Chrome · Glic › Glic
CVE-2026-113155
UAF in Glic (Glic)
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
GlicScreenshotCapturerchrome/browser/glic/host/context/glic_screenshot_capturer.h |
modified | |
ifchrome/browser/glic/host/context/glic_screenshot_capturer_android.cc |
modified | |
GlicScreenshotCapturerAndroidchrome/browser/glic/host/context/glic_screenshot_capturer_android.h |
modified | |
ifchrome/browser/glic/host/context/glic_screenshot_capturer_impl.cc |
modified | |
BindRepeatingchrome/browser/glic/host/context/glic_screenshot_capturer_impl.cc |
modified |
Files Changed
chrome/browser/glic/host/host.ccchrome/test/data/webui/glic/browser_tests/glic_api_browsertest.tschrome/common/chrome_features.hchrome/browser/glic/public/glic_api_metrics.ccchrome/browser/resources/glic/glic_api/glic_api.tschrome/browser/glic/host/context/glic_screenshot_capturer_impl.hchrome/browser/glic/widget/glic_side_panel_ui_android.hchrome/browser/glic/widget/glic_side_panel_ui_android.cctools/metrics/histograms/metadata/glic/histograms.xmlchrome/browser/glic/host/context/glic_screenshot_capturer.hchrome/browser/glic/host/glic_web_client_handler.ccchrome/app/glic_strings.grdpchrome/browser/glic/host/context/glic_screenshot_capturer_unittest.ccchrome/browser/glic/widget/glic_floating_ui.htools/metrics/histograms/metadata/glic/enums.xmlchrome/browser/glic/host/context/glic_screenshot_capturer_android.ccchrome/test/data/webui/glic/test_client/page_element_types.tschrome/test/data/webui/glic/test_client/test_client.tschrome/browser/glic/widget/glic_side_panel_ui.hchrome/test/data/webui/glic/test_client/index.htmlchrome/browser/resources/glic/glic_api_impl/client/glic_api_client.tschrome/browser/resources/glic/glic_api_impl/host/host_from_client.tschrome/common/chrome_features.ccchrome/browser/glic/widget/glic_side_panel_ui.ccchrome/browser/glic/host/host.hchrome/browser/glic/widget/glic_floating_ui.ccchrome/browser/resources/glic/glic_api/glic_api_generated.tschrome/browser/resources/glic/glic_api_impl/request_types.tschrome/browser/glic/host/glic.mojomchrome/browser/glic/host/glic_api_browsertest.ccchrome/browser/glic/host/context/glic_screenshot_capturer.ccchrome/browser/glic/host/context/glic_screenshot_capturer_impl.ccchrome/browser/glic/BUILD.gnchrome/browser/glic/host/context/glic_screenshot_capturer_android.hchrome/browser/glic/public/glic_api_metrics.hchrome/app/glic_strings_grdp/IDS_GLIC_SCREEN_PICKER_REQUESTER.png.sha1
Patch
From c2ad908c4f9277743a4cda2dcab516c3f46c8477 Mon Sep 17 00:00:00 2001
From: Nick Birnie <birnie@google.com>
Date: Wed, 16 Sep 2026 16:12:35 -0700
Subject: [PATCH] [glic] Remove unused CaptureScreenshot API and capturer implementation
The CaptureScreenshot Mojo API and its backing GlicScreenshotCapturer
implementation are unused and have no active consumers. Remove the dead
code and associated host/embedder plumbing.
Companion WebClinet CL: http://shortn/_yNP2FhVb6M
No Traffic: https://screenshot-v2.corp.google.com/16aks1ls4dd18
Bug: 505994167
Change-Id: I2dad76df88f23056e2c94e99d6b5612004b40124
No-Stable-Mojom-Checks: true
Bypass-Glic-Api-Compatibility-Check: CaptureScreenshot API was dead and unused with no consumers.
