Chrome · PageInfo
CVE-2026-13956
Logic Error in PageInfo
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifchrome/browser/ui/views/page_info/page_info_permission_content_view.cc |
modified |
Files Changed
chrome/browser/ui/views/page_info/page_info_permission_content_view.cccomponents/page_info/page_info.h
Patch
From d928c4a06567d669db3d3ac7c80c6b8c6c12f12e Mon Sep 17 00:00:00 2001
From: Christian Dullweber <dullweber@chromium.org>
Date: Thu, 21 May 2026 02:34:17 -0700
Subject: [PATCH] PageInfo: Use presenter URL instead of web contents URL for permissions
Ensure that permission changes affect only the URL that is shown in
page info.
Bug: 513515168
Change-Id: I9d82901f54f9c3a051bfbf7903ab04384b34bdc9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7864581
Reviewed-by: Elias Klim <elklm@chromium.org>
Commit-Queue: Christian Dullweber <dullweber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1634139}
---
diff --git a/chrome/browser/ui/views/page_info/page_info_permission_content_view.cc b/chrome/browser/ui/views/page_info/page_info_permission_content_view.cc
index 86ee1bb3..d47419c0 100644
--- a/chrome/browser/ui/views/page_info/page_info_permission_content_view.cc
+++ b/chrome/browser/ui/views/page_info/page_info_permission_content_view.cc
@@ -129,8 +129,8 @@
FileSystemAccessPermissionContextFactory::GetForProfileIfExists(
web_contents->GetBrowserContext());
if (context) {
- granted_file_paths = context->GetGrantedPaths(
- url::Origin::Create(web_contents->GetLastCommittedURL()));
+ granted_file_paths =
+ context->GetGrantedPaths(url::Origin::Create(presenter_->site_url()));
}
if (!granted_file_paths.empty()) {
std::unique_ptr<views::ScrollView> scroll_panel =
@@ -281,8 +281,8 @@
remember_setting_->SetVisible(context &&
setting != CONTENT_SETTING_BLOCK);
remember_setting_->SetChecked(
- context && context->OriginHasExtendedPermission(url::Origin::Create(
- web_contents_->GetLastCommittedURL())));
+ context && context->OriginHasExtendedPermission(
+ url::Origin::Create(presenter_->site_url())));
}
} else {
auto* info =
@@ -380,8 +380,7 @@
return;
}
bool checkbox_enabled = remember_setting_->GetChecked();
- const url::Origin site_origin =
- url::Origin::Create(web_contents_->GetLastCommittedURL());
+ const url::Origin site_origin = url::Origin::Create(presenter_->site_url());
bool origin_has_extended_permission =
context->OriginHasExtendedPermission(site_origin);
diff --git a/components/page_info/page_info.h b/components/page_info/page_info.h
index 4920b08..2529d49 100644
--- a/components/page_info/page_info.h
+++ b/components/page_info/page_info.h
@@ -274,6 +274,8 @@
return safe_browsing_status_;
}
+ const GURL& site_url() const { return site_url_; }
+
// For most sites, this returns a human-friendly string based on site origin,
// without scheme, the username and password, the path or trivial subdomains.
//
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page