Chrome · PageInfo
CVE-2026-13989
Logic Error in PageInfo
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
chrome/browser/ui/views/page_info/web_view_side_panel_view.cc
Patch
From ead7c82b381fb546cb01feb6691c1f304989a796 Mon Sep 17 00:00:00 2001
From: Christian Dullweber <dullweber@chromium.org>
Date: Wed, 20 May 2026 01:31:00 -0700
Subject: [PATCH] PageInfo: Attach delegate and user data to loading indicator
Ensure that the loading indicator webview can not be navigated to
different URLs.
Bug: 514056221
Change-Id: I16d4b9bde16ee1be669bc224011041eec858bb5a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7859418
Commit-Queue: Christian Dullweber <dullweber@chromium.org>
Reviewed-by: Elias Klim <elklm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1633417}
---
diff --git a/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc b/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc
index 4358c93..278d569 100644
--- a/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc
+++ b/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc
@@ -68,7 +68,12 @@
loading_indicator_web_view_ =
AddChildView(CreateWebView(this, browser_context));
- loading_indicator_web_view_->GetWebContents()->GetController().LoadURL(
+ auto* loading_contents = loading_indicator_web_view_->GetWebContents();
+ loading_contents->SetDelegate(this);
+ loading_contents->SetUserData(
+ kWebViewSidePanelWebContentsUserDataKey,
+ std::make_unique<WebViewSidePanelWebContentsUserData>(AsWeakPtr()));
+ loading_contents->GetController().LoadURL(
GURL(loading_screen_url), content::Referrer(),
ui::PAGE_TRANSITION_FROM_API, std::string());
web_view_ = AddChildView(CreateWebView(this, browser_context));
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page