Low chrome Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInsufficient policy enforcement in Page Info
DescriptionInsufficient policy enforcement in Page Info
ComponentPage Info
Bug ClassLogic Error
Tracker501763121
Fix commitd3fc0e9f1ba3 (chromium/src) +24/-10
CISA KEVNot listed
CreditedGoogle
Disclosed2026-06-02

Files Changed

  • chrome/android/java/src/org/chromium/chrome/browser/page_info/PageInfoAboutThisSiteController.java
  • chrome/android/javatests/src/org/chromium/chrome/browser/previewtab/PreviewTabTest.java
  • chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabMediator.java
  • chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabObserver.java
From d3fc0e9f1ba34fb766edbcc9b31b7c046e571f14 Mon Sep 17 00:00:00 2001
From: Christian Dullweber <dullweber@chromium.org>
Date: Mon, 13 Apr 2026 09:48:06 -0700
Subject: [PATCH] PageInfo: Set navigation params for AboutThisSite

Set isRendererInitiated and initiatorOrigin when moving navigations
from the AboutThisSite bottomsheet to a regular tab.

Bug: 501763121
Change-Id: Iac830a0f23a835bb11ee4f397be5735135725e3f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7748619
Reviewed-by: Jinsuk Kim <jinsukkim@chromium.org>
Commit-Queue: Christian Dullweber <dullweber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1613799}
---

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/page_info/PageInfoAboutThisSiteController.java b/chrome/android/java/src/org/chromium/chrome/browser/page_info/PageInfoAboutThisSiteController.java
index cdb3af3..3535761 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/page_info/PageInfoAboutThisSiteController.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/page_info/PageInfoAboutThisSiteController.java
@@ -34,10 +34,12 @@
 import org.chromium.components.security_state.ConnectionSecurityLevel;
 import org.chromium.content_public.browser.BrowserContextHandle;
 import org.chromium.content_public.browser.LoadUrlParams;
+import org.chromium.content_public.browser.NavigationHandle;
 import org.chromium.content_public.browser.WebContents;
 import org.chromium.ui.base.PageTransition;
 import org.chromium.ui.base.ViewUtils;
 import org.chromium.url.GURL;
+import org.chromium.url.Origin;
 
 import java.util.function.Supplier;
 
@@ -135,12 +137,16 @@
                     }
 
                     @Override
-                    public void onNavigationStarted(GURL clickedUrl) {
+                    public void onNavigationStarted(NavigationHandle navigation) {
+                        GURL clickedUrl = navigation.getUrl();
                         if (!clickedUrl.equals(originUrl)) {
                             assumeNonNull(mEphemeralTabCoordinator);
                             mEphemeralTabCoordinator.close();
                             mEphemeralTabCoordinator.removeObserver(this);
-                            openInNewTab(clickedUrl.getSpec());
+                            openInNewTab(
+                                    clickedUrl.getSpec(),
+                                    navigation.isRendererInitiated(),
+                                    navigation.getInitiatorOrigin());
                         }
                     }
 
@@ -152,11 +158,17 @@
     }
 
     private void openInNewTab(String url) {
+        openInNewTab(url, false, null);
+    }
+
+    private void openInNewTab(
+            String url, boolean isRendererInitiated, @Nullable Origin initiatorOrigin) {
         if (mTabCreator == null) return;
+        LoadUrlParams params = new LoadUrlParams(url, PageTransition.LINK);
+        params.setIsRendererInitiated(isRendererInitiated);
+        params.setInitiatorOrigin(initiatorOrigin);
         mTabCreator.createNewTab(
-                new LoadUrlParams(url, PageTransition.LINK),
-                TabLaunchType.FROM_LINK,
-                TabUtils.fromWebContents(mWebContents));
+                params, TabLaunchType.FROM_LINK, TabUtils.fromWebContents(mWebContents));
     }
 
     private void setupRow() {
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/previewtab/PreviewTabTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/previewtab/PreviewTabTest.java
index d2afa47f..e11611f 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/previewtab/PreviewTabTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/previewtab/PreviewTabTest.java
@@ -38,6 +38,7 @@
 import org.chromium.components.browser_ui.bottomsheet.BottomSheetController;
 import org.chromium.components.browser_ui.bottomsheet.BottomSheetController.SheetState;
 import org.chromium.components.browser_ui.bottomsheet.BottomSheetTestSupport;
+import org.chromium.content_public.browser.NavigationHandle;
 import org.chromium.content_public.browser.test.util.DOMUtils;
 import org.chromium.url.GURL;
 
@@ -80,7 +81,7 @@
         }
 
         @Override
-        public void onNavigationStarted(GURL clickedUrl) {
+        public void onNavigationStarted(NavigationHandle navigation) {
             onNavigationStartedCallback.notifyCalled();
         }
 
diff --git a/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabMediator.java b/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabMediator.java
index 4f76ce2..0c9e3b6 100644
--- a/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabMediator.java
+++ b/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabMediator.java
@@ -103,11 +103,11 @@
     }
 
     /** Notify observers on navigation start. */
-    public void onNavigationStarted(GURL clickedUrl) {
+    public void onNavigationStarted(NavigationHandle navigation) {
         RewindableIterator<EphemeralTabObserver> observersIterator =
                 mObservers.rewindableIterator();
         while (observersIterator.hasNext()) {
-            observersIterator.next().onNavigationStarted(clickedUrl);
+            observersIterator.next().onNavigationStarted(navigation);
         }
     }
 
@@ -192,7 +192,7 @@
                                 return;
                             }
 
-                            onNavigationStarted(url);
+                            onNavigationStarted(navigation);
 
                             mCurrentUrl = url;
                             assumeNonNull(mProfile);
diff --git a/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabObserver.java b/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabObserver.java
index 1cd3bcb..48223b0c 100644
--- a/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabObserver.java
+++ b/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabObserver.java
@@ -7,6 +7,7 @@
 import android.view.ViewGroup;
 
 import org.chromium.build.annotations.NullMarked;
+import org.chromium.content_public.browser.NavigationHandle;
 import org.chromium.content_public.browser.WebContents;
 import org.chromium.url.GURL;
 
@@ -15,7 +16,7 @@
 public interface EphemeralTabObserver {
     default void onToolbarCreated(ViewGroup toolbarView) {}
 
-    default void onNavigationStarted(GURL clickedUrl) {}
+    default void onNavigationStarted(NavigationHandle navigation) {}
 
     default void onNavigationFinished(GURL clickedUrl) {}
 
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.