Low chrome Info Disclosure 🔧 Commit mapped

Overview

Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInformation leak in Payments
DescriptionInformation leak in Payments
ComponentPayments
Sub-componentAF
Bug ClassInfo Disclosure
Tracker556229780
Fix commita98723fe3673 (chromium/src) +2/-3
CISA KEVNot listed
CreditedGoogle
Disclosed2026-10-06

Files Changed

  • components/autofill/core/browser/data_model/payments/iban.cc
From a98723fe3673400ec3e6d23e3a9ab7b2b3130533 Mon Sep 17 00:00:00 2001
From: Olivia Saul <osaul@google.com>
Date: Wed, 09 Sep 2026 10:56:02 -0700
Subject: [PATCH] [AF] Swap to base::ToUpperASCII for uppercasing IBAN values/countries

Locales 'az' and 'tr' convert 'i' into 'İ' otherwise, which break
validation checks and country mapping checks.

Fixed: 556229780
Change-Id: I5677a52b144f1aef83c33a77306517b111e9f699
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8348703
Reviewed-by: Qihui Zhao <qihuizhao@google.com>
Commit-Queue: Qihui Zhao <qihuizhao@google.com>
Cr-Commit-Position: refs/heads/main@{#1694725}
---
diff --git a/components/autofill/core/browser/data_model/payments/iban.cc b/components/autofill/core/browser/data_model/payments/iban.cc
index 762ca76..ace1306f 100644
--- a/components/autofill/core/browser/data_model/payments/iban.cc
+++ b/components/autofill/core/browser/data_model/payments/iban.cc
@@ -17,7 +17,6 @@
 #include "base/check_op.h"
 #include "base/containers/fixed_flat_map.h"
 #include "base/containers/map_util.h"
-#include "base/i18n/case_conversion.h"
 #include "base/notreached.h"
 #include "base/strings/strcat.h"
 #include "base/strings/string_number_conversions.h"
@@ -132,7 +131,7 @@
 // static
 bool Iban::IsValid(std::u16string_view value) {
   std::u16string iban_value = RemoveIbanSeparators(value);
-  iban_value = base::i18n::ToUpper(iban_value);
+  iban_value = base::ToUpperASCII(iban_value);
   // IBANs must be at least 15 digits and at most 33 digits long.
   if (iban_value.length() < 15 || iban_value.length() > 33) {
     return false;
@@ -159,7 +158,7 @@
 // static
 std::string Iban::GetCountryCode(const std::u16string& iban_value) {
   CHECK(iban_value.length() >= 2);
-  return base::UTF16ToUTF8(base::i18n::ToUpper(iban_value.substr(0, 2)));
+  return base::UTF16ToUTF8(base::ToUpperASCII(iban_value.substr(0, 2)));
 }
 
 // static
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.