[FileSystemAccess] Fix internal Content URI blocklist bypasses on Android [chromium/src : main]

[Nate Chapin (Gerrit)]

Attention needed from Balazs Engedy and Benoit Lize

Nate Chapin added 1 comment

Patchset-level comments

File-level comment, Patchset 8 (Latest):

Nate Chapin . resolved

engedy: PTAL at chrome/browser/file_system_access/

Open in Gerrit

Related details

Attention is currently required from:

• Balazs Engedy
• Benoit Lize

Submit Requirements:

• Code-Coverage
• Code-Owners
• Code-Review
• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: comment

Gerrit-Project: chromium/src

Gerrit-Branch: main

Gerrit-Change-Id: I369b05fa63e0157c2ddb42e83ffb5d627d503bc2

Gerrit-Change-Number: 7986593

Gerrit-PatchSet: 8

Gerrit-Owner: Nate Chapin <jap...@chromium.org>

Gerrit-Reviewer: Balazs Engedy <eng...@chromium.org>

Gerrit-Reviewer: Benoit Lize <li...@chromium.org>

Gerrit-Reviewer: Nate Chapin <jap...@chromium.org>

Gerrit-Reviewer: SLSA Policy Verification Service <devtools-gerritco...@google.com>

Gerrit-CC: (Julie)Jeongeun Kim <je_jul...@chromium.org>

Gerrit-CC: Akihiro Ota <akihi...@chromium.org>

Gerrit-CC: Ale Bzk <ales...@chromium.org>

Gerrit-CC: Andrew Rayskiy <green...@google.com>

Gerrit-CC: Charles Hager <clh...@google.com>

Gerrit-CC: Christian Biesinger <cbies...@chromium.org>

Gerrit-CC: ChromeOS Gardener Code Reviews <chrome-os-gar...@google.com>

Gerrit-CC: Chromium LUCI CQ <chromiu...@luci-project-accounts.iam.gserviceaccount.com>

Gerrit-CC: Chromium Metrics Reviews <chromium-met...@google.com>

Gerrit-CC: Code Review Nudger <android-build...@prod.google.com>

Gerrit-CC: Daniel Cheng <dch...@chromium.org>

Gerrit-CC: David Worsham <dwor...@google.com>

Gerrit-CC: Dirk Schulze <dsch...@chromium.org>

Gerrit-CC: Eleanor Lee <elean...@google.com>

Gerrit-CC: Enterprise Policy Reviews <enterprise-p...@google.com>

Gerrit-CC: Fredrik Söderquist <f...@opera.com>

Gerrit-CC: Gazal Agarwal <aga...@google.com>

Gerrit-CC: Hans Wennborg <ha...@chromium.org>

Gerrit-CC: Hongchan Choi <hong...@chromium.org>

Gerrit-CC: Hu, Ningxin <ningx...@intel.com>

Gerrit-CC: James Maclean <wjma...@chromium.org>

Gerrit-CC: Jerome Jiang <ji...@chromium.org>

Gerrit-CC: Jiewei Qian <q...@chromium.org>

Gerrit-CC: Kentaro Hara <har...@chromium.org>

Gerrit-CC: Kevin Babbitt <kbab...@microsoft.com>

Gerrit-CC: Khushal Sagar <khusha...@chromium.org>

Gerrit-CC: Lei Zhang <the...@chromium.org>

Gerrit-CC: Linyu He <lin...@google.com>

Gerrit-CC: Mark Schillaci <mschi...@google.com>

Gerrit-CC: Menard, Alexis <alexis...@intel.com>

Gerrit-CC: Michael Wilson <mjwi...@chromium.org>

Gerrit-CC: Mirko Bonadei <mbon...@chromium.org>

Gerrit-CC: Moe Adel <ad...@google.com>

Gerrit-CC: Nektarios Paisios <nek...@chromium.org>

Gerrit-CC: Nikhil Nayunigari <nikh...@google.com>

Gerrit-CC: Olga Gerchikov <gerc...@microsoft.com>

Gerrit-CC: Per Åhgren <pe...@chromium.org>

Gerrit-CC: Permissions Reviews <permissio...@chromium.org>

Gerrit-CC: Peter Beverloo <pe...@chromium.org>

Gerrit-CC: Raphael Kubo da Costa <ku...@igalia.com>

Gerrit-CC: Rijubrata Bhaumik <rijubrat...@intel.com>

Gerrit-CC: Robert Kroeger <rjkr...@chromium.org>

Gerrit-CC: Ryan Sultanem <rs...@google.com>

Gerrit-CC: Sam Zackrisson <sa...@chromium.org>

Gerrit-CC: Shu Yang <shu...@google.com>

Gerrit-CC: Simon Hangl <sim...@google.com>

Gerrit-CC: Sinan Sahin <sinan...@google.com>

Gerrit-CC: Stephen Chenney <sche...@chromium.org>

Gerrit-CC: Zijie He <zij...@google.com>

Gerrit-CC: android-bu...@system.gserviceaccount.com <android-bu...@system.gserviceaccount.com>

