Bug: breadcrumb-router-segment-index-unvalidated-host-crash

[drmoisan]

• Work Mode: full-bug

Summary

An out-of-range segmentIndex in a segmentDoubleClick breadcrumb message passes codec validation,
throws ArgumentOutOfRangeException deep in BreadcrumbRow.CollapseAfter, and escapes the
async void host-event boundary in BreadcrumbBridgeRouter.OnHostMessageReceived, which catches
only BreadcrumbMessageException. On .NET Framework 4.8 an exception rethrown on the captured
SynchronizationContext from an async void method is unhandled, so a malformed message from the
WebView2 document can terminate the Outlook host process.

Environment

• OS/version: Windows 11 Pro 10.0.26200
• Python version: n/a (C# / .NET Framework 4.8.1 WinForms VSTO add-in with Microsoft WebView2)
• Command/flags used: n/a - reached through the EfcViewer folder-list breadcrumb surface
• Data source or fixture: any breadcrumb row whose segmentIndex exceeds the row's segment count

Steps to Reproduce

1. Open the EfcViewer folder list so the breadcrumb surface is hosted and
   EfcFormController.ConfigureBreadcrumbControl (QuickFiler/Controllers/EfcFormController.cs:834-854)
   has wired a BreadcrumbBridgeRouter to a WebView2BreadcrumbHost.
2. Have the hosted document post the message
   {"type":"segmentDoubleClick","rowId":"row-1","segmentIndex":99} for a row that has fewer than
   100 segments.
3. Observe the add-in host process.

Expected Behavior

The router's own XML doc comment at QuickFiler/Controllers/BreadcrumbBridgeRouter.cs:151-154 states
the contract: a malformed payload should "fail fast with the codec's BreadcrumbMessageException
(already logged) and leave state unchanged." An out-of-range index should therefore be rejected and
logged, leaving row state untouched and the host running.

Actual Behavior

ArgumentOutOfRangeException propagates out of async void OnHostMessageReceived and is rethrown on
the captured SynchronizationContext (the Outlook UI thread in production), producing an unhandled
exception and a host-process crash. The documented contract at :151-154 is false for this input.

Logs / Screenshots

• Attached minimal logs or screenshot
• Snippet: System.ArgumentOutOfRangeException originating in BreadcrumbRow.CollapseAfter
  (QuickFiler/Controllers/BreadcrumbRow.cs:111-118).

Impact / Severity

• Blocker
• High
• Medium
• Low

Rationale: the failure mode is host-process termination rather than a degraded feature, and the
input arrives from the hosted WebView2 document rather than from trusted in-process code.

Source

From: docs/features/potential/2026-08-08-breadcrumb-router-segment-index-unvalidated-host-crash.md