Low chrome Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInappropriate implementation in DarkMode
DescriptionInappropriate implementation in DarkMode
ComponentDarkMode
Bug ClassLogic Error
Tracker513698452
Fix commit270816537725 (chromium/src) +0/-87
CISA KEVNot listed
CreditedGoogle
Disclosed2026-06-30

Changed Functions

FunctionChangeNotes
switch
third_party/blink/renderer/core/origin_trials/origin_trial_context.cc
modified
TEST_F
third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc
modified

Files Changed

  • third_party/blink/renderer/core/origin_trials/origin_trial_context.cc
  • third_party/blink/renderer/core/origin_trials/origin_trial_context.h
  • third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc
  • third_party/blink/renderer/platform/runtime_enabled_features.json5
  • third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-header.php
  • third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-meta.html
From 270816537725f6e59b03bb4ff2e1af30de5d2d3b Mon Sep 17 00:00:00 2001
From: Rune Lillesveen <futhark@chromium.org>
Date: Thu, 21 May 2026 12:52:02 -0700
Subject: [PATCH] Remove AutoDarkMode origin trial

Origin trial ended in 2022. Vulnerability issue dubiously claims this
could leak an auto-dark setting to other origins, but regardless this
origin trial is not running.

Bug: 513698452
Change-Id: I840b5ac7e4b2e685f878d7e346e145473da4df21
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7865166
Reviewed-by: Philip Rogers <pdr@chromium.org>
Commit-Queue: Rune Lillesveen <futhark@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1634475}
---

diff --git a/third_party/blink/renderer/core/origin_trials/origin_trial_context.cc b/third_party/blink/renderer/core/origin_trials/origin_trial_context.cc
index 09d6051..b1c94975 100644
--- a/third_party/blink/renderer/core/origin_trials/origin_trial_context.cc
+++ b/third_party/blink/renderer/core/origin_trials/origin_trial_context.cc
@@ -444,9 +444,6 @@
       }
     }
 
-    if (InstallSettingFeature(document, enabled_feature))
-      continue;
-
     InstallPropertiesPerFeature(script_state, enabled_feature);
     added_binding_features = true;
   }
@@ -454,19 +451,6 @@
   return added_binding_features;
 }
 
-bool OriginTrialContext::InstallSettingFeature(
-    Document& document,
-    mojom::blink::OriginTrialFeature enabled_feature) {
-  switch (enabled_feature) {
-    case mojom::blink::OriginTrialFeature::kAutoDarkMode:
-      if (document.GetSettings())
-        document.GetSettings()->SetForceDarkModeEnabled(true);
-      return true;
-    default:
-      return false;
-  }
-}
-
 void OriginTrialContext::AddFeature(mojom::blink::OriginTrialFeature feature) {
   enabled_features_.insert(feature);
   InitializePendingFeatures();
diff --git a/third_party/blink/renderer/core/origin_trials/origin_trial_context.h b/third_party/blink/renderer/core/origin_trials/origin_trial_context.h
index 1d849b67..25c107e4 100644
--- a/third_party/blink/renderer/core/origin_trials/origin_trial_context.h
+++ b/third_party/blink/renderer/core/origin_trials/origin_trial_context.h
@@ -237,10 +237,6 @@
       Document&,
       ScriptState*);
 
-  // Installs a settings feature for the relevant Document instance. Returns
-  // whether the given OriginTrialFeature describes a setting feature.
-  bool InstallSettingFeature(Document&, mojom::blink::OriginTrialFeature);
-
   // Caches raw origin trial token along with the parse result to
   // `trial_results_`.
   void CacheToken(const String& raw_token,
diff --git a/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc b/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc
index 3f87eaf..17f4292 100644
--- a/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc
+++ b/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc
@@ -545,29 +545,6 @@
           mojom::blink::OriginTrialFeature::kOriginTrialsSampleAPIImplied));
 }
 