Gerrit-CC: chromium...@chromium.org

Gerrit-CC: gwsq

Gerrit-Attention: Benoit Lize <li...@chromium.org>

Gerrit-Attention: Balazs Engedy <eng...@chromium.org>

Gerrit-Comment-Date: Tue, 28 Jul 2026 17:55:00 +0000

Gerrit-HasComments: Yes

Gerrit-Has-Labels: No

[Joel Hockey (Gerrit)]

Attention needed from Balazs Engedy, Benoit Lize and Nate Chapin

Joel Hockey added 2 comments

File base/android/content_uri_utils.h

Line 69, Patchset 8 (Latest):// invalid.

Joel Hockey . unresolved

This comment belongs to GetContentUriMimeType() below

File base/test/android/java/AndroidManifest_file_provider.xml

Line 19, Patchset 8 (Latest): android:authorities="${applicationId}.inmemory;${applicationId}"

Joel Hockey . unresolved

why is this changing?

Open in Gerrit

Related details

Attention is currently required from:

• Balazs Engedy
• Benoit Lize
• Nate Chapin

Submit Requirements:

• Code-Coverage
• Code-Owners
• Code-Review

• No-Unresolved-Comments

Gerrit-CC: Joel Hockey <joelh...@chromium.org>

Gerrit-Attention: Nate Chapin <jap...@chromium.org>

Gerrit-Attention: Balazs Engedy <eng...@chromium.org>

Gerrit-Comment-Date: Tue, 28 Jul 2026 22:53:13 +0000

Gerrit-HasComments: Yes

Gerrit-Has-Labels: No

[Joel Hockey (Gerrit)]

Attention needed from Balazs Engedy, Benoit Lize and Nate Chapin

Joel Hockey voted Code-Review+1

Code-Review

+1

Open in Gerrit

Related details

Attention is currently required from:

• Balazs Engedy
• Benoit Lize
• Nate Chapin

Submit Requirements:

• Code-Coverage
• Code-Owners

• Code-Review

• No-Unresolved-Comments

• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: comment

Gerrit-Project: chromium/src

Gerrit-Branch: main

Gerrit-Change-Id: I369b05fa63e0157c2ddb42e83ffb5d627d503bc2

Gerrit-Change-Number: 7986593

Gerrit-PatchSet: 8

Gerrit-Owner: Nate Chapin <jap...@chromium.org>

Gerrit-Reviewer: Balazs Engedy <eng...@chromium.org>

Gerrit-Reviewer: Benoit Lize <li...@chromium.org>

Gerrit-Reviewer: Joel Hockey <joelh...@chromium.org>

Gerrit-Comment-Date: Tue, 28 Jul 2026 22:53:40 +0000

Gerrit-HasComments: No

Gerrit-Has-Labels: Yes

[Kirubel (Gerrit)]

Attention needed from Balazs Engedy, Benoit Lize and Nate Chapin

Kirubel removed bling-ai-foundatio...@google.com from this change

Deleted Reviewers:

• bling-ai-foundatio...@google.com

Open in Gerrit

Related details

Attention is currently required from:

• Balazs Engedy
• Benoit Lize
• Nate Chapin

Submit Requirements:

• Code-Coverage
• Code-Owners
• Code-Review
• No-Unresolved-Comments
• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: deleteReviewer

[Takuto Ikuta (Gerrit)]

Attention needed from Balazs Engedy, Benoit Lize and Nate Chapin

Takuto Ikuta removed chrome-b...@google.com from this change

Deleted Reviewers:

• chrome-b...@google.com

[Greg Thompson (Gerrit)]

Attention needed from Balazs Engedy, Benoit Lize and Nate Chapin

Greg Thompson removed grt+...@chromium.org from this change

Deleted Reviewers:

• grt+...@chromium.org

[Benoit Lize (Gerrit)]

