Chrome · PDF › PDF
CVE-2026-110147
UAF in PDF (PDF)
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
components/pdf/renderer/pdf_view_web_plugin_client.cc
Patch
From e0c230bb186080c81c9e6b36a08deea184d15c59 Mon Sep 17 00:00:00 2001
From: Lei Zhang <thestig@chromium.org>
Date: Tue, 06 Oct 2026 14:48:37 -0700
Subject: [PATCH] [PDF] Simplify PdfViewWebPluginClient::TextSelectionChanged()
This reverts crrev.com/906945, which added a focus frame call. The
motivation in that CL is to make PDFExtensionJSTest.BasicPlugin pass,
but the test still passes now without it. In the meanwhile, the focus
event is being abused, so just get rid of it.
Bug: 40192026, 570050928
Change-Id: Iadfc44ae381b42e9e29f2c83f2291bff3f9704c9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8524410
Reviewed-by: April Kallmeyer <ask@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1712741}
---
diff --git a/components/pdf/renderer/pdf_view_web_plugin_client.cc b/components/pdf/renderer/pdf_view_web_plugin_client.cc
index 1939bc0..685bea6 100644
--- a/components/pdf/renderer/pdf_view_web_plugin_client.cc
+++ b/components/pdf/renderer/pdf_view_web_plugin_client.cc
@@ -32,7 +32,6 @@
#include "third_party/blink/public/web/web_plugin_container.h"
#include "third_party/blink/public/web/web_script_forbidden_scope.h"
#include "third_party/blink/public/web/web_serialized_script_value.h"
-#include "third_party/blink/public/web/web_view.h"
#include "third_party/blink/public/web/web_widget.h"
#include "ui/accessibility/ax_features.mojom-features.h"
#include "ui/display/screen_info.h"
@@ -193,14 +192,7 @@
const blink::WebString& selection_text,
uint32_t offset,
const gfx::Range& range) {
- // Focus the plugin's containing frame before changing the text selection.
- // TODO(crbug.com/40192026): Would it make more sense not to change the text
- // selection at all in this case? Maybe we only have this problem because we
- // support a "selectAll" message.
- blink::WebLocalFrame* frame = GetFrame();
- frame->View()->SetFocusedFrame(frame);
-
- frame->TextSelectionChanged(selection_text, offset, range);
+ GetFrame()->TextSelectionChanged(selection_text, offset, range);
}
std::unique_ptr<blink::WebAssociatedURLLoader>
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page