Chrome · Enterprise
CVE-2026-14112
Logic Error in Enterprise
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
components/policy/core/common/cloud/cloud_policy_client_registration_helper.cc
Patch
From 6e1d077657902634d9a5d74b7850e6e323a3444c Mon Sep 17 00:00:00 2001
From: Owen Min <zmin@chromium.org>
Date: Thu, 28 May 2026 01:07:10 -0700
Subject: [PATCH] Stop logging OAuth access token in DVLOG.
The access token is sensitive and should not be logged.
Bug: 513713946
Change-Id: I1ed8b0af8455b380c5d22aeb8eefa61537e4ae6c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7879506
Auto-Submit: Owen Min <zmin@chromium.org>
Commit-Queue: Stanisław Solarewicz <ssolarewicz@chromium.org>
Reviewed-by: Stanisław Solarewicz <ssolarewicz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1637532}
---
diff --git a/components/policy/core/common/cloud/cloud_policy_client_registration_helper.cc b/components/policy/core/common/cloud/cloud_policy_client_registration_helper.cc
index 3fbfaa4..70cb568 100644
--- a/components/policy/core/common/cloud/cloud_policy_client_registration_helper.cc
+++ b/components/policy/core/common/cloud/cloud_policy_client_registration_helper.cc
@@ -170,8 +170,7 @@
// Cache the access token to be used after the GetUserInfo call.
oauth_access_token_ = access_token;
- DVLOG_POLICY(1, POLICY_AUTH)
- << "Fetched new scoped OAuth token:" << oauth_access_token_;
+ DVLOG_POLICY(1, POLICY_AUTH) << "Fetched new scoped OAuth token";
// Now we've gotten our access token - contact GAIA to see if this is a
// hosted domain.
user_info_fetcher_ =
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page