Chrome · Autofill
CVE-2025-3073
Logic Error in Autofill
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifchrome/browser/ui/views/autofill/popup/popup_view_utils.cc |
modified |
Files Changed
chrome/browser/ui/views/autofill/popup/popup_view_utils.cc
Patch
From ba87ecce5f6c7c8f22331d3bc718b88232c96b8a Mon Sep 17 00:00:00 2001
From: Thomas Nguyen <tungnh@chromium.org>
Date: Mon, 17 Feb 2025 02:09:41 -0800
Subject: [PATCH] [PEPC] Don't show autofill overlaps with PEPC
Bug: 388680893
Change-Id: I96bb1e1e9fae5d5ef28f01f376e1826602509fc3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6268722
Commit-Queue: Thomas Nguyen <tungnh@chromium.org>
Reviewed-by: Mohamed Amir Yosef <mamir@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1420982}
---
diff --git a/chrome/browser/ui/views/autofill/popup/popup_view_utils.cc b/chrome/browser/ui/views/autofill/popup/popup_view_utils.cc
index 7b8494fa..a5465fe 100644
--- a/chrome/browser/ui/views/autofill/popup/popup_view_utils.cc
+++ b/chrome/browser/ui/views/autofill/popup/popup_view_utils.cc
@@ -11,6 +11,7 @@
#include "chrome/browser/ui/browser_finder.h"
#include "chrome/browser/ui/views/extensions/extension_popup.h"
#include "chrome/browser/ui/views/frame/browser_view.h"
+#include "chrome/browser/ui/views/permissions/embedded_permission_prompt_base_view.h"
#include "chrome/browser/ui/views/permissions/permission_prompt_bubble_base_view.h"
#include "components/autofill/core/browser/suggestions/suggestion_type.h"
#include "components/autofill/core/browser/ui/popup_open_enums.h"
@@ -102,6 +103,18 @@
return {width, height};
}
+// Returns whether there is a visible view with `view_id` that overlaps
+// `screen_bounds`.
+bool BoundsOverlapWithView(const gfx::Rect& screen_bounds,
+ BrowserView* browser_view,
+ ui::ElementIdentifier view_id) {
+ auto* view_tracker = views::ElementTrackerViews::GetInstance();
+ views::View* view = view_tracker->GetFirstMatchingView(
+ view_id, view_tracker->GetContextForView(browser_view));
+ return view &&
+ view->GetWidget()->GetWindowBoundsInScreen().Intersects(screen_bounds);
+}
+
} // namespace
void CalculatePopupYAndHeight(int popup_preferred_height,
@@ -205,18 +218,10 @@
return false;
}
- views::View* const permission_bubble_view =
- views::ElementTrackerViews::GetInstance()->GetFirstMatchingView(
- PermissionPromptBubbleBaseView::kMainViewId,
- views::ElementTrackerViews::GetInstance()->GetContextForView(
- browser_view));
- if (!permission_bubble_view) {
- return false;
- }
-
- return permission_bubble_view->GetWidget()
- ->GetWindowBoundsInScreen()
- .Intersects(screen_bounds);
+ return BoundsOverlapWithView(screen_bounds, browser_view,
+ PermissionPromptBubbleBaseView::kMainViewId) ||
+ BoundsOverlapWithView(screen_bounds, browser_view,
+ EmbeddedPermissionPromptBaseView::kMainViewId);
}
bool BoundsOverlapWithPictureInPictureWindow(const gfx::Rect& screen_bounds) {
Loading diff…
Original Bug Report
reported by sa...@gmail.com
References
On This Page