Low CVSS 6.5 chrome Policy Bypass 🔧 Commit mapped

Overview

Low
Severity
6.5
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInsufficient policy enforcement in Page Info
DescriptionInsufficient policy enforcement in Page Info
ComponentPage Info
Sub-componentPageInfo
Bug ClassPolicy Bypass
Tracker501763121
Fix commitd3fc0e9f1ba3 (chromium/src) +24/-10
CWECWE-284
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CISA KEVNot listed
CreditedGoogle
Reported2026-04-11 (per vendor advisory)
Fix landed2026-04-13 (public git)
Disclosed2026-06-02
Patch gap50 days — fix public in source before the advisory

Files Changed

  • chrome/android/java/src/org/chromium/chrome/browser/page_info/PageInfoAboutThisSiteController.java
  • chrome/android/javatests/src/org/chromium/chrome/browser/previewtab/PreviewTabTest.java
  • chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabMediator.java
  • chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabObserver.java
From d3fc0e9f1ba34fb766edbcc9b31b7c046e571f14 Mon Sep 17 00:00:00 2001
From: Christian Dullweber <dullweber@chromium.org>
Date: Mon, 13 Apr 2026 09:48:06 -0700
Subject: [PATCH] PageInfo: Set navigation params for AboutThisSite

Set isRendererInitiated and initiatorOrigin when moving navigations
from the AboutThisSite bottomsheet to a regular tab.

Bug: 501763121
Change-Id: Iac830a0f23a835bb11ee4f397be5735135725e3f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7748619
Reviewed-by: Jinsuk Kim <jinsukkim@chromium.org>
Commit-Queue: Christian Dullweber <dullweber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1613799}
---

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/page_info/PageInfoAboutThisSiteController.java b/chrome/android/java/src/org/chromium/chrome/browser/page_info/PageInfoAboutThisSiteController.java
index cdb3af3..3535761 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/page_info/PageInfoAboutThisSiteController.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/page_info/PageInfoAboutThisSiteController.java
@@ -34,10 +34,12 @@
 import org.chromium.components.security_state.ConnectionSecurityLevel;
 import org.chromium.content_public.browser.BrowserContextHandle;
 import org.chromium.content_public.browser.LoadUrlParams;
+import org.chromium.content_public.browser.NavigationHandle;
 import org.chromium.content_public.browser.WebContents;
 import org.chromium.ui.base.PageTransition;
 import org.chromium.ui.base.ViewUtils;
 import org.chromium.url.GURL;
+import org.chromium.url.Origin;
 
 import java.util.function.Supplier;
 
@@ -135,12 +137,16 @@
                     }
 
                     @Override
-                    public void onNavigationStarted(GURL clickedUrl) {
+                    public void onNavigationStarted(NavigationHandle navigation) {
+                        GURL clickedUrl = navigation.getUrl();
                         if (!clickedUrl.equals(originUrl)) {
                             assumeNonNull(mEphemeralTabCoordinator);
                             mEphemeralTabCoordinator.close();
                             mEphemeralTabCoordinator.removeObserver(this);
-                            openInNewTab(clickedUrl.getSpec());
+                            openInNewTab(
+                                    clickedUrl.getSpec(),
+                                    navigation.isRendererInitiated(),
+                                    navigation.getInitiatorOrigin());
                         }
                     }
 
@@ -152,11 +158,17 @@
     }
 
     private void openInNewTab(String url) {
+        openInNewTab(url, false, null);
+    }
+
+    private void openInNewTab(
+            String url, boolean isRendererInitiated, @Nullable Origin initiatorOrigin) {
         if (mTabCreator == null) return;
+        LoadUrlParams params = new LoadUrlParams(url, PageTransition.LINK);
+        params.setIsRendererInitiated(isRendererInitiated);
+        params.setInitiatorOrigin(initiatorOrigin);
         mTabCreator.createNewTab(
-                new LoadUrlParams(url, PageTransition.LINK),
-                TabLaunchType.FROM_LINK,
-                TabUtils.fromWebContents(mWebContents));
+                params, TabLaunchType.FROM_LINK, TabUtils.fromWebContents(mWebContents));
     }
 
     private void setupRow() {
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/previewtab/PreviewTabTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/previewtab/PreviewTabTest.java
index d2afa47f..e11611f 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/previewtab/PreviewTabTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/previewtab/PreviewTabTest.java
@@ -38,6 +38,7 @@
 import org.chromium.components.browser_ui.bottomsheet.BottomSheetController;
 import org.chromium.components.browser_ui.bottomsheet.BottomSheetController.SheetState;
 import org.chromium.components.browser_ui.bottomsheet.BottomSheetTestSupport;
+import org.chromium.content_public.browser.NavigationHandle;
 import org.chromium.content_public.browser.test.util.DOMUtils;
 import org.chromium.url.GURL;
 
@@ -80,7 +81,7 @@
         }
 
         @Override
-        public void onNavigationStarted(GURL clickedUrl) {
+        public void onNavigationStarted(NavigationHandle navigation) {
             onNavigationStartedCallback.notifyCalled();
         }
 
diff --git a/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabMediator.java b/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabMediator.java
index 4f76ce2..0c9e3b6 100644
--- a/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabMediator.java
+++ b/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabMediator.java
@@ -103,11 +103,11 @@
     }
 
     /** Notify observers on navigation start. */
-    public void onNavigationStarted(GURL clickedUrl) {
+    public void onNavigationStarted(NavigationHandle navigation) {
         RewindableIterator<EphemeralTabObserver> observersIterator =
                 mObservers.rewindableIterator();
         while (observersIterator.hasNext()) {
-            observersIterator.next().onNavigationStarted(clickedUrl);
+            observersIterator.next().onNavigationStarted(navigation);
         }
     }
 
@@ -192,7 +192,7 @@
                                 return;
                             }
 
-                            onNavigationStarted(url);
+                            onNavigationStarted(navigation);
 
                             mCurrentUrl = url;
                             assumeNonNull(mProfile);
diff --git a/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabObserver.java b/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabObserver.java
index 1cd3bcb..48223b0c 100644
--- a/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabObserver.java
+++ b/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabObserver.java
@@ -7,6 +7,7 @@
 import android.view.ViewGroup;
 
 import org.chromium.build.annotations.NullMarked;
+import org.chromium.content_public.browser.NavigationHandle;
 import org.chromium.content_public.browser.WebContents;
 import org.chromium.url.GURL;
 
@@ -15,7 +16,7 @@
 public interface EphemeralTabObserver {
     default void onToolbarCreated(ViewGroup toolbarView) {}
 
-    default void onNavigationStarted(GURL clickedUrl) {}
+    default void onNavigationStarted(NavigationHandle navigation) {}
 
     default void onNavigationFinished(GURL clickedUrl) {}
 
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.