From af23e2707ce5e60362d214c762537d811101cb2b Mon Sep 17 00:00:00 2001
From: Jingping Sun <jings@microsoft.com>
Date: Tue, 08 Sep 2026 07:29:13 -0700
Subject: [PATCH] Prevent fullscreen while Android HTTP auth prompts are active

Android HTTP authentication prompts can remain active while content
re-enters fullscreen, hiding browser origin UI during credential entry.

Drop content fullscreen before showing the prompt and retain the
WebContents security fullscreen blocker for the login handler lifetime.

Bug: 450323465
Change-Id: I7e6320cb59e2ca12ebcd335adf331a1e0a92f210
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8361492
Reviewed-by: Andrew Grieve <agrieve@chromium.org>
Commit-Queue: Jingping Sun <jings@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#1693773}
---
diff --git a/chrome/browser/ui/android/login_handler_android.cc b/chrome/browser/ui/android/login_handler_android.cc
index 89736fc..53585d29 100644
--- a/chrome/browser/ui/android/login_handler_android.cc
+++ b/chrome/browser/ui/android/login_handler_android.cc
@@ -8,6 +8,7 @@
 #include <optional>
 #include <string>
 
+#include "base/functional/callback_helpers.h"
 #include "base/logging.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/android/tab_android.h"
@@ -17,6 +18,7 @@
 #include "net/base/auth.h"
 #include "ui/android/view_android.h"
 #include "ui/android/window_android.h"
+#include "ui/display/types/display_constants.h"
 #include "url/gurl.h"
 
 using content::BrowserThread;
@@ -56,6 +58,13 @@
     ui::WindowAndroid* window = view ? view->GetWindowAndroid() : nullptr;
     // Notify WindowAndroid that HTTP authentication is required.
     if (tab && window) {
+      auto blocker = contents->ForSecurityDropFullscreen(
+          /*display_id=*/display::kInvalidDisplayId);
+      if (!blocker) {
+        return false;
+      }
+      fullscreen_blocker_ = std::move(*blocker);
+
       chrome_http_auth_handler_ = std::make_unique<ChromeHttpAuthHandler>(
           authority, explanation, auth_info().challenger.GetURL(),
           login_model_data);
@@ -77,6 +86,7 @@
   }
 
  private:
+  base::ScopedClosureRunner fullscreen_blocker_;
   std::unique_ptr<ChromeHttpAuthHandler> chrome_http_auth_handler_;
 };