Medium chrome UAF 🔧 Commit mapped

Overview

Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactUse after free in Glic
DescriptionUse after free in Glic
ComponentGlic
Sub-componentGlic
Bug ClassUAF
Tracker505994167
Fix commitc2ad908c4f92 (chromium/src) +7/-752
CISA KEVNot listed
CreditedGoogle
Disclosed2026-10-20

Changed Functions

FunctionChangeNotes
GlicScreenshotCapturer
chrome/browser/glic/host/context/glic_screenshot_capturer.h
modified
if
chrome/browser/glic/host/context/glic_screenshot_capturer_android.cc
modified
GlicScreenshotCapturerAndroid
chrome/browser/glic/host/context/glic_screenshot_capturer_android.h
modified
if
chrome/browser/glic/host/context/glic_screenshot_capturer_impl.cc
modified
BindRepeating
chrome/browser/glic/host/context/glic_screenshot_capturer_impl.cc
modified

Files Changed

  • chrome/browser/glic/host/host.cc
  • chrome/test/data/webui/glic/browser_tests/glic_api_browsertest.ts
  • chrome/common/chrome_features.h
  • chrome/browser/glic/public/glic_api_metrics.cc
  • chrome/browser/resources/glic/glic_api/glic_api.ts
  • chrome/browser/glic/host/context/glic_screenshot_capturer_impl.h
  • chrome/browser/glic/widget/glic_side_panel_ui_android.h
  • chrome/browser/glic/widget/glic_side_panel_ui_android.cc
  • tools/metrics/histograms/metadata/glic/histograms.xml
  • chrome/browser/glic/host/context/glic_screenshot_capturer.h
  • chrome/browser/glic/host/glic_web_client_handler.cc
  • chrome/app/glic_strings.grdp
  • chrome/browser/glic/host/context/glic_screenshot_capturer_unittest.cc
  • chrome/browser/glic/widget/glic_floating_ui.h
  • tools/metrics/histograms/metadata/glic/enums.xml
  • chrome/browser/glic/host/context/glic_screenshot_capturer_android.cc
  • chrome/test/data/webui/glic/test_client/page_element_types.ts
  • chrome/test/data/webui/glic/test_client/test_client.ts
  • chrome/browser/glic/widget/glic_side_panel_ui.h
  • chrome/test/data/webui/glic/test_client/index.html
  • chrome/browser/resources/glic/glic_api_impl/client/glic_api_client.ts
  • chrome/browser/resources/glic/glic_api_impl/host/host_from_client.ts
  • chrome/common/chrome_features.cc
  • chrome/browser/glic/widget/glic_side_panel_ui.cc
  • chrome/browser/glic/host/host.h
  • chrome/browser/glic/widget/glic_floating_ui.cc
  • chrome/browser/resources/glic/glic_api/glic_api_generated.ts
  • chrome/browser/resources/glic/glic_api_impl/request_types.ts
  • chrome/browser/glic/host/glic.mojom
  • chrome/browser/glic/host/glic_api_browsertest.cc
  • chrome/browser/glic/host/context/glic_screenshot_capturer.cc
  • chrome/browser/glic/host/context/glic_screenshot_capturer_impl.cc
  • chrome/browser/glic/BUILD.gn
  • chrome/browser/glic/host/context/glic_screenshot_capturer_android.h
  • chrome/browser/glic/public/glic_api_metrics.h
  • chrome/app/glic_strings_grdp/IDS_GLIC_SCREEN_PICKER_REQUESTER.png.sha1
From c2ad908c4f9277743a4cda2dcab516c3f46c8477 Mon Sep 17 00:00:00 2001
From: Nick Birnie <birnie@google.com>
Date: Wed, 16 Sep 2026 16:12:35 -0700
Subject: [PATCH] [glic] Remove unused CaptureScreenshot API and capturer implementation

The CaptureScreenshot Mojo API and its backing GlicScreenshotCapturer
implementation are unused and have no active consumers. Remove the dead
code and associated host/embedder plumbing.

