Chrome · Payments › AF
CVE-2026-106334
Info Disclosure in Payments (AF)
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
components/autofill/core/browser/data_model/payments/iban.cc
Patch
From a98723fe3673400ec3e6d23e3a9ab7b2b3130533 Mon Sep 17 00:00:00 2001
From: Olivia Saul <osaul@google.com>
Date: Wed, 09 Sep 2026 10:56:02 -0700
Subject: [PATCH] [AF] Swap to base::ToUpperASCII for uppercasing IBAN values/countries
Locales 'az' and 'tr' convert 'i' into 'İ' otherwise, which break
validation checks and country mapping checks.
Fixed: 556229780
Change-Id: I5677a52b144f1aef83c33a77306517b111e9f699
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8348703
Reviewed-by: Qihui Zhao <qihuizhao@google.com>
Commit-Queue: Qihui Zhao <qihuizhao@google.com>
Cr-Commit-Position: refs/heads/main@{#1694725}
---
diff --git a/components/autofill/core/browser/data_model/payments/iban.cc b/components/autofill/core/browser/data_model/payments/iban.cc
index 762ca76..ace1306f 100644
--- a/components/autofill/core/browser/data_model/payments/iban.cc
+++ b/components/autofill/core/browser/data_model/payments/iban.cc
@@ -17,7 +17,6 @@
#include "base/check_op.h"
#include "base/containers/fixed_flat_map.h"
#include "base/containers/map_util.h"
-#include "base/i18n/case_conversion.h"
#include "base/notreached.h"
#include "base/strings/strcat.h"
#include "base/strings/string_number_conversions.h"
@@ -132,7 +131,7 @@
// static
bool Iban::IsValid(std::u16string_view value) {
std::u16string iban_value = RemoveIbanSeparators(value);
- iban_value = base::i18n::ToUpper(iban_value);
+ iban_value = base::ToUpperASCII(iban_value);
// IBANs must be at least 15 digits and at most 33 digits long.
if (iban_value.length() < 15 || iban_value.length() > 33) {
return false;
@@ -159,7 +158,7 @@
// static
std::string Iban::GetCountryCode(const std::u16string& iban_value) {
CHECK(iban_value.length() >= 2);
- return base::UTF16ToUTF8(base::i18n::ToUpper(iban_value.substr(0, 2)));
+ return base::UTF16ToUTF8(base::ToUpperASCII(iban_value.substr(0, 2)));
}
// static
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page