Chrome · DarkMode
CVE-2026-14110
Logic Error in DarkMode
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
switchthird_party/blink/renderer/core/origin_trials/origin_trial_context.cc |
modified | |
TEST_Fthird_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc |
modified |
Files Changed
third_party/blink/renderer/core/origin_trials/origin_trial_context.ccthird_party/blink/renderer/core/origin_trials/origin_trial_context.hthird_party/blink/renderer/core/origin_trials/origin_trial_context_test.ccthird_party/blink/renderer/platform/runtime_enabled_features.json5third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-header.phpthird_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-meta.html
Patch
From 270816537725f6e59b03bb4ff2e1af30de5d2d3b Mon Sep 17 00:00:00 2001
From: Rune Lillesveen <futhark@chromium.org>
Date: Thu, 21 May 2026 12:52:02 -0700
Subject: [PATCH] Remove AutoDarkMode origin trial
Origin trial ended in 2022. Vulnerability issue dubiously claims this
could leak an auto-dark setting to other origins, but regardless this
origin trial is not running.
Bug: 513698452
Change-Id: I840b5ac7e4b2e685f878d7e346e145473da4df21
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7865166
Reviewed-by: Philip Rogers <pdr@chromium.org>
Commit-Queue: Rune Lillesveen <futhark@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1634475}
---
diff --git a/third_party/blink/renderer/core/origin_trials/origin_trial_context.cc b/third_party/blink/renderer/core/origin_trials/origin_trial_context.cc
index 09d6051..b1c94975 100644
--- a/third_party/blink/renderer/core/origin_trials/origin_trial_context.cc
+++ b/third_party/blink/renderer/core/origin_trials/origin_trial_context.cc
@@ -444,9 +444,6 @@
}
}
- if (InstallSettingFeature(document, enabled_feature))
- continue;
-
InstallPropertiesPerFeature(script_state, enabled_feature);
added_binding_features = true;
}
@@ -454,19 +451,6 @@
return added_binding_features;
}
-bool OriginTrialContext::InstallSettingFeature(
- Document& document,
- mojom::blink::OriginTrialFeature enabled_feature) {
- switch (enabled_feature) {
- case mojom::blink::OriginTrialFeature::kAutoDarkMode:
- if (document.GetSettings())
- document.GetSettings()->SetForceDarkModeEnabled(true);
- return true;
- default:
- return false;
- }
-}
-
void OriginTrialContext::AddFeature(mojom::blink::OriginTrialFeature feature) {
enabled_features_.insert(feature);
InitializePendingFeatures();
diff --git a/third_party/blink/renderer/core/origin_trials/origin_trial_context.h b/third_party/blink/renderer/core/origin_trials/origin_trial_context.h
index 1d849b67..25c107e4 100644
--- a/third_party/blink/renderer/core/origin_trials/origin_trial_context.h
+++ b/third_party/blink/renderer/core/origin_trials/origin_trial_context.h
@@ -237,10 +237,6 @@
Document&,
ScriptState*);
- // Installs a settings feature for the relevant Document instance. Returns
- // whether the given OriginTrialFeature describes a setting feature.
- bool InstallSettingFeature(Document&, mojom::blink::OriginTrialFeature);
-
// Caches raw origin trial token along with the parse result to
// `trial_results_`.
void CacheToken(const String& raw_token,
diff --git a/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc b/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc
index 3f87eaf..17f4292 100644
--- a/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc
+++ b/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc
@@ -545,29 +545,6 @@
mojom::blink::OriginTrialFeature::kOriginTrialsSampleAPIImplied));
}
-TEST_F(OriginTrialContextTest, SettingFeatureUpdatesDocumentSettings) {
- // Create a page holder window/document with an OriginTrialContext.
- auto page_holder = std::make_unique<DummyPageHolder>();
- LocalDOMWindow* window = page_holder->GetFrame().DomWindow();
- OriginTrialContext* context = window->GetOriginTrialContext();
-
- // Force-disabled the AutoDarkMode feature in the page holder's settings.
- ASSERT_TRUE(page_holder->GetDocument().GetSettings());
- page_holder->GetDocument().GetSettings()->SetForceDarkModeEnabled(false);
-
- // Enable a settings-based origin trial API ("AutoDarkMode").
- context->AddFeature(mojom::blink::OriginTrialFeature::kAutoDarkMode);
- EXPECT_TRUE(context->IsFeatureEnabled(
- mojom::blink::OriginTrialFeature::kAutoDarkMode));
-
- // Expect the AutoDarkMode setting to have been enabled.
