Low chrome Spoofing 🔧 Commit mapped

Overview

Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactUI misrepresentation in Chromoting
DescriptionUI misrepresentation in Chromoting
ComponentChromoting
Sub-componentRemoting
Bug ClassSpoofing
Tracker556259957
Fix commitde8733b6cba6 (chromium/src) +17/-0
CISA KEVNot listed
CreditedGoogle
Disclosed2026-10-06

Files Changed

  • remoting/host/disconnect_window_win.cc
  • remoting/host/win/core.rc.jinja2
From de8733b6cba641ad3c1072f13daed3a5a66e2068 Mon Sep 17 00:00:00 2001
From: Joe Downing <joedow@google.com>
Date: Tue, 08 Sep 2026 13:42:28 -0700
Subject: [PATCH] [remoting] Document and assert disconnect window virtual desktop invariant

Windows Desktop Window Manager (DWM) excludes unowned WS_EX_TOOLWINDOW
windows (without WS_EX_APPWINDOW) from Shell Virtual Desktop management,
ensuring the CRD disconnect indicator dialog is never cloaked
(DWMWA_CLOAKED) across virtual desktop transitions (e.g., Win+Ctrl+D).

This change adds architectural documentation to core.rc.jinja2 and
disconnect_window_win.cc explaining this invariant, and adds DCHECKs in
DisconnectWindowWin::BeginDialog() to guard against regressions.

TAG=agy
CONV=a52bf02c-a579-4a74-97f6-2174833e8215

Fixed: 556259957
Change-Id: I77bc409463548da3187166adecfb62401497ef14
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8371824
Commit-Queue: Joe Downing <joedow@chromium.org>
Reviewed-by: Jamie Walch <jamiewalch@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1694027}
---
diff --git a/remoting/host/disconnect_window_win.cc b/remoting/host/disconnect_window_win.cc
index 55e2d380..0b5d593 100644
--- a/remoting/host/disconnect_window_win.cc
+++ b/remoting/host/disconnect_window_win.cc
@@ -330,6 +330,14 @@
     return false;
   }
 
+  // IDD_DISCONNECT must have WS_EX_TOOLWINDOW and must NOT have
+  // WS_EX_APPWINDOW. Unowned WS_EX_TOOLWINDOW popups are excluded from Windows
+  // Shell Virtual Desktop management, ensuring Desktop Window Manager (DWM)
+  // never cloaks the disconnect window when switching virtual desktops
+  // (Win+Ctrl+D). See crbug.com/556259957.
+  DCHECK(GetWindowLong(hwnd_, GWL_EXSTYLE) & WS_EX_TOOLWINDOW);
+  DCHECK(!(GetWindowLong(hwnd_, GWL_EXSTYLE) & WS_EX_APPWINDOW));
+
   // Set up handler for Ctrl-Alt-Esc shortcut.
   if (!has_hotkey_ && RegisterHotKey(hwnd_, DISCONNECT_HOTKEY_ID,
                                      MOD_ALT | MOD_CONTROL, VK_ESCAPE)) {
diff --git a/remoting/host/win/core.rc.jinja2 b/remoting/host/win/core.rc.jinja2
index eed5835a..334f445 100644
--- a/remoting/host/win/core.rc.jinja2
+++ b/remoting/host/win/core.rc.jinja2
@@ -53,6 +53,15 @@
 
 #endif  // (REMOTING_HOST_BINARY == BINARY_CORE)
 
+// Note on dialog extended styles:
+// WS_EX_TOOLWINDOW is required so that Desktop Window Manager (DWM) treats
+// this unowned dialog as a tool window and excludes it from Windows Shell
+// Virtual Desktop management. This ensures the indicator dialog is never
+// cloaked (DWMWA_CLOAKED) and remains visible and interactive across all
+// virtual desktops (e.g. when Win+Ctrl+D is pressed).
+// WS_EX_APPWINDOW must NOT be added here, as it would force the window into
+// virtual desktop tracking and cause it to be cloaked when switching desktops.
+// See crbug.com/556259957.
 IDD_DISCONNECT DIALOGEX 0, 0, 145, 24
 STYLE DS_SETFONT | WS_POPUP
 EXSTYLE WS_EX_TOPMOST | WS_EX_TOOLWINDOW {% if IsRtlLanguage(lang) %} | WS_EX_LAYOUTRTL | WS_EX_RTLREADING {% endif %}
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.