Companion WebClinet CL: http://shortn/_yNP2FhVb6M
No Traffic: https://screenshot-v2.corp.google.com/16aks1ls4dd18

Bug: 505994167
Change-Id: I2dad76df88f23056e2c94e99d6b5612004b40124
No-Stable-Mojom-Checks: true
Bypass-Glic-Api-Compatibility-Check: CaptureScreenshot API was dead and unused with no consumers.
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8299392
Commit-Queue: Nick Birnie <birnie@google.com>
Reviewed-by: Fred Shih <ffred@chromium.org>
Reviewed-by: Dan H <harringtond@chromium.org>
Auto-Submit: Nick Birnie <birnie@google.com>
Cr-Commit-Position: refs/heads/main@{#1699334}
---
diff --git a/chrome/app/glic_strings.grdp b/chrome/app/glic_strings.grdp
index c600878..22ca1ea 100644
--- a/chrome/app/glic_strings.grdp
+++ b/chrome/app/glic_strings.grdp
@@ -449,9 +449,6 @@
   </message>
 
    <!-- Screenpicker Menu String -->
-  <message name="IDS_GLIC_SCREEN_PICKER_REQUESTER" desc="Text shown on screen picker dialog that indicates the requesting source is Gemini.">
-    Gemini
-  </message>
   <message name="IDS_GLIC_SCREEN_PICKER_HEADLINE" desc="Title of the Gemini screen picker dialog used for specifying which screen to capture.">
     Choose a screen to capture
   </message>
diff --git a/chrome/app/glic_strings_grdp/IDS_GLIC_SCREEN_PICKER_REQUESTER.png.sha1 b/chrome/app/glic_strings_grdp/IDS_GLIC_SCREEN_PICKER_REQUESTER.png.sha1
deleted file mode 100644
index 2850b16..0000000
--- a/chrome/app/glic_strings_grdp/IDS_GLIC_SCREEN_PICKER_REQUESTER.png.sha1
+++ /dev/null
@@ -1 +0,0 @@
-1bff5b774725576e58cf31ac3b4cfac9708db9e7
\ No newline at end of file
diff --git a/chrome/browser/glic/host/context/glic_screenshot_capturer.cc b/chrome/browser/glic/host/context/glic_screenshot_capturer.cc
deleted file mode 100644
index 420b138..0000000
--- a/chrome/browser/glic/host/context/glic_screenshot_capturer.cc
+++ /dev/null
@@ -1,26 +0,0 @@
-// Copyright 2026 The Chromium Authors
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chrome/browser/glic/host/context/glic_screenshot_capturer.h"
-
-#include "build/build_config.h"
-
-#if BUILDFLAG(IS_ANDROID)
-#include "chrome/browser/glic/host/context/glic_screenshot_capturer_android.h"
-#else
-#include "chrome/browser/glic/host/context/glic_screenshot_capturer_impl.h"
-#endif
-
-namespace glic {
-
-// static
-std::unique_ptr<GlicScreenshotCapturer> GlicScreenshotCapturer::Create() {
-#if BUILDFLAG(IS_ANDROID)
-  return std::make_unique<GlicScreenshotCapturerAndroid>();
-#else
-  return std::make_unique<GlicScreenshotCapturerImpl>();
-#endif
-}
-
-}  // namespace glic
diff --git a/chrome/browser/glic/host/context/glic_screenshot_capturer.h b/chrome/browser/glic/host/context/glic_screenshot_capturer.h
deleted file mode 100644
index 6c05996..0000000
--- a/chrome/browser/glic/host/context/glic_screenshot_capturer.h
+++ /dev/null
@@ -1,28 +0,0 @@
-// Copyright 2026 The Chromium Authors
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CHROME_BROWSER_GLIC_HOST_CONTEXT_GLIC_SCREENSHOT_CAPTURER_H_
-#define CHROME_BROWSER_GLIC_HOST_CONTEXT_GLIC_SCREENSHOT_CAPTURER_H_
-
-#include <memory>
-
-#include "chrome/browser/glic/host/glic.mojom.h"
-#include "ui/gfx/native_ui_types.h"
-
-namespace glic {
-
-class GlicScreenshotCapturer {
- public:
-  static std::unique_ptr<GlicScreenshotCapturer> Create();