Attention needed from Balazs Engedy and Nate Chapin

Benoit Lize voted and added 1 comment

Votes added by Benoit Lize

Code-Review

+1

1 comment

Patchset-level comments

File-level comment, Patchset 8 (Latest):

Benoit Lize . resolved

lgtm

Open in Gerrit

Related details

Attention is currently required from:

• Balazs Engedy
• Nate Chapin

Submit Requirements:

• Code-Coverage
• Code-Owners
• Code-Review
• No-Unresolved-Comments
• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: comment

Gerrit-Attention: Nate Chapin <jap...@chromium.org>

Gerrit-Attention: Balazs Engedy <eng...@chromium.org>

Gerrit-Comment-Date: Wed, 29 Jul 2026 09:43:53 +0000

Gerrit-HasComments: Yes

Gerrit-Has-Labels: Yes

[Nate Chapin (Gerrit)]

Attention needed from Balazs Engedy

Nate Chapin added 2 comments

File base/android/content_uri_utils.h

Line 69, Patchset 8:// invalid.

Joel Hockey . resolved

This comment belongs to GetContentUriMimeType() below

Nate Chapin

Done

File base/test/android/java/AndroidManifest_file_provider.xml

Line 19, Patchset 8: android:authorities="${applicationId}.inmemory;${applicationId}"

Joel Hockey . resolved

why is this changing?

Nate Chapin

Sorry, comment that explained got resolved.

The new test tries to match exactly against the package name, so one of the providers needs to be the authority for applicationId to correctly identify it.

Open in Gerrit

Related details

Attention is currently required from:

• Balazs Engedy

Submit Requirements:

• Code-Coverage
• Code-Owners
• Code-Review

• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: comment

Gerrit-Project: chromium/src

Gerrit-Branch: main

Gerrit-Change-Id: I369b05fa63e0157c2ddb42e83ffb5d627d503bc2

Gerrit-Change-Number: 7986593

Gerrit-PatchSet: 9

Gerrit-Attention: Balazs Engedy <eng...@chromium.org>

Gerrit-Comment-Date: Wed, 29 Jul 2026 20:06:04 +0000

Gerrit-HasComments: Yes

Gerrit-Has-Labels: No

Comment-In-Reply-To: Joel Hockey <joelh...@chromium.org>

[Joel Hockey (Gerrit)]

Attention needed from Balazs Engedy and Nate Chapin

Joel Hockey voted and added 1 comment

Votes added by Joel Hockey

Code-Review

+1

1 comment

File base/test/android/java/AndroidManifest_file_provider.xml

Line 19, Patchset 8: android:authorities="${applicationId}.inmemory;${applicationId}"

Joel Hockey . resolved

why is this changing?

Nate Chapin

Sorry, comment that explained got resolved.

The new test tries to match exactly against the package name, so one of the providers needs to be the authority for applicationId to correctly identify it.

Joel Hockey

I'm not so familiar with the syntax. I thought at first you were appending something strange to the existing authority, but I'm guessing that the semicolon is a separator to indicate that the provider will be used for either. That makes sense.

Open in Gerrit

Related details

Attention is currently required from:

• Balazs Engedy
• Nate Chapin

Gerrit-Attention: Nate Chapin <jap...@chromium.org>

Gerrit-Attention: Balazs Engedy <eng...@chromium.org>

Gerrit-Comment-Date: Wed, 29 Jul 2026 23:47:04 +0000

Gerrit-HasComments: Yes

Gerrit-Has-Labels: Yes

Comment-In-Reply-To: Joel Hockey <joelh...@chromium.org>

Comment-In-Reply-To: Nate Chapin <jap...@chromium.org>

[Balazs Engedy (Gerrit)]

Attention needed from Nate Chapin

Balazs Engedy voted and added 1 comment

Votes added by Balazs Engedy

Code-Review

+1

1 comment

Patchset-level comments

File-level comment, Patchset 9 (Latest):

Balazs Engedy . resolved

permission_context LGTM, thanks!

