Describe the issue

The element picker works by creating an about:blank iframe in the page to display the dialog. Because the same origin policy does not prevent the page from editing the form fields, it can inject malicious rules like ||*.com or whatever.

It's not the end of the world, but if the frame were a web_accessible_resource page instead, the same origin policy would protect it from tampering by the page. That would minimize the damage possible by a malicious page, at worst they would be able to stop you using the picker on their domain.

I don't think a page can trigger the element picker themselves, they have to wait for the user to do it. Untrusted click events are dropped, but that's not that important, a page could add their own handler to modify the contents on a trusted click, or just rearrange and hide elements so that clicking anywhere on the screen triggers the event.

Steps for anyone to reproduce the issue

1. Start the element picker.
2. Do something like

document.querySelector("iframe").contentWindow.document.querySelector("textarea").value = "||*.com";
// Do something like this to make it impossible not to click
create = document.querySelector("iframe").contentWindow.document.querySelector("[id=create]"); 
create.parentElement.removeChild(create);
document.body.appendChild(create);
create.style.cssText = "position: fixed; top: 0; left: 0; height: 100%; width: 100%"

Your settings

• Linux
• Chrome64