From 2749edae91e090b735b9ae8b65a52476409cfd18 Mon Sep 17 00:00:00 2001
From: Mohamed Amir Yosef <mamir@chromium.org>
Date: Tue, 19 May 2026 05:22:10 -0700
Subject: [PATCH] [Autofill]: Hoist overlap checks into PopupBaseView

Hoist open prompt, permission bubble, and HTML form popup overlap checks
from PopupViewViews into the base class PopupBaseView.

Previously, the sibling class PopupViewViews implemented overlap checks
for open prompts, permission dialogs, and HTML form popups to prevent
clickjacking attacks. However, password-related popup views (such as
PasswordGenerationPopupViewViews and
PasswordCrossDomainConfirmationPopupViewViews) inherit from the base
class PopupBaseView and did not inherit these checks. A compromised
renderer could therefore position a password-related popup to obscure
trusted browser dialogs.

This CL hoists these checks into a shared helper method
HideIfOverlappingWithAnotherPrompt in PopupBaseView and calls it in both
PopupBaseView and PopupViewViews to protect all popup subclasses while
avoiding duplicate code.

Fixed: 514006829
Test: out/Default/unit_tests --gtest_filter="PopupBaseViewBrowsertest.*:PopupViewViewsTest.*"
Change-Id: I7239b3e643c1b4dbe3defab22c7cdef51a5789d3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7853421
Reviewed-by: Dominic Battré <battre@chromium.org>
Commit-Queue: Mohamed Amir Yosef <mamir@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1632784}
---

diff --git a/chrome/browser/ui/views/autofill/popup/popup_base_view.cc b/chrome/browser/ui/views/autofill/popup/popup_base_view.cc
index 5efd1fde..5c9c09d1 100644
--- a/chrome/browser/ui/views/autofill/popup/popup_base_view.cc
+++ b/chrome/browser/ui/views/autofill/popup/popup_base_view.cc
@@ -577,6 +577,11 @@
       element_bounds, visible_content_area_bounds, preferred_size,
       kDefaultPreferredPopupSides);
 
+  if (OverlapsWithAnotherPrompt(popup_bounds)) {
+    HideController(SuggestionHidingReason::kOverlappingWithAnotherPrompt);
+    return false;
+  }
+
   if (BoundsOverlapWithPictureInPictureWindow(popup_bounds)) {
     HideController(
         SuggestionHidingReason::kOverlappingWithPictureInPictureWindow);
@@ -593,6 +598,33 @@
   return true;
 }
 
+bool PopupBaseView::OverlapsWithAnotherPrompt(
+    const gfx::Rect& popup_bounds) const {
+  content::WebContents* web_contents = GetWebContents();
+  if (!web_contents) {
+    return false;
+  }
+
+  if (BoundsOverlapWithAnyOpenPrompt(popup_bounds, web_contents)) {
+    return true;
+  }
+  // On Windows, due to platform-specific implementation details, the previous
+  // check isn't reliable, and fails to detect open prompts. Since the most
+  // critical bubble is the permission bubble, we check for that specifically.
+  if (BoundsOverlapWithOpenPermissionsPrompt(popup_bounds, web_contents)) {
+    return true;
+  }
+
+  if (base::FeatureList::IsEnabled(
+          features::kAutofillPopupCheckHtmlFormPopupOverlap)) {
+    if (BoundsOverlapWithHtmlFormPopup(popup_bounds, web_contents)) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
 void PopupBaseView::OnNativeFocusChanged(gfx::NativeView focused_now) {
   // TODO(crbug.com/330303918): The focus change is triggered sometimes
   // (reproduced on a Linux release build, on a debug one - no) with
diff --git a/chrome/browser/ui/views/autofill/popup/popup_base_view.h b/chrome/browser/ui/views/autofill/popup/popup_base_view.h
index ba14966..dac026d 100644
--- a/chrome/browser/ui/views/autofill/popup/popup_base_view.h
+++ b/chrome/browser/ui/views/autofill/popup/popup_base_view.h
@@ -93,6 +93,10 @@
   // testing).
   [[nodiscard]] virtual bool DoUpdateBoundsAndRedrawPopup();
 
+  // Checks whether the popup at `popup_bounds` overlaps with any open prompts,
+  // permission bubbles, or HTML form popups.
+  bool OverlapsWithAnotherPrompt(const gfx::Rect& popup_bounds) const;
+
   // Returns the optimal bounds to place the popup with `preferred_size` and
   // places an arrow on the popup border to point towards `element_bounds`
   // within `max_bounds_for_popup`. The `preferred_popup_sides` are tried
diff --git a/chrome/browser/ui/views/autofill/popup/popup_view_views.cc b/chrome/browser/ui/views/autofill/popup/popup_view_views.cc
index 3deaf6fa..3fdbf1e9 100644
--- a/chrome/browser/ui/views/autofill/popup/popup_view_views.cc
+++ b/chrome/browser/ui/views/autofill/popup/popup_view_views.cc
@@ -1518,28 +1518,10 @@
       element_bounds, visible_content_area_bounds, preferred_size,
       preferred_popup_sides);
 
-  if (BoundsOverlapWithAnyOpenPrompt(popup_bounds,
-                                     controller_->GetWebContents())) {
+  if (OverlapsWithAnotherPrompt(popup_bounds)) {
     controller_->Hide(SuggestionHidingReason::kOverlappingWithAnotherPrompt);
     return false;
   }
-  // On Windows, due to platform-specific implementation details, the previous
-  // check isn't reliable, and fails to detect open prompts. Since the most
-  // critical bubble is the permission bubble, we check for that specifically.
-  if (BoundsOverlapWithOpenPermissionsPrompt(popup_bounds,
-                                             controller_->GetWebContents())) {
-    controller_->Hide(SuggestionHidingReason::kOverlappingWithAnotherPrompt);
-    return false;
-  }
-
-  if (base::FeatureList::IsEnabled(
-          features::kAutofillPopupCheckHtmlFormPopupOverlap)) {
-    if (BoundsOverlapWithHtmlFormPopup(popup_bounds,
-                                       controller_->GetWebContents())) {
-      controller_->Hide(SuggestionHidingReason::kOverlappingWithAnotherPrompt);
-      return false;
-    }
-  }
 
   // The pip surface is given the most preference while rendering. So, the
   // autofill popup should not be shown when the picture in picture window