Open in Gerrit

Related details

Attention is currently required from:

• Nate Chapin

Submit Requirements:

• Code-Coverage
• Code-Owners

Gerrit-Comment-Date: Mon, 03 Aug 2026 20:58:43 +0000

Gerrit-HasComments: Yes

Gerrit-Has-Labels: Yes

[Nate Chapin (Gerrit)]

Nate Chapin voted Commit-Queue+2

Commit-Queue

+2

Open in Gerrit

Related details

Attention set is empty

Gerrit-Comment-Date: Mon, 03 Aug 2026 21:00:48 +0000

Gerrit-HasComments: No

Gerrit-Has-Labels: Yes

[Chromium LUCI CQ (Gerrit)]

Chromium LUCI CQ submitted the change

Change information

Commit message:

[FileSystemAccess] Fix internal Content URI blocklist bypasses on Android

This CL fixes a vulnerability where malicious websites could bypass the
File System Access API's blocklist on Android to access Chrome's
internal private content providers.

1. Exact Package Name Bypass: Chrome registers some providers with the
   exact package name as the authority (e.g. content://com.android.chrome).
   The previous blocklist check strictly looked for a trailing dot
   (content://com.android.chrome.), allowing these to bypass the check.
2. Userinfo Bypass: Prepending userinfo (e.g., content://us...@com.android.chrome)
   bypassed the prefix check but was still resolved by Android.

Fix:
- Refactored the C++ blocklist check to delegate to Java's robust
  ContentUriUtils.isUriFromThisApp() via JNI. This helper resolves the
  authority using PackageManager, making it immune to string-based bypasses like including userinfo.
- Patched the Java-side TWA validation in WebAppLaunchHandler.java using
  robust host extraction via Uri.getHost().
- Added C++ and Java unit tests.

Fixed: 525167753
Test: chrome_junit_tests --gtest_filter=*WebAppLaunchHandlerTest*
Test: unit_tests --gtest_filter=ChromeFileSystemAccessPermissionContextTest.ConfirmSensitiveEntryAccess_ContentUri

TAG=agy
CONV=c6712a02-0910-4fd2-8f7a-fb4d862b0d19

Change-Id: I369b05fa63e0157c2ddb42e83ffb5d627d503bc2

Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7986593

Reviewed-by: Balazs Engedy <eng...@chromium.org>

Reviewed-by: Benoit Lize <li...@chromium.org>

Commit-Queue: Nate Chapin <jap...@chromium.org>

Reviewed-by: Joel Hockey <joelh...@chromium.org>

Cr-Commit-Position: refs/heads/main@{#1672927}

Files:

• M base/android/content_uri_utils.cc
• M base/android/content_uri_utils.h
• M base/android/java/src/org/chromium/base/ContentUriUtils.java
• M base/test/android/java/AndroidManifest_file_provider.xml
• M chrome/android/java/src/org/chromium/chrome/browser/customtabs/content/WebAppLaunchHandler.java
• M chrome/android/junit/src/org/chromium/chrome/browser/customtabs/content/WebAppLaunchHandlerTest.java
• M chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc
• M chrome/browser/file_system_access/chrome_file_system_access_permission_context_unittest.cc

Change size: M

Delta: 8 files changed, 101 insertions(+), 21 deletions(-)

Branch: refs/heads/main

Submit Requirements:

• Code-Review: +1 by Benoit Lize, +1 by Balazs Engedy, +1 by Joel Hockey

Open in Gerrit

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: merged

Gerrit-Project: chromium/src

Gerrit-Branch: main

Gerrit-Change-Id: I369b05fa63e0157c2ddb42e83ffb5d627d503bc2

Gerrit-Change-Number: 7986593

Gerrit-PatchSet: 10

Gerrit-Owner: Nate Chapin <jap...@chromium.org>

Gerrit-Reviewer: Balazs Engedy <eng...@chromium.org>

Gerrit-Reviewer: Benoit Lize <li...@chromium.org>

Gerrit-Reviewer: Chromium LUCI CQ <chromiu...@luci-project-accounts.iam.gserviceaccount.com>

Gerrit-Reviewer: Joel Hockey <joelh...@chromium.org>

Gerrit-Reviewer: Nate Chapin <jap...@chromium.org>

Gerrit-Reviewer: SLSA Policy Verification Service <devtools-gerritco...@google.com>

Gerrit-CC: (Julie)Jeongeun Kim <je_jul...@chromium.org>

Gerrit-CC: Akihiro Ota <akihi...@chromium.org>

Gerrit-CC: Ale Bzk <ales...@chromium.org>

Gerrit-CC: Andrew Rayskiy <green...@google.com>

Gerrit-CC: Charles Hager <clh...@google.com>

Gerrit-CC: Christian Biesinger <cbies...@chromium.org>

Gerrit-CC: ChromeOS Gardener Code Reviews <chrome-os-gar...@google.com>