-  virtual ~GlicScreenshotCapturer() = default;
-
-  virtual void CaptureScreenshot(
-      gfx::NativeWindow parent_window,
-      glic::mojom::WebClientHandler::CaptureScreenshotCallback callback) = 0;
-  virtual void CloseScreenPicker() = 0;
-};
-
-}  // namespace glic
-
-#endif  // CHROME_BROWSER_GLIC_HOST_CONTEXT_GLIC_SCREENSHOT_CAPTURER_H_
diff --git a/chrome/browser/glic/host/context/glic_screenshot_capturer_android.cc b/chrome/browser/glic/host/context/glic_screenshot_capturer_android.cc
deleted file mode 100644
index 42aac1b..0000000
--- a/chrome/browser/glic/host/context/glic_screenshot_capturer_android.cc
+++ /dev/null
@@ -1,103 +0,0 @@
-// Copyright 2026 The Chromium Authors
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chrome/browser/glic/host/context/glic_screenshot_capturer_android.h"
-
-#include <utility>
-
-#include "base/functional/bind.h"
-#include "base/memory/weak_ptr.h"
-#include "base/task/task_traits.h"
-#include "base/task/thread_pool.h"
-#include "ui/android/window_android.h"
-#include "ui/gfx/image/image.h"
-#include "ui/gfx/image/image_util.h"
-#include "ui/snapshot/snapshot.h"
-
-namespace glic {
-
-GlicScreenshotCapturerAndroid::GlicScreenshotCapturerAndroid() = default;
-
-GlicScreenshotCapturerAndroid::~GlicScreenshotCapturerAndroid() {
-  if (capture_callback_) {
-    std::move(capture_callback_)
-        .Run(mojom::CaptureScreenshotResult::NewErrorReason(
-            mojom::CaptureScreenshotErrorReason::kUnknown));
-  }
-}
-
-void GlicScreenshotCapturerAndroid::CaptureScreenshot(
-    gfx::NativeWindow parent_window,
-    glic::mojom::WebClientHandler::CaptureScreenshotCallback callback) {
-  if (capture_callback_) {
-    std::move(callback).Run(mojom::CaptureScreenshotResult::NewErrorReason(
-        mojom::CaptureScreenshotErrorReason::kScreenCaptureRequestThrottled));
-    return;
-  }
-  if (!parent_window) {
-    std::move(callback).Run(mojom::CaptureScreenshotResult::NewErrorReason(
-        mojom::CaptureScreenshotErrorReason::kUnknown));
-    return;
-  }
-
-  capture_callback_ = std::move(callback);
-  ui::GrabWindowSnapshot(
-      parent_window, gfx::Rect(parent_window->GetPhysicalBackingSize()),
-      base::BindOnce(&GlicScreenshotCapturerAndroid::OnSnapshotCaptured,
-                     weak_ptr_factory_.GetWeakPtr()));
-}
-
-void GlicScreenshotCapturerAndroid::OnSnapshotCaptured(gfx::Image snapshot) {
-  if (!capture_callback_) {
-    return;
-  }
-  if (snapshot.IsEmpty()) {
-    std::move(capture_callback_)
-        .Run(mojom::CaptureScreenshotResult::NewErrorReason(
-            mojom::CaptureScreenshotErrorReason::kUnknown));
-    return;
-  }
-
-  base::ThreadPool::PostTaskAndReplyWithResult(
-      FROM_HERE,
-      {base::MayBlock(), base::TaskPriority::USER_VISIBLE,
-       base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
-      base::BindOnce(&gfx::JPEG1xEncodedDataFromImage, snapshot,
-                     /*quality=*/100),
-      base::BindOnce(&GlicScreenshotCapturerAndroid::OnScreenshotEncoded,
-                     weak_ptr_factory_.GetWeakPtr(), snapshot.Width(),
-                     snapshot.Height()));
-}
-
-void GlicScreenshotCapturerAndroid::OnScreenshotEncoded(
-    int width,
-    int height,
-    std::optional<std::vector<uint8_t>> jpeg_data) {
