Chrome · Tab Strip
CVE-2026-11222
Logic Error in Tab Strip
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifchrome/browser/ui/views/tabs/hovercard/hover_card_anchor_target.cc |
modified |
Files Changed
AUTHORSchrome/browser/ui/views/frame/multi_contents_view_mini_toolbar.ccchrome/browser/ui/views/tabs/hovercard/hover_card_anchor_target.cc
Patch
From 4565bd201d41b752c3a5df16298d8d0470e75dbd Mon Sep 17 00:00:00 2001
From: Hafiizh <sas.kunz@gmail.com>
Date: Mon, 04 May 2026 09:20:30 -0700
Subject: [PATCH] hovercard: Fix hover card domain label for about:blank tabs
Previously, the hover card domain label for about:blank tabs was not
handled explicitly, which could cause incorrect domain text to be
displayed. This patch adds an explicit check for about:blank URLs and
sets the domain label to url::kAboutBlankURL16 accordingly.
Bug: 458442542
Change-Id: Ib34c977395919b5c6e7b89cc424867922452aa0f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7761368
Commit-Queue: Alison Gale <agale@chromium.org>
Auto-Submit: Bug Bounty Channel <sas.kunz@gmail.com>
Reviewed-by: Foromo Daniel Soromou <koretadaniel@chromium.org>
Reviewed-by: Alison Gale <agale@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1624740}
---
diff --git a/AUTHORS b/AUTHORS
index ef9340c..3649262 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -541,6 +541,7 @@
Habib Virji <habib.virji@samsung.com>
Haeun Kim <ggrace.kim93@gmail.com>
Haeun Kim <haeungun@gmail.com>
+Hafiizh <sas.kunz@gmail.com>
Haitao Feng <haitao.feng@intel.com>
Halley Zhao <halley.zhao@intel.com>
Halton Huo <halton.huo@gmail.com>
diff --git a/chrome/browser/ui/views/frame/multi_contents_view_mini_toolbar.cc b/chrome/browser/ui/views/frame/multi_contents_view_mini_toolbar.cc
index c2fc4be7..7c4f533d 100644
--- a/chrome/browser/ui/views/frame/multi_contents_view_mini_toolbar.cc
+++ b/chrome/browser/ui/views/frame/multi_contents_view_mini_toolbar.cc
@@ -49,6 +49,7 @@
#include "ui/views/layout/flex_layout.h"
#include "ui/views/view.h"
#include "ui/views/view_utils.h"
+#include "url/url_constants.h"
namespace {
constexpr int kMiniToolbarContentPadding = 4;
@@ -190,6 +191,8 @@
domain = l10n_util::GetStringUTF16(IDS_HOVER_CARD_BLOB_URL_SOURCE);
} else if (domain_url.SchemeIs(url::kViewSourceScheme)) {
domain = l10n_util::GetStringUTF16(IDS_HOVER_CARD_VIEW_SOURCE_URL_SOURCE);
+ } else if (domain_url.IsAboutBlank()) {
+ domain = url::kAboutBlankURL16;
} else if (tab_ui_helper->ShouldDisplayURL()) {
domain = url_formatter::FormatUrl(
domain_url,
diff --git a/chrome/browser/ui/views/tabs/hovercard/hover_card_anchor_target.cc b/chrome/browser/ui/views/tabs/hovercard/hover_card_anchor_target.cc
index 334cd58..70f7cd00 100644
--- a/chrome/browser/ui/views/tabs/hovercard/hover_card_anchor_target.cc
+++ b/chrome/browser/ui/views/tabs/hovercard/hover_card_anchor_target.cc
@@ -21,6 +21,7 @@
#include "ui/base/interaction/element_tracker.h"
#include "ui/base/l10n/l10n_util.h"
#include "ui/views/view.h"
+#include "url/url_constants.h"
namespace {
@@ -103,6 +104,8 @@
domain = l10n_util::GetStringUTF16(IDS_HOVER_CARD_BLOB_URL_SOURCE);
} else if (domain_url.SchemeIs(url::kViewSourceScheme)) {
domain = l10n_util::GetStringUTF16(IDS_HOVER_CARD_VIEW_SOURCE_URL_SOURCE);
+ } else if (domain_url.IsAboutBlank()) {
+ domain = url::kAboutBlankURL16;
} else {
if (tab_data.should_display_url) {
is_domain_url = true;
Loading diff…
Original Bug Report
reported by sa...@gmail.com
Popup window tab doesn't show the origin correctly
VULNERABILITY DETAILS
This vulnerability is similar to this: https://issues.chromium.org/issues/40075024, https://issues.chromium.org/issues/448421954
but in this bug Popup window tab doesn’t show correctly. in the popup window it shows subdomain.paypal.auth.docs.google.com which should be about:blank
VERSION Chrome Version 144.0.7513.0 (Official Build) canary (64-bit) Operating System: Windows 11
REPRODUCTION CASE
- Open tabdomain.html
- Click on button in tabdomain.html
- Hover over the tab
References
On This Page