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8299392
Commit-Queue: Nick Birnie <birnie@google.com>
Reviewed-by: Fred Shih <ffred@chromium.org>
Reviewed-by: Dan H <harringtond@chromium.org>
Auto-Submit: Nick Birnie <birnie@google.com>
Cr-Commit-Position: refs/heads/main@{#1699334}
---
diff --git a/chrome/app/glic_strings.grdp b/chrome/app/glic_strings.grdp
index c600878..22ca1ea 100644
--- a/chrome/app/glic_strings.grdp
+++ b/chrome/app/glic_strings.grdp
@@ -449,9 +449,6 @@
</message>
<!-- Screenpicker Menu String -->
- <message name="IDS_GLIC_SCREEN_PICKER_REQUESTER" desc="Text shown on screen picker dialog that indicates the requesting source is Gemini.">
- Gemini
- </message>
<message name="IDS_GLIC_SCREEN_PICKER_HEADLINE" desc="Title of the Gemini screen picker dialog used for specifying which screen to capture.">
Choose a screen to capture
</message>
diff --git a/chrome/app/glic_strings_grdp/IDS_GLIC_SCREEN_PICKER_REQUESTER.png.sha1 b/chrome/app/glic_strings_grdp/IDS_GLIC_SCREEN_PICKER_REQUESTER.png.sha1
deleted file mode 100644
index 2850b16..0000000
--- a/chrome/app/glic_strings_grdp/IDS_GLIC_SCREEN_PICKER_REQUESTER.png.sha1
+++ /dev/null
@@ -1 +0,0 @@
-1bff5b774725576e58cf31ac3b4cfac9708db9e7
\ No newline at end of file
diff --git a/chrome/browser/glic/host/context/glic_screenshot_capturer.cc b/chrome/browser/glic/host/context/glic_screenshot_capturer.cc
deleted file mode 100644
index 420b138..0000000
--- a/chrome/browser/glic/host/context/glic_screenshot_capturer.cc
+++ /dev/null
@@ -1,26 +0,0 @@
-// Copyright 2026 The Chromium Authors
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chrome/browser/glic/host/context/glic_screenshot_capturer.h"
-
-#include "build/build_config.h"
-
-#if BUILDFLAG(IS_ANDROID)
-#include "chrome/browser/glic/host/context/glic_screenshot_capturer_android.h"
-#else
-#include "chrome/browser/glic/host/context/glic_screenshot_capturer_impl.h"
-#endif
-
-namespace glic {
-
-// static
-std::unique_ptr<GlicScreenshotCapturer> GlicScreenshotCapturer::Create() {
-#if BUILDFLAG(IS_ANDROID)
- return std::make_unique<GlicScreenshotCapturerAndroid>();
-#else
- return std::make_unique<GlicScreenshotCapturerImpl>();
-#endif
-}
-
-} // namespace glic
diff --git a/chrome/browser/glic/host/context/glic_screenshot_capturer.h b/chrome/browser/glic/host/context/glic_screenshot_capturer.h
deleted file mode 100644
index 6c05996..0000000
--- a/chrome/browser/glic/host/context/glic_screenshot_capturer.h
+++ /dev/null
@@ -1,28 +0,0 @@
-// Copyright 2026 The Chromium Authors
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CHROME_BROWSER_GLIC_HOST_CONTEXT_GLIC_SCREENSHOT_CAPTURER_H_
-#define CHROME_BROWSER_GLIC_HOST_CONTEXT_GLIC_SCREENSHOT_CAPTURER_H_
-
-#include <memory>
-
-#include "chrome/browser/glic/host/glic.mojom.h"
-#include "ui/gfx/native_ui_types.h"
-
-namespace glic {
-
-class GlicScreenshotCapturer {
- public:
- static std::unique_ptr<GlicScreenshotCapturer> Create();
- virtual ~GlicScreenshotCapturer() = default;
-
- virtual void CaptureScreenshot(
- gfx::NativeWindow parent_window,
- glic::mojom::WebClientHandler::CaptureScreenshotCallback callback) = 0;
- virtual void CloseScreenPicker() = 0;
-};
-
-} // namespace glic
-
-#endif // CHROME_BROWSER_GLIC_HOST_CONTEXT_GLIC_SCREENSHOT_CAPTURER_H_
diff --git a/chrome/browser/glic/host/context/glic_screenshot_capturer_android.cc b/chrome/browser/glic/host/context/glic_screenshot_capturer_android.cc
