Fingerprinting protections bypassable via window.open

[pes10k]

Description

Similar to #11683, fingerprinting protections can be bypassed by opening up a new window with window.open grabbing the references to the blocked fingerprinting methods off the window object before the extension / content script / document_start extension hook fires in the new window's context.

This vulnerability is less serious than #11683, since the user has to have granted to page the ability to open popup windows. But once the user does, the page can escalate that privilege to fingerprint the user.

Steps to Reproduce

// This will be a reference to a function that blocks the page's finger printing attempt.
let blockedGetImageData = CanvasRenderingContext2D.prototype.getImageData;

let newWindow = window.open("//" + window.location.hostname);

// If the user has allowed the page to open popup windows, `notBlockedGetImageData`
// will be a referenced to the original, DOM provided methods, that is not blocked
let notBlockedGetImageData = newWindow.CanvasRenderingContext2D.prototype.getImageData;

Actual result:
notBlockedGetImageData in the above example is a reference to the original CanvasRenderingContext2D.prototype.getImageData method.

Expected result:
notBlockedGetImageData in the above example should be a reference to the extension injected blocking function / proxy object.

Reproduces how often:
100% of the time

Brave Version

about:brave info:
d4b94c6 (and also master)

Reproducible on current live release:
yes

Additional Information

This would be fixed by #12045 too. A shorter term fix could be done similar to ###11683

[diracdeltas]

marking as 0.20.x since it is a subissue of #12045

[bsclifton]

Moving to 0.21.x since this is a sub-issue of #12045 (which was moved to 0.21.x)

[alexwykoff]

@diracdeltas should this be in 0.21.x or can it be moved back?

[diracdeltas]

@alexwykoff see #12045 (comment)

[tildelowengrimm]

@yrliou Can you confirm whether this is fixed in brave-browser?

[yrliou]

It's fixed by brave/brave-browser#11, fingerprinting protection in brave-browser is implemented in C++ instead of using proxy objects in JS, so won't have this issue.

[bsclifton]

Will be fixed by our upcoming fork (thanks for the update, @yrliou!)

For browser-laptop (the current version of the product), I'm going to close this issue as wontfix