium.org, chrome-intelligence-te...@google.com, grt+...@chromium.org, net-r...@chromium.org, cblume...@chromium.org, devtools...@chromium.org, chrome-intell...@chromium.org, penghuan...@chromium.org, mar...@chromium.org, fgal...@chromium.org, jz...@chromium.org, security-...@chromium.org, halliwe...@chromium.org

      Sandeep Vijayasekar added 1 comment

      Commit Message
      Line 9, Patchset 20 (Latest):Protected CastBrowserService in AndroidManifest.xml by requiring android.permission.DUMP. Explicitly filter incoming command-line switches in CastCommandLineHelper to a known safe allowlist, preventing injection of malicious flags like --no-sandbox.
      Sandeep Vijayasekar . unresolved

      I dont see this in the CL

      Open in Gerrit

      Related details

      Attention set is empty
      Submit Requirements:
        • requirement satisfiedCode-Coverage
        • requirement satisfiedCode-Owners
        • requirement satisfiedCode-Review
        • requirement is not satisfiedNo-Unresolved-Comments
        • requirement satisfiedReview-Enforcement
        Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
        Gerrit-MessageType: comment
        Gerrit-Project: chromium/src
        Gerrit-Branch: main
        Gerrit-Change-Id: I92a918da640b4f3a2f9611070ecc98695f499536
        Gerrit-Change-Number: 7765497
        Gerrit-PatchSet: 20
        Gerrit-Owner: Simeon Anfinrud <san...@chromium.org>
        Gerrit-Reviewer: Sandeep Vijayasekar <sa...@google.com>
        Gerrit-Reviewer: Simeon Anfinrud <san...@chromium.org>
        Gerrit-CC: Code Review Nudger <android-build...@prod.google.com>
        Gerrit-CC: Jerome Jiang <ji...@chromium.org>
        Gerrit-CC: Mirko Bonadei <mbon...@chromium.org>
        Gerrit-Comment-Date: Mon, 22 Jun 2026 17:45:45 +0000
        Gerrit-HasComments: Yes
        Gerrit-Has-Labels: No
        satisfied_requirement
        unsatisfied_requirement
        open
        diffy
        Reply all
        Reply to author
        Forward
        0 new messages