deleted file mode 100644
index 42aac1b..0000000
--- a/chrome/browser/glic/host/context/glic_screenshot_capturer_android.cc
+++ /dev/null
@@ -1,103 +0,0 @@
-// Copyright 2026 The Chromium Authors
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chrome/browser/glic/host/context/glic_screenshot_capturer_android.h"
-
-#include <utility>
-
-#include "base/functional/bind.h"
-#include "base/memory/weak_ptr.h"
-#include "base/task/task_traits.h"
-#include "base/task/thread_pool.h"
-#include "ui/android/window_android.h"
-#include "ui/gfx/image/image.h"
-#include "ui/gfx/image/image_util.h"
-#include "ui/snapshot/snapshot.h"
-
-namespace glic {
-
-GlicScreenshotCapturerAndroid::GlicScreenshotCapturerAndroid() = default;
-
-GlicScreenshotCapturerAndroid::~GlicScreenshotCapturerAndroid() {
- if (capture_callback_) {
- std::move(capture_callback_)
- .Run(mojom::CaptureScreenshotResult::NewErrorReason(
- mojom::CaptureScreenshotErrorReason::kUnknown));
- }
-}
-
-void GlicScreenshotCapturerAndroid::CaptureScreenshot(
- gfx::NativeWindow parent_window,
- glic::mojom::WebClientHandler::CaptureScreenshotCallback callback) {
- if (capture_callback_) {
- std::move(callback).Run(mojom::CaptureScreenshotResult::NewErrorReason(
- mojom::CaptureScreenshotErrorReason::kScreenCaptureRequestThrottled));
- return;
- }
- if (!parent_window) {
- std::move(callback).Run(mojom::CaptureScreenshotResult::NewErrorReason(
- mojom::CaptureScreenshotErrorReason::kUnknown));
- return;
- }
-
- capture_callback_ = std::move(callback);
- ui::GrabWindowSnapshot(
- parent_window, gfx::Rect(parent_window->GetPhysicalBackingSize()),
- base::BindOnce(&GlicScreenshotCapturerAndroid::OnSnapshotCaptured,
- weak_ptr_factory_.GetWeakPtr()));
-}
-
-void GlicScreenshotCapturerAndroid::OnSnapshotCaptured(gfx::Image snapshot) {
- if (!capture_callback_) {
- return;
- }
- if (snapshot.IsEmpty()) {
- std::move(capture_callback_)
- .Run(mojom::CaptureScreenshotResult::NewErrorReason(
- mojom::CaptureScreenshotErrorReason::kUnknown));
- return;
- }
-
- base::ThreadPool::PostTaskAndReplyWithResult(
- FROM_HERE,
- {base::MayBlock(), base::TaskPriority::USER_VISIBLE,
- base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
- base::BindOnce(&gfx::JPEG1xEncodedDataFromImage, snapshot,
- /*quality=*/100),
- base::BindOnce(&GlicScreenshotCapturerAndroid::OnScreenshotEncoded,
- weak_ptr_factory_.GetWeakPtr(), snapshot.Width(),
- snapshot.Height()));
-}
-
-void GlicScreenshotCapturerAndroid::OnScreenshotEncoded(
- int width,
- int height,
- std::optional<std::vector<uint8_t>> jpeg_data) {
- if (!capture_callback_) {
- return;
- }
- if (!jpeg_data || jpeg_data->empty()) {
- std::move(capture_callback_)
- .Run(mojom::CaptureScreenshotResult::NewErrorReason(
- mojom::CaptureScreenshotErrorReason::kUnknown));
- return;
- }
-
- mojom::ScreenshotPtr mojo_screenshot = mojom::Screenshot::New();
- mojo_screenshot->width_pixels = width;
- mojo_screenshot->height_pixels = height;
- mojo_screenshot->mime_type = "image/jpeg";
- mojo_screenshot->data = std::move(*jpeg_data);
- mojo_screenshot->origin_annotations = mojom::ImageOriginAnnotations::New();
-
- std::move(capture_callback_)
- .Run(mojom::CaptureScreenshotResult::NewScreenshot(
- std::move(mojo_screenshot)));
-}
-
-void GlicScreenshotCapturerAndroid::CloseScreenPicker() {
- // No-op on Android since there is no desktop screen picker.
