Chrome · PageInfo
CVE-2026-14065
Logic Error in PageInfo
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifchrome/browser/ui/views/page_info/web_view_side_panel_view.cc |
modified |
Files Changed
chrome/browser/ui/views/page_info/web_view_side_panel_view.cc
Patch
From e19bd0f4858ab20feeaee2cb393d1226cbef90a3 Mon Sep 17 00:00:00 2001
From: Christian Dullweber <dullweber@chromium.org>
Date: Wed, 20 May 2026 07:32:14 -0700
Subject: [PATCH] PageInfo: Properly set initiator origin
Ensure that we set the correct initiator for navigations from the ATP
webview.
Bug: 503617508
Change-Id: Id6d15a10ba4b306e13857cf05a30f02b867f5cf4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7863753
Reviewed-by: Nicola Tommasi <tommasin@chromium.org>
Commit-Queue: Christian Dullweber <dullweber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1633586}
---
diff --git a/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc b/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc
index 278d569..dd708da 100644
--- a/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc
+++ b/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc
@@ -17,6 +17,8 @@
#include "content/public/browser/browser_thread.h"
#include "content/public/browser/navigation_handle.h"
#include "content/public/browser/page_navigator.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/render_process_host.h"
#include "content/public/browser/web_contents.h"
#include "content/public/common/referrer.h"
#include "net/base/url_util.h"
@@ -127,8 +129,12 @@
renderer_initiated);
// If the navigation is initiated by the renderer process, we must set an
// initiator origin.
- if (renderer_initiated) {
- params.initiator_origin = url::Origin::Create(url);
+ if (renderer_initiated && source_render_frame_host) {
+ params.initiator_origin =
+ source_render_frame_host->GetLastCommittedOrigin();
+ params.initiator_frame_token = source_render_frame_host->GetFrameToken();
+ params.initiator_process_id =
+ source_render_frame_host->GetProcess()->GetID().GetUnsafeValue();
}
// We can't open a new tab while the observer is running because it might
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page