Chrome · Page Info
CVE-2026-11275
Logic Error in Page Info
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
chrome/android/java/src/org/chromium/chrome/browser/page_info/PageInfoAboutThisSiteController.javachrome/android/javatests/src/org/chromium/chrome/browser/previewtab/PreviewTabTest.javachrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabMediator.javachrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabObserver.java
Patch
From d3fc0e9f1ba34fb766edbcc9b31b7c046e571f14 Mon Sep 17 00:00:00 2001
From: Christian Dullweber <dullweber@chromium.org>
Date: Mon, 13 Apr 2026 09:48:06 -0700
Subject: [PATCH] PageInfo: Set navigation params for AboutThisSite
Set isRendererInitiated and initiatorOrigin when moving navigations
from the AboutThisSite bottomsheet to a regular tab.
Bug: 501763121
Change-Id: Iac830a0f23a835bb11ee4f397be5735135725e3f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7748619
Reviewed-by: Jinsuk Kim <jinsukkim@chromium.org>
Commit-Queue: Christian Dullweber <dullweber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1613799}
---
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/page_info/PageInfoAboutThisSiteController.java b/chrome/android/java/src/org/chromium/chrome/browser/page_info/PageInfoAboutThisSiteController.java
index cdb3af3..3535761 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/page_info/PageInfoAboutThisSiteController.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/page_info/PageInfoAboutThisSiteController.java
@@ -34,10 +34,12 @@
import org.chromium.components.security_state.ConnectionSecurityLevel;
import org.chromium.content_public.browser.BrowserContextHandle;
import org.chromium.content_public.browser.LoadUrlParams;
+import org.chromium.content_public.browser.NavigationHandle;
import org.chromium.content_public.browser.WebContents;
import org.chromium.ui.base.PageTransition;
import org.chromium.ui.base.ViewUtils;
import org.chromium.url.GURL;
+import org.chromium.url.Origin;
import java.util.function.Supplier;
@@ -135,12 +137,16 @@
}
@Override
- public void onNavigationStarted(GURL clickedUrl) {
+ public void onNavigationStarted(NavigationHandle navigation) {
+ GURL clickedUrl = navigation.getUrl();
if (!clickedUrl.equals(originUrl)) {
assumeNonNull(mEphemeralTabCoordinator);
mEphemeralTabCoordinator.close();
mEphemeralTabCoordinator.removeObserver(this);
- openInNewTab(clickedUrl.getSpec());
+ openInNewTab(
+ clickedUrl.getSpec(),
+ navigation.isRendererInitiated(),
+ navigation.getInitiatorOrigin());
}
}
@@ -152,11 +158,17 @@
}
private void openInNewTab(String url) {
+ openInNewTab(url, false, null);
+ }
+
+ private void openInNewTab(
+ String url, boolean isRendererInitiated, @Nullable Origin initiatorOrigin) {
if (mTabCreator == null) return;
+ LoadUrlParams params = new LoadUrlParams(url, PageTransition.LINK);
+ params.setIsRendererInitiated(isRendererInitiated);
+ params.setInitiatorOrigin(initiatorOrigin);
mTabCreator.createNewTab(
- new LoadUrlParams(url, PageTransition.LINK),
- TabLaunchType.FROM_LINK,
- TabUtils.fromWebContents(mWebContents));
+ params, TabLaunchType.FROM_LINK, TabUtils.fromWebContents(mWebContents));
}
private void setupRow() {
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/previewtab/PreviewTabTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/previewtab/PreviewTabTest.java
index d2afa47f..e11611f 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/previewtab/PreviewTabTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/previewtab/PreviewTabTest.java
@@ -38,6 +38,7 @@
import org.chromium.components.browser_ui.bottomsheet.BottomSheetController;
import org.chromium.components.browser_ui.bottomsheet.BottomSheetController.SheetState;
import org.chromium.components.browser_ui.bottomsheet.BottomSheetTestSupport;
+import org.chromium.content_public.browser.NavigationHandle;
import org.chromium.content_public.browser.test.util.DOMUtils;
import org.chromium.url.GURL;
@@ -80,7 +81,7 @@
}
@Override
- public void onNavigationStarted(GURL clickedUrl) {
+ public void onNavigationStarted(NavigationHandle navigation) {
onNavigationStartedCallback.notifyCalled();
}
diff --git a/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabMediator.java b/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabMediator.java
index 4f76ce2..0c9e3b6 100644
--- a/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabMediator.java
+++ b/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabMediator.java
@@ -103,11 +103,11 @@
}
/** Notify observers on navigation start. */
- public void onNavigationStarted(GURL clickedUrl) {
+ public void onNavigationStarted(NavigationHandle navigation) {
RewindableIterator<EphemeralTabObserver> observersIterator =
mObservers.rewindableIterator();
while (observersIterator.hasNext()) {
- observersIterator.next().onNavigationStarted(clickedUrl);
+ observersIterator.next().onNavigationStarted(navigation);
}
}
@@ -192,7 +192,7 @@
return;
}
- onNavigationStarted(url);
+ onNavigationStarted(navigation);
mCurrentUrl = url;
assumeNonNull(mProfile);
diff --git a/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabObserver.java b/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabObserver.java
index 1cd3bcb..48223b0c 100644
--- a/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabObserver.java
+++ b/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabObserver.java
@@ -7,6 +7,7 @@
import android.view.ViewGroup;
import org.chromium.build.annotations.NullMarked;
+import org.chromium.content_public.browser.NavigationHandle;
import org.chromium.content_public.browser.WebContents;
import org.chromium.url.GURL;
@@ -15,7 +16,7 @@
public interface EphemeralTabObserver {
default void onToolbarCreated(ViewGroup toolbarView) {}
- default void onNavigationStarted(GURL clickedUrl) {}
+ default void onNavigationStarted(NavigationHandle navigation) {}
default void onNavigationFinished(GURL clickedUrl) {}
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page