-}
-
-} // namespace glic
diff --git a/chrome/browser/glic/host/context/glic_screenshot_capturer_android.h b/chrome/browser/glic/host/context/glic_screenshot_capturer_android.h
deleted file mode 100644
index 45be431f..0000000
--- a/chrome/browser/glic/host/context/glic_screenshot_capturer_android.h
+++ /dev/null
@@ -1,44 +0,0 @@
-// Copyright 2026 The Chromium Authors
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CHROME_BROWSER_GLIC_HOST_CONTEXT_GLIC_SCREENSHOT_CAPTURER_ANDROID_H_
-#define CHROME_BROWSER_GLIC_HOST_CONTEXT_GLIC_SCREENSHOT_CAPTURER_ANDROID_H_
-
-#include <optional>
-#include <vector>
-
-#include "base/memory/weak_ptr.h"
-#include "chrome/browser/glic/host/context/glic_screenshot_capturer.h"
-#include "ui/gfx/image/image.h"
-
-namespace glic {
-
-class GlicScreenshotCapturerAndroid : public GlicScreenshotCapturer {
- public:
- GlicScreenshotCapturerAndroid();
- GlicScreenshotCapturerAndroid(const GlicScreenshotCapturerAndroid&) = delete;
- GlicScreenshotCapturerAndroid& operator=(
- const GlicScreenshotCapturerAndroid&) = delete;
- ~GlicScreenshotCapturerAndroid() override;
-
- // GlicScreenshotCapturer:
- void CaptureScreenshot(
- gfx::NativeWindow parent_window,
- glic::mojom::WebClientHandler::CaptureScreenshotCallback callback)
- override;
- void CloseScreenPicker() override;
-
- private:
- void OnSnapshotCaptured(gfx::Image snapshot);
- void OnScreenshotEncoded(int width,
- int height,
- std::optional<std::vector<uint8_t>> jpeg_data);
-
- glic::mojom::WebClientHandler::CaptureScreenshotCallback capture_callback_;
- base::WeakPtrFactory<GlicScreenshotCapturerAndroid> weak_ptr_factory_{this};
-};
-
-} // namespace glic
-
-#endif // CHROME_BROWSER_GLIC_HOST_CONTEXT_GLIC_SCREENSHOT_CAPTURER_ANDROID_H_
diff --git a/chrome/browser/glic/host/context/glic_screenshot_capturer_impl.cc b/chrome/browser/glic/host/context/glic_screenshot_capturer_impl.cc
deleted file mode 100644
index a256a72..0000000
--- a/chrome/browser/glic/host/context/glic_screenshot_capturer_impl.cc
+++ /dev/null
@@ -1,198 +0,0 @@
-// Copyright 2026 The Chromium Authors
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chrome/browser/glic/host/context/glic_screenshot_capturer_impl.h"
-
-#include <memory>
-#include <utility>
-
-#include "base/logging.h"
-#include "base/task/single_thread_task_runner.h"
-#include "base/task/thread_pool.h"
-#include "base/time/time.h"
-#include "chrome/browser/media/webrtc/desktop_media_picker_controller.h"
-#include "chrome/common/chrome_features.h"
-#include "chrome/grit/generated_resources.h"
-#include "content/public/browser/browser_task_traits.h"
-#include "content/public/browser/browser_thread.h"
-#include "content/public/browser/render_widget_host_view.h"
-#include "third_party/skia/include/core/SkBitmap.h"
-#include "ui/base/l10n/l10n_util.h"
-#include "ui/gfx/codec/jpeg_codec.h"
-
-namespace glic {
-
-namespace {
-
-// Helper used to convert the captured DesktopFrame to a JPEG.