-  if (!capture_callback_) {
-    return;
-  }
-  if (!jpeg_data || jpeg_data->empty()) {
-    std::move(capture_callback_)
-        .Run(mojom::CaptureScreenshotResult::NewErrorReason(
-            mojom::CaptureScreenshotErrorReason::kUnknown));
-    return;
-  }
-
-  mojom::ScreenshotPtr mojo_screenshot = mojom::Screenshot::New();
-  mojo_screenshot->width_pixels = width;
-  mojo_screenshot->height_pixels = height;
-  mojo_screenshot->mime_type = "image/jpeg";
-  mojo_screenshot->data = std::move(*jpeg_data);
-  mojo_screenshot->origin_annotations = mojom::ImageOriginAnnotations::New();
-
-  std::move(capture_callback_)
-      .Run(mojom::CaptureScreenshotResult::NewScreenshot(
-          std::move(mojo_screenshot)));
-}
-
-void GlicScreenshotCapturerAndroid::CloseScreenPicker() {
-  // No-op on Android since there is no desktop screen picker.
-}
-
-}  // namespace glic
diff --git a/chrome/browser/glic/host/context/glic_screenshot_capturer_android.h b/chrome/browser/glic/host/context/glic_screenshot_capturer_android.h
deleted file mode 100644
index 45be431f..0000000
--- a/chrome/browser/glic/host/context/glic_screenshot_capturer_android.h
+++ /dev/null
@@ -1,44 +0,0 @@
-// Copyright 2026 The Chromium Authors
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CHROME_BROWSER_GLIC_HOST_CONTEXT_GLIC_SCREENSHOT_CAPTURER_ANDROID_H_
-#define CHROME_BROWSER_GLIC_HOST_CONTEXT_GLIC_SCREENSHOT_CAPTURER_ANDROID_H_
-
-#include <optional>
-#include <vector>
-
-#include "base/memory/weak_ptr.h"
-#include "chrome/browser/glic/host/context/glic_screenshot_capturer.h"
-#include "ui/gfx/image/image.h"
-
-namespace glic {
-
-class GlicScreenshotCapturerAndroid : public GlicScreenshotCapturer {
- public:
-  GlicScreenshotCapturerAndroid();
-  GlicScreenshotCapturerAndroid(const GlicScreenshotCapturerAndroid&) = delete;
-  GlicScreenshotCapturerAndroid& operator=(
-      const GlicScreenshotCapturerAndroid&) = delete;
-  ~GlicScreenshotCapturerAndroid() override;
-
-  // GlicScreenshotCapturer:
-  void CaptureScreenshot(
-      gfx::NativeWindow parent_window,
-      glic::mojom::WebClientHandler::CaptureScreenshotCallback callback)
-      override;
-  void CloseScreenPicker() override;
-
- private:
-  void OnSnapshotCaptured(gfx::Image snapshot);
-  void OnScreenshotEncoded(int width,
-                           int height,
-                           std::optional<std::vector<uint8_t>> jpeg_data);
-
-  glic::mojom::WebClientHandler::CaptureScreenshotCallback capture_callback_;
-  base::WeakPtrFactory<GlicScreenshotCapturerAndroid> weak_ptr_factory_{this};
-};
-
-}  // namespace glic
-
-#endif  // CHROME_BROWSER_GLIC_HOST_CONTEXT_GLIC_SCREENSHOT_CAPTURER_ANDROID_H_
diff --git a/chrome/browser/glic/host/context/glic_screenshot_capturer_impl.cc b/chrome/browser/glic/host/context/glic_screenshot_capturer_impl.cc
deleted file mode 100644
index a256a72..0000000
--- a/chrome/browser/glic/host/context/glic_screenshot_capturer_impl.cc
+++ /dev/null
@@ -1,198 +0,0 @@
-// Copyright 2026 The Chromium Authors
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chrome/browser/glic/host/context/glic_screenshot_capturer_impl.h"
-
-#include <memory>
-#include <utility>
-
-#include "base/logging.h"
-#include "base/task/single_thread_task_runner.h"