- EXPECT_TRUE(
- page_holder->GetDocument().GetSettings()->GetForceDarkModeEnabled());
-
- // TODO(crbug.com/1260410): Switch this test away from using the AutoDarkMode
- // feature towards an OriginTrialsSampleAPI* feature.
-}
-
// This test ensures that the feature and token data are correctly mapped. The
// assertions mirror the code that is used to send origin trial overrides to the
// browser process via RuntimeFeatureStateOverrideContext's IPC.
diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
index aa5e1c67..c9804c1 100644
--- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
+++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
@@ -759,7 +759,6 @@
{
name: "AutoDarkMode",
base_feature: "none",
- origin_trial_feature_name: "AutoDarkMode",
},
{
// When enabled, the dark mode filter (Auto Dark / force-dark) skips
diff --git a/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-header.php b/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-header.php
deleted file mode 100644
index 0a1487e..0000000
--- a/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-header.php
+++ /dev/null
@@ -1,22 +0,0 @@
-<?php
-// Generate token with the command:
-// generate_token.py http://127.0.0.1:8000 AutoDarkMode --expire-timestamp=2000000000
-
-header("Origin-Trial: AyWCm6J71a4pwPzRIUOrEfpDSlIjoONkqThP5D2UOXaZUutVQAD3RfGQ6VCfkIiwrRSafaB2Pa64M+6g0HHnUg0AAABUeyJvcmlnaW4iOiAiaHR0cDovLzEyNy4wLjAuMTo4MDAwIiwgImZlYXR1cmUiOiAiQXV0b0RhcmtNb2RlIiwgImV4cGlyeSI6IDIwMDAwMDAwMDB9");
-?>
-<!doctype html>
-<meta charset="utf-8">
-<title>Auto Dark Mode - behavior imposed by the origin trial (HTTP header)</title>
-<script src="../../resources/testharness.js"></script>
-<script src="../../resources/testharnessreport.js"></script>
-<div id="detection" style="background-color: canvas; color-scheme: light"></div>
-<script>
- test(test => {
- // Auto Dark Mode can be detected by adjusted values for system color names,
- // such as the "canvas" value used in this example, which defaults to white:
- // https://www.w3.org/TR/css-color-4/#valdef-system-color-canvas
- assert_not_equals(
- getComputedStyle(detection).backgroundColor, 'rgb(255, 255, 255)');
-
- }, "The Auto Dark Mode Origin Trial alters coloring of the Web content");
-</script>
diff --git a/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-meta.html b/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-meta.html
deleted file mode 100644
index 63929cd..0000000
--- a/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-meta.html
+++ /dev/null
@@ -1,21 +0,0 @@
-<!doctype html>
-<meta charset="utf-8">
-<!-- Generate token with the command:
-generate_token.py http://127.0.0.1:8000 AutoDarkMode --expire-timestamp=2000000000
--- -->
-<meta http-equiv="origin-trial"
- content="AyWCm6J71a4pwPzRIUOrEfpDSlIjoONkqThP5D2UOXaZUutVQAD3RfGQ6VCfkIiwrRSafaB2Pa64M+6g0HHnUg0AAABUeyJvcmlnaW4iOiAiaHR0cDovLzEyNy4wLjAuMTo4MDAwIiwgImZlYXR1cmUiOiAiQXV0b0RhcmtNb2RlIiwgImV4cGlyeSI6IDIwMDAwMDAwMDB9" />
-<title>Auto Dark Mode - behavior imposed by the origin trial (meta tag)</title>
-<script src="../../resources/testharness.js"></script>
-<script src="../../resources/testharnessreport.js"></script>
-<div id="detection" style="background-color: canvas; color-scheme: light"></div>
-<script>
- test(test => {
- // Auto Dark Mode can be detected by adjusted values for system color names,
- // such as the "canvas" value used in this example, which defaults to white:
- // https://www.w3.org/TR/css-color-4/#valdef-system-color-canvas
- assert_not_equals(
- getComputedStyle(detection).backgroundColor, 'rgb(255, 255, 255)');
-
- }, "The Auto Dark Mode Origin Trial alters coloring of the Web content");
-</script>
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc b/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc
index 3f87eaf..17f4292 100644
--- a/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc
+++ b/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc
@@ -545,29 +545,6 @@
mojom::blink::OriginTrialFeature::kOriginTrialsSampleAPIImplied));
}
-TEST_F(OriginTrialContextTest, SettingFeatureUpdatesDocumentSettings) {
- // Create a page holder window/document with an OriginTrialContext.