-std::vector<uint8_t> ConvertFrameToJpeg(
- std::unique_ptr<webrtc::DesktopFrame> frame) {
- CHECK(frame);
- // TODO(crbug.com/352187279): Support other pixel formats.
- CHECK_EQ(frame->pixel_format(), webrtc::FOURCC_ARGB);
- SkImageInfo image_info =
- SkImageInfo::Make(frame->size().width(), frame->size().height(),
- kBGRA_8888_SkColorType, kPremul_SkAlphaType);
-
- SkBitmap sk_bitmap;
- if (!sk_bitmap.tryAllocPixels(image_info)) {
- return {};
- }
-
- SkPixmap pixmap(image_info, frame->data(), frame->stride());
- if (!sk_bitmap.writePixels(pixmap)) {
- return {};
- }
-
- auto start_time = base::Time::Now();
- auto jpeg_data = gfx::JPEGCodec::Encode(
- sk_bitmap, features::kGlicScreenshotEncodeQuality.Get());
- if (!jpeg_data.has_value()) {
- return {};
- }
- auto encode_time = base::Time::Now() - start_time;
- VLOG(1) << "JPEGCodec::Encode() frame size: " << frame->size().width() << "x"
- << frame->size().height();
- VLOG(1) << "JPEGCodec::Encode() time: " << encode_time;
- VLOG(1) << "JPEGCodec::Encode() result file size: " << jpeg_data->size();
- return std::move(*jpeg_data);
-}
-
-} // namespace
-
-GlicScreenshotCapturerImpl::GlicScreenshotCapturerImpl() = default;
-
-GlicScreenshotCapturerImpl::~GlicScreenshotCapturerImpl() {
- if (capture_callback_) {
- SignalError(glic::mojom::CaptureScreenshotErrorReason::kUnknown);
- }
-}
-
-void GlicScreenshotCapturerImpl::CaptureScreenshot(
- gfx::NativeWindow parent_window,
- glic::mojom::WebClientHandler::CaptureScreenshotCallback callback) {
- if (capture_callback_) {
- std::move(callback).Run(mojom::CaptureScreenshotResult::NewErrorReason(
- glic::mojom::CaptureScreenshotErrorReason::
- kScreenCaptureRequestThrottled));
- return;
- }
- capture_callback_ = std::move(callback);
- if (!parent_window) {
- SignalError(glic::mojom::CaptureScreenshotErrorReason::kUnknown);
- return;
- }
- // Construct picker.