-#include "base/task/thread_pool.h"
-#include "base/time/time.h"
-#include "chrome/browser/media/webrtc/desktop_media_picker_controller.h"
-#include "chrome/common/chrome_features.h"
-#include "chrome/grit/generated_resources.h"
-#include "content/public/browser/browser_task_traits.h"
-#include "content/public/browser/browser_thread.h"
-#include "content/public/browser/render_widget_host_view.h"
-#include "third_party/skia/include/core/SkBitmap.h"
-#include "ui/base/l10n/l10n_util.h"
-#include "ui/gfx/codec/jpeg_codec.h"
-
-namespace glic {
-
-namespace {
-
-// Helper used to convert the captured DesktopFrame to a JPEG.
-std::vector<uint8_t> ConvertFrameToJpeg(
-    std::unique_ptr<webrtc::DesktopFrame> frame) {
-  CHECK(frame);
-  // TODO(crbug.com/352187279): Support other pixel formats.
-  CHECK_EQ(frame->pixel_format(), webrtc::FOURCC_ARGB);
-  SkImageInfo image_info =
-      SkImageInfo::Make(frame->size().width(), frame->size().height(),
-                        kBGRA_8888_SkColorType, kPremul_SkAlphaType);
-
-  SkBitmap sk_bitmap;
-  if (!sk_bitmap.tryAllocPixels(image_info)) {
-    return {};
-  }
-
-  SkPixmap pixmap(image_info, frame->data(), frame->stride());
-  if (!sk_bitmap.writePixels(pixmap)) {
-    return {};
-  }
-
-  auto start_time = base::Time::Now();
-  auto jpeg_data = gfx::JPEGCodec::Encode(
-      sk_bitmap, features::kGlicScreenshotEncodeQuality.Get());
-  if (!jpeg_data.has_value()) {
-    return {};
-  }
-  auto encode_time = base::Time::Now() - start_time;
-  VLOG(1) << "JPEGCodec::Encode() frame size: " << frame->size().width() << "x"
-          << frame->size().height();
-  VLOG(1) << "JPEGCodec::Encode() time: " << encode_time;
-  VLOG(1) << "JPEGCodec::Encode() result file size: " << jpeg_data->size();
-  return std::move(*jpeg_data);
-}
-
-}  // namespace
-
-GlicScreenshotCapturerImpl::GlicScreenshotCapturerImpl() = default;
-
-GlicScreenshotCapturerImpl::~GlicScreenshotCapturerImpl() {
-  if (capture_callback_) {
-    SignalError(glic::mojom::CaptureScreenshotErrorReason::kUnknown);
-  }
-}
-
-void GlicScreenshotCapturerImpl::CaptureScreenshot(
-    gfx::NativeWindow parent_window,
-    glic::mojom::WebClientHandler::CaptureScreenshotCallback callback) {
-  if (capture_callback_) {
-    std::move(callback).Run(mojom::CaptureScreenshotResult::NewErrorReason(
-        glic::mojom::CaptureScreenshotErrorReason::
-            kScreenCaptureRequestThrottled));
-    return;
-  }
-  capture_callback_ = std::move(callback);
-  if (!parent_window) {
-    SignalError(glic::mojom::CaptureScreenshotErrorReason::kUnknown);
-    return;
-  }
-  // Construct picker.
-  picker_controller_ = std::make_unique<DesktopMediaPickerController>();
-  const std::u16string name(
-      l10n_util::GetStringUTF16(IDS_GLIC_SCREEN_PICKER_REQUESTER));
-  DesktopMediaPickerController::Params picker_params(
-      DesktopMediaPickerController::Params::RequestSource::kGlic);
-  picker_params.context = parent_window;
-  picker_params.parent = parent_window;
-  picker_params.app_name = name;
-  picker_params.target_name = name;
-  picker_params.request_audio = false;
-  picker_params.restricted_by_policy = false;
-  picker_params.includable_web_contents_filter =
-      base::BindRepeating([](content::WebContents* wc) { return false; });
