Chrome · PopupBlocker
CVE-2026-14089
Logic Error in PopupBlocker
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
switchcomponents/blocked_content/popup_blocker.cc |
modified |
Files Changed
components/blocked_content/popup_blocker.cc
Patch
From 7e16017eb02859b2c0273571c1369868501e9eca Mon Sep 17 00:00:00 2001
From: Charles Harrison <csharrison@chromium.org>
Date: Wed, 20 May 2026 17:22:05 -0700
Subject: [PATCH] Enforce popup blocking for split view.
For browser-initiated split views this should be a no-op. Renderer
initiated split views are not launched yet, but this seems reasonable
if/when they do.
This change also refactors ConsiderForPopupBlocking to use a switch
statement, so anyone adding a new WindowOpenDisposition will be forced
to make a decision.
Bug: 513188254
Change-Id: Ia702e698fc4d83695e443fc3f13e5a297648fbe3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7855263
Reviewed-by: Chris Thompson <cthomp@chromium.org>
Commit-Queue: Charles Harrison <csharrison@chromium.org>
Reviewed-by: Alison Gale <agale@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1633913}
---
diff --git a/components/blocked_content/popup_blocker.cc b/components/blocked_content/popup_blocker.cc
index 8b12c7dd..9e227da71 100644
--- a/components/blocked_content/popup_blocker.cc
+++ b/components/blocked_content/popup_blocker.cc
@@ -94,10 +94,26 @@
} // namespace
bool ConsiderForPopupBlocking(WindowOpenDisposition disposition) {
- return disposition == WindowOpenDisposition::NEW_POPUP ||
- disposition == WindowOpenDisposition::NEW_FOREGROUND_TAB ||
- disposition == WindowOpenDisposition::NEW_BACKGROUND_TAB ||
- disposition == WindowOpenDisposition::NEW_WINDOW;
+ switch (disposition) {
+ case WindowOpenDisposition::UNKNOWN:
+ case WindowOpenDisposition::CURRENT_TAB:
+ case WindowOpenDisposition::SINGLETON_TAB:
+ // OTR popups would be considered, but they cannot be triggered by any
+ // renderer message so we can ignore them.
+ case WindowOpenDisposition::OFF_THE_RECORD:
+ case WindowOpenDisposition::SAVE_TO_DISK:
+ case WindowOpenDisposition::IGNORE_ACTION:
+ case WindowOpenDisposition::SWITCH_TO_TAB:
+ // TODO(crbug.com/513188254): Support blocking PIP windows.
+ case WindowOpenDisposition::NEW_PICTURE_IN_PICTURE:
+ return false;
+ case WindowOpenDisposition::NEW_POPUP:
+ case WindowOpenDisposition::NEW_FOREGROUND_TAB:
+ case WindowOpenDisposition::NEW_BACKGROUND_TAB:
+ case WindowOpenDisposition::NEW_WINDOW:
+ case WindowOpenDisposition::NEW_SPLIT_VIEW:
+ return true;
+ }
}
std::unique_ptr<PopupNavigationDelegate> MaybeBlockPopup(
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page