- picker_controller_ = std::make_unique<DesktopMediaPickerController>();
- const std::u16string name(
- l10n_util::GetStringUTF16(IDS_GLIC_SCREEN_PICKER_REQUESTER));
- DesktopMediaPickerController::Params picker_params(
- DesktopMediaPickerController::Params::RequestSource::kGlic);
- picker_params.context = parent_window;
- picker_params.parent = parent_window;
- picker_params.app_name = name;
- picker_params.target_name = name;
- picker_params.request_audio = false;
- picker_params.restricted_by_policy = false;
- picker_params.includable_web_contents_filter =
- base::BindRepeating([](content::WebContents* wc) { return false; });
- DesktopMediaPickerController::DoneCallback source_selected_callback =
- base::BindOnce(&GlicScreenshotCapturerImpl::OnSourceSelected,
- weak_ptr_factory_.GetWeakPtr());
- picker_controller_->Show(picker_params, {DesktopMediaList::Type::kScreen},
- std::move(source_selected_callback));
-}
-
-void GlicScreenshotCapturerImpl::CloseScreenPicker() {
- picker_controller_.reset();
- if (capture_callback_) {
- SignalError(glic::mojom::CaptureScreenshotErrorReason::
- kUserCancelledScreenPickerDialog);
- }
-}
-
-void GlicScreenshotCapturerImpl::OnSourceSelected(const std::string& err,
- content::DesktopMediaID id) {
- picker_controller_ = nullptr;
- if (!err.empty()) {
- DVLOG(1) << "Unknown error while selecting source: " << err;
- SignalError(glic::mojom::CaptureScreenshotErrorReason::kUnknown);
- return;
- }
- if (id.is_null()) {
- SignalError(glic::mojom::CaptureScreenshotErrorReason::
... (file diff truncated)
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/chrome/browser/glic/host/context/glic_screenshot_capturer_unittest.cc b/chrome/browser/glic/host/context/glic_screenshot_capturer_unittest.cc
deleted file mode 100644
index abcae73..0000000
--- a/chrome/browser/glic/host/context/glic_screenshot_capturer_unittest.cc
+++ /dev/null
@@ -1,42 +0,0 @@
-// Copyright 2025 The Chromium Authors
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include <utility>
-
-#include "base/compiler_specific.h"
-#include "base/files/file_util.h"
-#include "base/path_service.h"
-#include "chrome/browser/glic/host/context/glic_screenshot_capturer_impl.h"
-#include "chrome/common/chrome_paths.h"
-#include "content/public/browser/desktop_capture.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "ui/gfx/codec/png_codec.h"
-
-namespace glic {
-
-TEST(GlicScreenshotCapturerTest, MANUAL_ConvertFrameToJpeg) {
- base::FilePath input_path =
- base::PathService::CheckedGet(chrome::DIR_TEST_DATA)
- .AppendASCII("glic_convert_frame_to_jpeg.png");
- std::optional<std::vector<uint8_t>> input_data =
- base::ReadFileToBytes(input_path);
- ASSERT_TRUE(input_data.has_value());
-
- SkBitmap input_bitmap = gfx::PNGCodec::Decode(input_data.value());
- ASSERT_FALSE(input_bitmap.drawsNothing());
-
- webrtc::DesktopSize size(input_bitmap.width(), input_bitmap.height());
- auto frame =
- std::make_unique<webrtc::BasicDesktopFrame>(size, webrtc::FOURCC_ARGB);
- UNSAFE_TODO(memcpy(frame->data(), input_bitmap.getPixels(),
- input_bitmap.computeByteSize()));
- frame->mutable_updated_region()->SetRect(webrtc::DesktopRect::MakeSize(size));
-
- std::vector<uint8_t> jpeg_data =
- GlicScreenshotCapturerImpl::ConvertFrameToJpegForTesting(
- std::move(frame));
- EXPECT_FALSE(jpeg_data.empty());
-}
-
-} // namespace glic
diff --git a/chrome/browser/glic/host/glic_api_browsertest.cc b/chrome/browser/glic/host/glic_api_browsertest.cc
index aa4efdca..13aa761 100644
--- a/chrome/browser/glic/host/glic_api_browsertest.cc
+++ b/chrome/browser/glic/host/glic_api_browsertest.cc
@@ -4916,12 +4916,6 @@
"Glic.Turn.PromptType", mojom::PromptType::kTypedText, 1));
}
-// TODO(crbug.com/454083080): Fix this, it hangs.
-IN_PROC_BROWSER_TEST_P(GlicApiTest, DISABLED_testCaptureScreenshot) {
- ASSERT_OK(OpenGlicForActiveTab());
- ExecuteJsTest();
-}
-
// TODO(crbug.com/441588906): Flaky on multiple platforms.
