Low CVSS 6.5 chrome Input Validation 🔧 Commit mapped

Overview

Low
Severity
6.5
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInsufficient validation of untrusted input in PageInfo
DescriptionInsufficient validation of untrusted input in PageInfo
ComponentPageInfo
Sub-componentPageInfo
Bug ClassInput Validation
Tracker503617508
Fix commite19bd0f4858a (chromium/src) +8/-2
CWECWE-20 (Improper input validation)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CISA KEVNot listed
CreditedGoogle
Reported2026-04-17 (per vendor advisory)
Fix landed2026-05-20 (public git)
Disclosed2026-06-30
Patch gap41 days — fix public in source before the advisory

Changed Functions

FunctionChangeNotes
if
chrome/browser/ui/views/page_info/web_view_side_panel_view.cc
modified

Files Changed

  • chrome/browser/ui/views/page_info/web_view_side_panel_view.cc
From e19bd0f4858ab20feeaee2cb393d1226cbef90a3 Mon Sep 17 00:00:00 2001
From: Christian Dullweber <dullweber@chromium.org>
Date: Wed, 20 May 2026 07:32:14 -0700
Subject: [PATCH] PageInfo: Properly set initiator origin

Ensure that we set the correct initiator for navigations from the ATP
webview.

Bug: 503617508
Change-Id: Id6d15a10ba4b306e13857cf05a30f02b867f5cf4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7863753
Reviewed-by: Nicola Tommasi <tommasin@chromium.org>
Commit-Queue: Christian Dullweber <dullweber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1633586}
---

diff --git a/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc b/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc
index 278d569..dd708da 100644
--- a/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc
+++ b/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc
@@ -17,6 +17,8 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/navigation_handle.h"
 #include "content/public/browser/page_navigator.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/referrer.h"
 #include "net/base/url_util.h"
@@ -127,8 +129,12 @@
                                 renderer_initiated);
   // If the navigation is initiated by the renderer process, we must set an
   // initiator origin.
-  if (renderer_initiated) {
-    params.initiator_origin = url::Origin::Create(url);
+  if (renderer_initiated && source_render_frame_host) {
+    params.initiator_origin =
+        source_render_frame_host->GetLastCommittedOrigin();
+    params.initiator_frame_token = source_render_frame_host->GetFrameToken();
+    params.initiator_process_id =
+        source_render_frame_host->GetProcess()->GetID().GetUnsafeValue();
   }
 
   // We can't open a new tab while the observer is running because it might
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.