Chrome · Chrome for iOS
CVE-2026-14128
Logic Error in Chrome for iOS
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
ios/web/navigation/navigation_manager_impl.hios/web/navigation/navigation_manager_impl.mm
Patch
From b5bc8ec2d0145e1e59504fbd3ebdcba82df1b296 Mon Sep 17 00:00:00 2001
From: Federica Germinario <fedegermi@google.com>
Date: Thu, 21 May 2026 10:00:51 -0700
Subject: [PATCH] [ios] Account for port changes in GetVisibleWebViewOriginURL cache
This change updates the caching mechanism for the visible URL's origin
in GetVisibleWebViewOriginURL to consider the port number.
Previously, the cache only checked the scheme and host. This could lead
to incorrect origin values being returned if the port number changed
while the scheme and host remained the same.
Fixed: 514015836
Change-Id: Ib6aa0da5469ba8a630b81a18055a6645629aeed6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7867751
Auto-Submit: Federica Germinario <fedegermi@google.com>
Commit-Queue: Mike Dougherty <michaeldo@chromium.org>
Reviewed-by: Mike Dougherty <michaeldo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1634372}
---
diff --git a/ios/web/navigation/navigation_manager_impl.h b/ios/web/navigation/navigation_manager_impl.h
index d238e50..ae874b1 100644
--- a/ios/web/navigation/navigation_manager_impl.h
+++ b/ios/web/navigation/navigation_manager_impl.h
@@ -321,6 +321,7 @@
mutable GURL cached_visible_origin_url_;
mutable NSString* cached_visible_host_nsstring_;
mutable NSString* cached_visible_scheme_nsstring_;
+ mutable NSNumber* cached_visible_port_nsnumber_;
std::vector<std::unique_ptr<NavigationItemImpl>> cached_items_;
int cached_current_item_index_;
diff --git a/ios/web/navigation/navigation_manager_impl.mm b/ios/web/navigation/navigation_manager_impl.mm
index 6323f60d..a4a985b2 100644
--- a/ios/web/navigation/navigation_manager_impl.mm
+++ b/ios/web/navigation/navigation_manager_impl.mm
@@ -1494,12 +1494,14 @@
// Retain the url to reduce the number of calls to `proxy.URL` which may be
// very expensive after being called hundreds of time for one navigation.
NSURL* url = proxy.URL;
- if (![cached_visible_host_nsstring_ isEqualToString:url.host] ||
+ if (![cached_visible_port_nsnumber_ isEqual:url.port] ||
+ ![cached_visible_host_nsstring_ isEqualToString:url.host] ||
![cached_visible_scheme_nsstring_ isEqualToString:url.scheme]) {
cached_visible_origin_url_ =
net::GURLWithNSURL(url).DeprecatedGetOriginAsURL();
cached_visible_host_nsstring_ = url.host;
cached_visible_scheme_nsstring_ = url.scheme;
+ cached_visible_port_nsnumber_ = url.port;
}
return cached_visible_origin_url_;
}
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page