IN_PROC_BROWSER_TEST_P(GlicApiTest, DISABLED_testFetchInactiveTabScreenshot) {
tabs::TabInterface* tab0 = GetTabListInterface()->GetActiveTab();
diff --git a/chrome/test/data/webui/glic/browser_tests/glic_api_browsertest.ts b/chrome/test/data/webui/glic/browser_tests/glic_api_browsertest.ts
index 098dcc90..b1f09d4 100644
--- a/chrome/test/data/webui/glic/browser_tests/glic_api_browsertest.ts
+++ b/chrome/test/data/webui/glic/browser_tests/glic_api_browsertest.ts
@@ -2681,17 +2681,6 @@
metrics.onUserInputSubmitted(WebClientMode.TEXT, PromptType.TYPED_TEXT);
}
- // TODO(crbug.com/454083080): Fix this, it hangs.
- async testCaptureScreenshot() {
- assertDefined(this.host.captureScreenshot);
- const screenshot = await this.host.captureScreenshot?.();
- assertDefined(screenshot);
- assertTrue(screenshot.widthPixels > 0);
- assertTrue(screenshot.heightPixels > 0);
- assertTrue(screenshot.data.byteLength > 0);
- assertEquals(screenshot.mimeType, 'image/jpeg');
- }
-
async fetchInactiveTabScreenshot(expectNoFocus: boolean = false) {
assertDefined(this.host.getFocusedTabStateV2);
assertDefined(this.host.getContextFromTab);
diff --git a/chrome/test/data/webui/glic/test_client/index.html b/chrome/test/data/webui/glic/test_client/index.html
index 246abec..d50bec6 100644
--- a/chrome/test/data/webui/glic/test_client/index.html
+++ b/chrome/test/data/webui/glic/test_client/index.html
@@ -481,8 +481,7 @@
<label id="screenWakeLockStatus" lockStatus="released" />
</div>
<div class="section">
- <h1>Desktop Screenshot</h1>
- <button id="desktopScreenshot">Capture</button>
+ <h1>Panel Screenshot</h1>
<button id="panelScreenshot">Capture Panel</button>
<span id="desktopScreenshotErrorReason"></span>
<img id="desktopScreenshotImg" />
diff --git a/chrome/test/data/webui/glic/test_client/page_element_types.ts b/chrome/test/data/webui/glic/test_client/page_element_types.ts
index 177431eb..d6645093 100644
--- a/chrome/test/data/webui/glic/test_client/page_element_types.ts
+++ b/chrome/test/data/webui/glic/test_client/page_element_types.ts
@@ -75,7 +75,6 @@
mic: HTMLAudioElement;
audioDuckingOn: HTMLButtonElement;
audioDuckingOff: HTMLButtonElement;
- desktopScreenshot: HTMLButtonElement;
desktopScreenshotImg: HTMLImageElement;
desktopScreenshotErrorReason: HTMLSpanElement;
panelScreenshot: HTMLButtonElement;
diff --git a/chrome/test/data/webui/glic/test_client/test_client.ts b/chrome/test/data/webui/glic/test_client/test_client.ts
index 6d3b681..9410187c 100644
--- a/chrome/test/data/webui/glic/test_client/test_client.ts
+++ b/chrome/test/data/webui/glic/test_client/test_client.ts
@@ -232,23 +232,6 @@
window.addEventListener('load', () => {
initCaptureRegion();
- $.desktopScreenshot.addEventListener('click', async () => {
- logMessage('Requesting desktop screenshot...');
- try {
- const screenshot = await getBrowser()!.captureScreenshot!();
- if (screenshot) {
- const blob = new Blob([screenshot.data], {type: 'image/jpeg'});
- $.desktopScreenshotImg.src = URL.createObjectURL(blob);
- $.desktopScreenshotErrorReason!.innerText =
- 'Desktop screenshot captured.';
- } else {
- $.desktopScreenshotErrorReason!.innerText =
- 'Failed to capture desktop screenshot.';
- }
- } catch (error) {
- $.desktopScreenshotErrorReason!.innerText = `Caught error: ${error}`;
- }
- });
$.panelScreenshot.addEventListener('click', async () => {
const stream = await navigator.mediaDevices.getDisplayMedia({
video: {
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page