-  DesktopMediaPickerController::DoneCallback source_selected_callback =
-      base::BindOnce(&GlicScreenshotCapturerImpl::OnSourceSelected,
-                     weak_ptr_factory_.GetWeakPtr());
-  picker_controller_->Show(picker_params, {DesktopMediaList::Type::kScreen},
-                           std::move(source_selected_callback));
-}
-
-void GlicScreenshotCapturerImpl::CloseScreenPicker() {
-  picker_controller_.reset();
-  if (capture_callback_) {
-    SignalError(glic::mojom::CaptureScreenshotErrorReason::
-                    kUserCancelledScreenPickerDialog);
-  }
-}
-
-void GlicScreenshotCapturerImpl::OnSourceSelected(const std::string& err,
-                                                  content::DesktopMediaID id) {
-  picker_controller_ = nullptr;
-  if (!err.empty()) {
-    DVLOG(1) << "Unknown error while selecting source: " << err;
-    SignalError(glic::mojom::CaptureScreenshotErrorReason::kUnknown);
-    return;
-  }
-  if (id.is_null()) {
-    SignalError(glic::mojom::CaptureScreenshotErrorReason::
... (file diff truncated)
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/chrome/browser/glic/host/context/glic_screenshot_capturer_unittest.cc b/chrome/browser/glic/host/context/glic_screenshot_capturer_unittest.cc
deleted file mode 100644
index abcae73..0000000
--- a/chrome/browser/glic/host/context/glic_screenshot_capturer_unittest.cc
+++ /dev/null
@@ -1,42 +0,0 @@
-// Copyright 2025 The Chromium Authors
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include <utility>
-
-#include "base/compiler_specific.h"
-#include "base/files/file_util.h"
-#include "base/path_service.h"
-#include "chrome/browser/glic/host/context/glic_screenshot_capturer_impl.h"
-#include "chrome/common/chrome_paths.h"
-#include "content/public/browser/desktop_capture.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "ui/gfx/codec/png_codec.h"
-
-namespace glic {
-
-TEST(GlicScreenshotCapturerTest, MANUAL_ConvertFrameToJpeg) {
-  base::FilePath input_path =
-      base::PathService::CheckedGet(chrome::DIR_TEST_DATA)
-          .AppendASCII("glic_convert_frame_to_jpeg.png");
-  std::optional<std::vector<uint8_t>> input_data =
-      base::ReadFileToBytes(input_path);
-  ASSERT_TRUE(input_data.has_value());
-
-  SkBitmap input_bitmap = gfx::PNGCodec::Decode(input_data.value());
-  ASSERT_FALSE(input_bitmap.drawsNothing());
-
-  webrtc::DesktopSize size(input_bitmap.width(), input_bitmap.height());
-  auto frame =
-      std::make_unique<webrtc::BasicDesktopFrame>(size, webrtc::FOURCC_ARGB);
-  UNSAFE_TODO(memcpy(frame->data(), input_bitmap.getPixels(),
-                     input_bitmap.computeByteSize()));
-  frame->mutable_updated_region()->SetRect(webrtc::DesktopRect::MakeSize(size));
-
-  std::vector<uint8_t> jpeg_data =
-      GlicScreenshotCapturerImpl::ConvertFrameToJpegForTesting(
-          std::move(frame));
-  EXPECT_FALSE(jpeg_data.empty());
-}
-
-}  // namespace glic
diff --git a/chrome/browser/glic/host/glic_api_browsertest.cc b/chrome/browser/glic/host/glic_api_browsertest.cc
index aa4efdca..13aa761 100644
--- a/chrome/browser/glic/host/glic_api_browsertest.cc
+++ b/chrome/browser/glic/host/glic_api_browsertest.cc
@@ -4916,12 +4916,6 @@
       "Glic.Turn.PromptType", mojom::PromptType::kTypedText, 1));
 }
 
