If you can find and fix this subtle Chromium bug that breaks some extensions, there's $8k waiting for you

Unlucky few percent of netizens affected by weird timing issue

For the past three months, an elusive bug in Google's open-source Chromium project has been causing a small percentage of Chrome extensions to silently fail.

The bug affects about three to five percent of users of several popular Chrome browser extensions, according to Jói Sigurdsson, founder and CEO of CrankWheel, maker of a screen-sharing extension for sales teams.

As described in the Chromium bug report, event handlers registered via chrome.browserAction.onClicked.addListener sometimes will fail to get dispatched when the associated button or icon is clicked by the user. For an individual using an affected extension, the result would be that the extension's button just stops responding to click events.

"Around April 10th, we started getting reports from several users that clicking the CrankWheel button in their browser was not causing anything to happen," explained Sigurdsson in a blog post published last month. "Our initial suggestion to users was to disable and re-enable our extension, and that seemed to do the trick."

"Five days later, the issue randomly reproduced on my machine, and I was able to confirm that it is a Google Chrome / Chromium problem, not a problem with our extension, and I registered an issue on the Chromium issue tracker, along with screen recordings that confirm the reproduction and provide some extra detail."

Beyond CrankWheek, Sigurdsson believes several popular extensions that use the same browserAction API for event handling are likely to be affected, including LastPass, Screencastify, Norton Password Manager, Mendeley Web Importer, Picture in Picture Extension (by Google), Crx Mouse Chrome Gestures, Save to Pocket, Google Mail Checker (by Google), and Mute Tab.

Efforts to confirm this have come to naught. In a message to the Chromium Extensions developer forum on Monday, Sigurdsson said he had not heard back from the developers of those extensions. However, there is an independent report that the issue has been reproduced with Google Mail Checker and Mute Tab.

Since about a week ago, there have been several reports of similar problems from users of Microsoft Edge, which is based on Chromium.

Initially, the problems started occurring in Chrome 100 and Sigurdsson believed they might be limited to extensions built to the deprecated Manifest v2 specification. But the issue has also been reported for Chrome extensions built using Manifest v3 and a supposed fix in Chrome 102 evidently failed to make things right.

Google engineers have discussed the issue in several posts but they aren't inclined to try to come up with a repair plan in the absence of a reliable way to reproduce the error.

Efforts to diagnose the problem have led to plenty of speculation but no definitive fix. The situation has proven troubling enough that CrankWheel is offering a $4,000 bounty to consistently reproduce the bug and a separate $4,000 bounty to fix it.

Last week, the company posted a job through freelancing site Upwork in the hope someone can hunt down the vexing bug.
"What we need is a Chromium C++ expert to dig into the bug and hopefully solve it," the posting reads.

"We would like to start with up to two full days of work at your hourly rate if you are selected, plus we are offering two $4k bounties, one for a consistent and reasonably quick repro scenario, and one for an actual fix.

"Although we would be paying your hourly rate, you would still also be eligible for either or both bounties, which we would pay through the Upwork platform, until the total value of your work for us based on your hourly rate exceeds $5k. After work worth $5k for your time, you would become ineligible for the bounties unless we make a separate agreement."

In his forum message, Sigurdsson said he has already hired one C++ developer to dig through the Chromium code in search of an answer, though he said he is open to hiring a second if the individual has the right skillset. ®

Source