Low chrome Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInappropriate implementation in Printing
DescriptionInappropriate implementation in Printing
ComponentPrinting
Bug ClassLogic Error
Tracker514009654
Fix commite863db912b0f (chromium/src) +15/-2
CISA KEVNot listed
CreditedGoogle
Disclosed2026-06-30

Changed Functions

FunctionChangeNotes
if
chrome/browser/printing/print_view_manager.cc
modified

Files Changed

  • android_webview/browser/aw_print_manager.cc
  • chrome/browser/printing/print_view_manager.cc
  • chrome/browser/printing/print_view_manager_base.cc
From e863db912b0f3377879fb2c40b18b5713d7cc65b Mon Sep 17 00:00:00 2001
From: Lei Zhang <thestig@chromium.org>
Date: Mon, 01 Jun 2026 10:58:34 -0700
Subject: [PATCH] Printing: Check for inactive RFHs when handling more printing requests

Since only active RFHs should show UI elements, reject printing requests
from inactive RFHs in PrintViewManagerBase::ScriptedPrint(). Update
AwPrintManager::ScriptedPrint() for consistency.

In PrintViewManager::OnScriptedPrintPreviewCallback(), add the same
check as well.

Bug: 514009654, 516508002
Change-Id: I765c4d67d7e08e677dc742720df4e23d4a4c6877
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7884711
Reviewed-by: Bo Liu <boliu@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1639521}
---

diff --git a/android_webview/browser/aw_print_manager.cc b/android_webview/browser/aw_print_manager.cc
index 2abbd97..873f779 100644
--- a/android_webview/browser/aw_print_manager.cc
+++ b/android_webview/browser/aw_print_manager.cc
@@ -113,8 +113,15 @@
     ScriptedPrintCallback callback) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
 
+  content::RenderFrameHost* render_frame_host = GetCurrentTargetFrame();
+  if (!render_frame_host->IsActive()) {
+    // Only active RFHs should try to print.
+    std::move(callback).Run(nullptr);
+    return;
+  }
+
   if (scripted_params->is_scripted &&
-      GetCurrentTargetFrame()->IsNestedWithinFencedFrame()) {
+      render_frame_host->IsNestedWithinFencedFrame()) {
     DLOG(ERROR) << "Unexpected message received. Script Print is not allowed"
                    " in a fenced frame.";
     std::move(callback).Run(nullptr);
diff --git a/chrome/browser/printing/print_view_manager.cc b/chrome/browser/printing/print_view_manager.cc
index e650cb2..36d4122 100644
--- a/chrome/browser/printing/print_view_manager.cc
+++ b/chrome/browser/printing/print_view_manager.cc
@@ -561,7 +561,7 @@
   DCHECK(print_preview_rfh_);
 
   auto* rfh = content::RenderFrameHost::FromID(rfh_id);
-  if (!rfh || rfh != print_preview_rfh_) {
+  if (!rfh || rfh != print_preview_rfh_ || !print_preview_rfh_->IsActive()) {
     return;
   }
 
diff --git a/chrome/browser/printing/print_view_manager_base.cc b/chrome/browser/printing/print_view_manager_base.cc
index af02a63..02e10bb 100644
--- a/chrome/browser/printing/print_view_manager_base.cc
+++ b/chrome/browser/printing/print_view_manager_base.cc
@@ -620,6 +620,12 @@
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
 
   content::RenderFrameHost* render_frame_host = GetCurrentTargetFrame();
+  if (!render_frame_host->IsActive()) {
+    // Only active RFHs should show UI elements.
+    std::move(callback).Run(nullptr);
+    return;
+  }
+
   content::RenderProcessHost* render_process_host =
       render_frame_host->GetProcess();
   if (params->is_scripted && render_frame_host->IsNestedWithinFencedFrame()) {
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.