-TEST_F(OriginTrialContextTest, SettingFeatureUpdatesDocumentSettings) {
-  // Create a page holder window/document with an OriginTrialContext.
-  auto page_holder = std::make_unique<DummyPageHolder>();
-  LocalDOMWindow* window = page_holder->GetFrame().DomWindow();
-  OriginTrialContext* context = window->GetOriginTrialContext();
-
-  // Force-disabled the AutoDarkMode feature in the page holder's settings.
-  ASSERT_TRUE(page_holder->GetDocument().GetSettings());
-  page_holder->GetDocument().GetSettings()->SetForceDarkModeEnabled(false);
-
-  // Enable a settings-based origin trial API ("AutoDarkMode").
-  context->AddFeature(mojom::blink::OriginTrialFeature::kAutoDarkMode);
-  EXPECT_TRUE(context->IsFeatureEnabled(
-      mojom::blink::OriginTrialFeature::kAutoDarkMode));
-
-  // Expect the AutoDarkMode setting to have been enabled.
-  EXPECT_TRUE(
-      page_holder->GetDocument().GetSettings()->GetForceDarkModeEnabled());
-
-  // TODO(crbug.com/1260410): Switch this test away from using the AutoDarkMode
-  // feature towards an OriginTrialsSampleAPI* feature.
-}
-
 // This test ensures that the feature and token data are correctly mapped. The
 // assertions mirror the code that is used to send origin trial overrides to the
 // browser process via RuntimeFeatureStateOverrideContext's IPC.
diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
index aa5e1c67..c9804c1 100644
--- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
+++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
@@ -759,7 +759,6 @@
     {
       name: "AutoDarkMode",
       base_feature: "none",
-      origin_trial_feature_name: "AutoDarkMode",
     },
     {
       // When enabled, the dark mode filter (Auto Dark / force-dark) skips
diff --git a/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-header.php b/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-header.php
deleted file mode 100644
index 0a1487e..0000000
--- a/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-header.php
+++ /dev/null
@@ -1,22 +0,0 @@
-<?php
-// Generate token with the command:
-// generate_token.py http://127.0.0.1:8000 AutoDarkMode --expire-timestamp=2000000000
-
-header("Origin-Trial: AyWCm6J71a4pwPzRIUOrEfpDSlIjoONkqThP5D2UOXaZUutVQAD3RfGQ6VCfkIiwrRSafaB2Pa64M+6g0HHnUg0AAABUeyJvcmlnaW4iOiAiaHR0cDovLzEyNy4wLjAuMTo4MDAwIiwgImZlYXR1cmUiOiAiQXV0b0RhcmtNb2RlIiwgImV4cGlyeSI6IDIwMDAwMDAwMDB9");
-?>
-<!doctype html>
-<meta charset="utf-8">
-<title>Auto Dark Mode - behavior imposed by the origin trial (HTTP header)</title>
-<script src="../../resources/testharness.js"></script>
-<script src="../../resources/testharnessreport.js"></script>
-<div id="detection" style="background-color: canvas; color-scheme: light"></div>
-<script>
-  test(test => {
-    // Auto Dark Mode can be detected by adjusted values for system color names,
-    // such as the "canvas" value used in this example, which defaults to white:
-    // https://www.w3.org/TR/css-color-4/#valdef-system-color-canvas
-    assert_not_equals(
-      getComputedStyle(detection).backgroundColor, 'rgb(255, 255, 255)');
-
-  }, "The Auto Dark Mode Origin Trial alters coloring of the Web content");
-</script>
diff --git a/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-meta.html b/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-meta.html
deleted file mode 100644
index 63929cd..0000000
--- a/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-meta.html
+++ /dev/null
@@ -1,21 +0,0 @@
-<!doctype html>
-<meta charset="utf-8">
-<!-- Generate token with the command:
-generate_token.py http://127.0.0.1:8000 AutoDarkMode --expire-timestamp=2000000000
--- -->
-<meta http-equiv="origin-trial"
-  content="AyWCm6J71a4pwPzRIUOrEfpDSlIjoONkqThP5D2UOXaZUutVQAD3RfGQ6VCfkIiwrRSafaB2Pa64M+6g0HHnUg0AAABUeyJvcmlnaW4iOiAiaHR0cDovLzEyNy4wLjAuMTo4MDAwIiwgImZlYXR1cmUiOiAiQXV0b0RhcmtNb2RlIiwgImV4cGlyeSI6IDIwMDAwMDAwMDB9" />
-<title>Auto Dark Mode - behavior imposed by the origin trial (meta tag)</title>
-<script src="../../resources/testharness.js"></script>
-<script src="../../resources/testharnessreport.js"></script>
-<div id="detection" style="background-color: canvas; color-scheme: light"></div>
-<script>
-  test(test => {
-    // Auto Dark Mode can be detected by adjusted values for system color names,
-    // such as the "canvas" value used in this example, which defaults to white:
-    // https://www.w3.org/TR/css-color-4/#valdef-system-color-canvas
-    assert_not_equals(
-      getComputedStyle(detection).backgroundColor, 'rgb(255, 255, 255)');
-
-  }, "The Auto Dark Mode Origin Trial alters coloring of the Web content");
-</script>
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc b/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc
index 3f87eaf..17f4292 100644
--- a/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc
+++ b/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc
@@ -545,29 +545,6 @@
           mojom::blink::OriginTrialFeature::kOriginTrialsSampleAPIImplied));
 }
 