-// TODO(crbug.com/454083080): Fix this, it hangs.
-IN_PROC_BROWSER_TEST_P(GlicApiTest, DISABLED_testCaptureScreenshot) {
-  ASSERT_OK(OpenGlicForActiveTab());
-  ExecuteJsTest();
-}
-
 // TODO(crbug.com/441588906): Flaky on multiple platforms.
 IN_PROC_BROWSER_TEST_P(GlicApiTest, DISABLED_testFetchInactiveTabScreenshot) {
   tabs::TabInterface* tab0 = GetTabListInterface()->GetActiveTab();
diff --git a/chrome/test/data/webui/glic/browser_tests/glic_api_browsertest.ts b/chrome/test/data/webui/glic/browser_tests/glic_api_browsertest.ts
index 098dcc90..b1f09d4 100644
--- a/chrome/test/data/webui/glic/browser_tests/glic_api_browsertest.ts
+++ b/chrome/test/data/webui/glic/browser_tests/glic_api_browsertest.ts
@@ -2681,17 +2681,6 @@
     metrics.onUserInputSubmitted(WebClientMode.TEXT, PromptType.TYPED_TEXT);
   }
 
-  // TODO(crbug.com/454083080): Fix this, it hangs.
-  async testCaptureScreenshot() {
-    assertDefined(this.host.captureScreenshot);
-    const screenshot = await this.host.captureScreenshot?.();
-    assertDefined(screenshot);
-    assertTrue(screenshot.widthPixels > 0);
-    assertTrue(screenshot.heightPixels > 0);
-    assertTrue(screenshot.data.byteLength > 0);
-    assertEquals(screenshot.mimeType, 'image/jpeg');
-  }
-
   async fetchInactiveTabScreenshot(expectNoFocus: boolean = false) {
     assertDefined(this.host.getFocusedTabStateV2);
     assertDefined(this.host.getContextFromTab);
diff --git a/chrome/test/data/webui/glic/test_client/index.html b/chrome/test/data/webui/glic/test_client/index.html
index 246abec..d50bec6 100644
--- a/chrome/test/data/webui/glic/test_client/index.html
+++ b/chrome/test/data/webui/glic/test_client/index.html
@@ -481,8 +481,7 @@
     <label id="screenWakeLockStatus" lockStatus="released" />
   </div>
   <div class="section">
-    <h1>Desktop Screenshot</h1>
-    <button id="desktopScreenshot">Capture</button>
+    <h1>Panel Screenshot</h1>
     <button id="panelScreenshot">Capture Panel</button>
     <span id="desktopScreenshotErrorReason"></span>
     <img id="desktopScreenshotImg" />
diff --git a/chrome/test/data/webui/glic/test_client/page_element_types.ts b/chrome/test/data/webui/glic/test_client/page_element_types.ts
index 177431eb..d6645093 100644
--- a/chrome/test/data/webui/glic/test_client/page_element_types.ts
+++ b/chrome/test/data/webui/glic/test_client/page_element_types.ts
@@ -75,7 +75,6 @@
   mic: HTMLAudioElement;
   audioDuckingOn: HTMLButtonElement;
   audioDuckingOff: HTMLButtonElement;
-  desktopScreenshot: HTMLButtonElement;
   desktopScreenshotImg: HTMLImageElement;
   desktopScreenshotErrorReason: HTMLSpanElement;
   panelScreenshot: HTMLButtonElement;
diff --git a/chrome/test/data/webui/glic/test_client/test_client.ts b/chrome/test/data/webui/glic/test_client/test_client.ts
index 6d3b681..9410187c 100644
--- a/chrome/test/data/webui/glic/test_client/test_client.ts
+++ b/chrome/test/data/webui/glic/test_client/test_client.ts
@@ -232,23 +232,6 @@
 
 window.addEventListener('load', () => {
   initCaptureRegion();
-  $.desktopScreenshot.addEventListener('click', async () => {
-    logMessage('Requesting desktop screenshot...');
-    try {
-      const screenshot = await getBrowser()!.captureScreenshot!();
-      if (screenshot) {
-        const blob = new Blob([screenshot.data], {type: 'image/jpeg'});
-        $.desktopScreenshotImg.src = URL.createObjectURL(blob);
-        $.desktopScreenshotErrorReason!.innerText =
-            'Desktop screenshot captured.';
-      } else {
-        $.desktopScreenshotErrorReason!.innerText =
-            'Failed to capture desktop screenshot.';
-      }
-    } catch (error) {
-      $.desktopScreenshotErrorReason!.innerText = `Caught error: ${error}`;
-    }
-  });
   $.panelScreenshot.addEventListener('click', async () => {
     const stream = await navigator.mediaDevices.getDisplayMedia({
       video: {
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.