Chrome · Chromoting › Remoting
CVE-2026-106251
Spoofing in Chromoting (Remoting)
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifremoting/host/disconnect_window_mac.mm |
modified |
Files Changed
remoting/host/disconnect_window_mac.mmremoting/host/disconnect_window_mac.h
Patch
From b0fc1ed64ed654aca12eafe8b960dbc71e3c26b1 Mon Sep 17 00:00:00 2001
From: Joe Downing <joedow@google.com>
Date: Tue, 08 Sep 2026 10:27:47 -0700
Subject: [PATCH] [remoting] Use ElideEmail in macOS host disconnect dialog
Applies remoting::ElideEmail in DisconnectWindowMac on macOS so that
client emails are bounded in length while preserving the username prefix
and authentic domain suffix.
Also configures the NSTextField cell for middle truncation in single-line
mode so any layout elision explicitly displays an ellipsis, and sanitizes
directional formatting after elision.
Bug: 556237314
Change-Id: If1dcbb76dc3bfd2bffb8006c87227b48d97fe0e1
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8360556
Reviewed-by: Jamie Walch <jamiewalch@chromium.org>
Commit-Queue: Jamie Walch <jamiewalch@chromium.org>
Auto-Submit: Joe Downing <joedow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1693889}
---
diff --git a/remoting/host/disconnect_window_mac.h b/remoting/host/disconnect_window_mac.h
index 137124b3..9379eaa 100644
--- a/remoting/host/disconnect_window_mac.h
+++ b/remoting/host/disconnect_window_mac.h
@@ -16,7 +16,7 @@
@interface DisconnectWindowController : NSWindowController
- (instancetype)initWithCallback:(base::OnceClosure)disconnect_callback
- username:(const std::string&)username
+ email:(const std::string&)email
window:(NSWindow*)window;
- (void)initializeWindow;
- (void)stopSharing:(id)sender;
diff --git a/remoting/host/disconnect_window_mac.mm b/remoting/host/disconnect_window_mac.mm
index 67c03d4..bea5e09 100644
--- a/remoting/host/disconnect_window_mac.mm
+++ b/remoting/host/disconnect_window_mac.mm
@@ -18,6 +18,7 @@
#include "base/strings/utf_string_conversions.h"
#include "base/time/time.h"
#include "base/timer/timer.h"
+#include "remoting/base/email_utils.h"
#include "remoting/base/string_resources.h"
#include "remoting/host/client_session_control.h"
#include "remoting/host/host_window.h"
@@ -104,7 +105,7 @@
&ClientSessionControl::DisconnectSession, client_session_control,
ErrorCode::OK, "Disconnect button was clicked.", FROM_HERE);
std::string client_jid = client_session_control->client_jid();
- std::string username = client_jid.substr(0, client_jid.find('/'));
+ std::string email = client_jid.substr(0, client_jid.find('/'));
NSRect frame = NSMakeRect(0, 0, 466, 40);
DisconnectWindow* window =
@@ -115,7 +116,7 @@
window.releasedWhenClosed = NO;
window_controller_ = [[DisconnectWindowController alloc]
initWithCallback:std::move(disconnect_callback)
- username:username
+ email:email
window:window];
[window_controller_ initializeWindow];
[window_controller_ showWindow:nil];
@@ -130,7 +131,7 @@
@implementation DisconnectWindowController {
base::OnceClosure _disconnect_callback;
- std::u16string _username;
+ std::u16string _email;
base::OneShotTimer _cooldown_timer;
}
@@ -139,12 +140,17 @@
@synthesize disconnectButton = _disconnectButton;
- (instancetype)initWithCallback:(base::OnceClosure)disconnect_callback
- username:(const std::string&)username
+ email:(const std::string&)email
window:(NSWindow*)window {
self = [super initWithWindow:window];
if (self) {
_disconnect_callback = std::move(disconnect_callback);
- _username = base::UTF8ToUTF16(username);
+ std::u16string email_u16 = base::UTF8ToUTF16(email);
+ email_u16 = base::CollapseWhitespace(
+ email_u16, /*trim_sequences_with_line_breaks=*/true);
+ email_u16 = remoting::ElideEmail(email_u16);
+ base::i18n::SanitizeUserSuppliedString(&email_u16);
+ _email = std::move(email_u16);
[NSNotificationCenter.defaultCenter
addObserver:self
selector:@selector(onScreenParametersChanged:)
@@ -223,6 +229,8 @@
self.connectedToField.bezeled = NO;
self.connectedToField.editable = NO;
self.connectedToField.font = [NSFont systemFontOfSize:11];
+ self.connectedToField.cell.lineBreakMode = NSLineBreakByTruncatingMiddle;
+ self.connectedToField.cell.usesSingleLineMode = YES;
[self.window.contentView addSubview:self.connectedToField];
self.disconnectButton =
@@ -235,7 +243,7 @@
[self.window.contentView addSubview:self.disconnectButton];
self.connectedToField.stringValue =
- l10n_util::GetNSStringF(IDS_MESSAGE_SHARED, _username);
+ l10n_util::GetNSStringF(IDS_MESSAGE_SHARED, _email);
self.disconnectButton.title = l10n_util::GetNSString(IDS_STOP_SHARING_BUTTON);
// Resize the window dynamically based on the content.
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page