-TEST_F(OriginTrialContextTest, SettingFeatureUpdatesDocumentSettings) {
-  // Create a page holder window/document with an OriginTrialContext.
-  auto page_holder = std::make_unique<DummyPageHolder>();
-  LocalDOMWindow* window = page_holder->GetFrame().DomWindow();
-  OriginTrialContext* context = window->GetOriginTrialContext();
-
-  // Force-disabled the AutoDarkMode feature in the page holder's settings.
-  ASSERT_TRUE(page_holder->GetDocument().GetSettings());
-  page_holder->GetDocument().GetSettings()->SetForceDarkModeEnabled(false);
-
-  // Enable a settings-based origin trial API ("AutoDarkMode").
-  context->AddFeature(mojom::blink::OriginTrialFeature::kAutoDarkMode);
-  EXPECT_TRUE(context->IsFeatureEnabled(
-      mojom::blink::OriginTrialFeature::kAutoDarkMode));
-
-  // Expect the AutoDarkMode setting to have been enabled.
-  EXPECT_TRUE(
-      page_holder->GetDocument().GetSettings()->GetForceDarkModeEnabled());
-
-  // TODO(crbug.com/1260410): Switch this test away from using the AutoDarkMode
-  // feature towards an OriginTrialsSampleAPI* feature.
-}
-
 // This test ensures that the feature and token data are correctly mapped. The
 // assertions mirror the code that is used to send origin trial overrides to the
 // browser process via RuntimeFeatureStateOverrideContext's IPC.
diff --git a/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-header.php b/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-header.php
deleted file mode 100644
index 0a1487e..0000000
--- a/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-header.php
+++ /dev/null
@@ -1,22 +0,0 @@
-<?php
-// Generate token with the command:
-// generate_token.py http://127.0.0.1:8000 AutoDarkMode --expire-timestamp=2000000000
-
-header("Origin-Trial: AyWCm6J71a4pwPzRIUOrEfpDSlIjoONkqThP5D2UOXaZUutVQAD3RfGQ6VCfkIiwrRSafaB2Pa64M+6g0HHnUg0AAABUeyJvcmlnaW4iOiAiaHR0cDovLzEyNy4wLjAuMTo4MDAwIiwgImZlYXR1cmUiOiAiQXV0b0RhcmtNb2RlIiwgImV4cGlyeSI6IDIwMDAwMDAwMDB9");
-?>
-<!doctype html>
-<meta charset="utf-8">
-<title>Auto Dark Mode - behavior imposed by the origin trial (HTTP header)</title>
-<script src="../../resources/testharness.js"></script>
-<script src="../../resources/testharnessreport.js"></script>
-<div id="detection" style="background-color: canvas; color-scheme: light"></div>
-<script>
-  test(test => {
-    // Auto Dark Mode can be detected by adjusted values for system color names,
-    // such as the "canvas" value used in this example, which defaults to white:
-    // https://www.w3.org/TR/css-color-4/#valdef-system-color-canvas
-    assert_not_equals(
-      getComputedStyle(detection).backgroundColor, 'rgb(255, 255, 255)');
-
-  }, "The Auto Dark Mode Origin Trial alters coloring of the Web content");
-</script>
diff --git a/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-meta.html b/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-meta.html
deleted file mode 100644
index 63929cd..0000000
--- a/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-meta.html
+++ /dev/null
@@ -1,21 +0,0 @@
-<!doctype html>
-<meta charset="utf-8">
-<!-- Generate token with the command:
-generate_token.py http://127.0.0.1:8000 AutoDarkMode --expire-timestamp=2000000000
--- -->
-<meta http-equiv="origin-trial"
-  content="AyWCm6J71a4pwPzRIUOrEfpDSlIjoONkqThP5D2UOXaZUutVQAD3RfGQ6VCfkIiwrRSafaB2Pa64M+6g0HHnUg0AAABUeyJvcmlnaW4iOiAiaHR0cDovLzEyNy4wLjAuMTo4MDAwIiwgImZlYXR1cmUiOiAiQXV0b0RhcmtNb2RlIiwgImV4cGlyeSI6IDIwMDAwMDAwMDB9" />
-<title>Auto Dark Mode - behavior imposed by the origin trial (meta tag)</title>
-<script src="../../resources/testharness.js"></script>
-<script src="../../resources/testharnessreport.js"></script>
-<div id="detection" style="background-color: canvas; color-scheme: light"></div>
-<script>
-  test(test => {
-    // Auto Dark Mode can be detected by adjusted values for system color names,
-    // such as the "canvas" value used in this example, which defaults to white:
-    // https://www.w3.org/TR/css-color-4/#valdef-system-color-canvas
-    assert_not_equals(
-      getComputedStyle(detection).backgroundColor, 'rgb(255, 255, 255)');
-
-  }, "The Auto Dark Mode Origin Trial alters coloring of the Web content");
-</script>
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.