- auto page_holder = std::make_unique<DummyPageHolder>();
- LocalDOMWindow* window = page_holder->GetFrame().DomWindow();
- OriginTrialContext* context = window->GetOriginTrialContext();
-
- // Force-disabled the AutoDarkMode feature in the page holder's settings.
- ASSERT_TRUE(page_holder->GetDocument().GetSettings());
- page_holder->GetDocument().GetSettings()->SetForceDarkModeEnabled(false);
-
- // Enable a settings-based origin trial API ("AutoDarkMode").
- context->AddFeature(mojom::blink::OriginTrialFeature::kAutoDarkMode);
- EXPECT_TRUE(context->IsFeatureEnabled(
- mojom::blink::OriginTrialFeature::kAutoDarkMode));
-
- // Expect the AutoDarkMode setting to have been enabled.
- EXPECT_TRUE(
- page_holder->GetDocument().GetSettings()->GetForceDarkModeEnabled());
-
- // TODO(crbug.com/1260410): Switch this test away from using the AutoDarkMode
- // feature towards an OriginTrialsSampleAPI* feature.
-}
-
// This test ensures that the feature and token data are correctly mapped. The
// assertions mirror the code that is used to send origin trial overrides to the
// browser process via RuntimeFeatureStateOverrideContext's IPC.
diff --git a/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-header.php b/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-header.php
deleted file mode 100644
index 0a1487e..0000000
--- a/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-header.php
+++ /dev/null
@@ -1,22 +0,0 @@
-<?php
-// Generate token with the command:
-// generate_token.py http://127.0.0.1:8000 AutoDarkMode --expire-timestamp=2000000000
-
-header("Origin-Trial: AyWCm6J71a4pwPzRIUOrEfpDSlIjoONkqThP5D2UOXaZUutVQAD3RfGQ6VCfkIiwrRSafaB2Pa64M+6g0HHnUg0AAABUeyJvcmlnaW4iOiAiaHR0cDovLzEyNy4wLjAuMTo4MDAwIiwgImZlYXR1cmUiOiAiQXV0b0RhcmtNb2RlIiwgImV4cGlyeSI6IDIwMDAwMDAwMDB9");
-?>
-<!doctype html>
-<meta charset="utf-8">
-<title>Auto Dark Mode - behavior imposed by the origin trial (HTTP header)</title>
-<script src="../../resources/testharness.js"></script>
-<script src="../../resources/testharnessreport.js"></script>
-<div id="detection" style="background-color: canvas; color-scheme: light"></div>
-<script>
- test(test => {
- // Auto Dark Mode can be detected by adjusted values for system color names,
- // such as the "canvas" value used in this example, which defaults to white:
- // https://www.w3.org/TR/css-color-4/#valdef-system-color-canvas
- assert_not_equals(
- getComputedStyle(detection).backgroundColor, 'rgb(255, 255, 255)');
-
- }, "The Auto Dark Mode Origin Trial alters coloring of the Web content");
-</script>
diff --git a/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-meta.html b/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-meta.html
deleted file mode 100644
index 63929cd..0000000
--- a/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-meta.html
+++ /dev/null
@@ -1,21 +0,0 @@
-<!doctype html>
-<meta charset="utf-8">
-<!-- Generate token with the command:
-generate_token.py http://127.0.0.1:8000 AutoDarkMode --expire-timestamp=2000000000
--- -->
-<meta http-equiv="origin-trial"
- content="AyWCm6J71a4pwPzRIUOrEfpDSlIjoONkqThP5D2UOXaZUutVQAD3RfGQ6VCfkIiwrRSafaB2Pa64M+6g0HHnUg0AAABUeyJvcmlnaW4iOiAiaHR0cDovLzEyNy4wLjAuMTo4MDAwIiwgImZlYXR1cmUiOiAiQXV0b0RhcmtNb2RlIiwgImV4cGlyeSI6IDIwMDAwMDAwMDB9" />
-<title>Auto Dark Mode - behavior imposed by the origin trial (meta tag)</title>
-<script src="../../resources/testharness.js"></script>
-<script src="../../resources/testharnessreport.js"></script>
-<div id="detection" style="background-color: canvas; color-scheme: light"></div>
-<script>
- test(test => {
- // Auto Dark Mode can be detected by adjusted values for system color names,
- // such as the "canvas" value used in this example, which defaults to white:
- // https://www.w3.org/TR/css-color-4/#valdef-system-color-canvas
- assert_not_equals(
- getComputedStyle(detection).backgroundColor, 'rgb(255, 255, 255)');
-
- }, "The Auto Dark Mode Origin Trial alters coloring of the Web content");
-</script>
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page