From 2f8fdaf4f88fbaa932388a15aecb5669bdc4d0cd Mon Sep 17 00:00:00 2001
From: Jinsuk Kim <jinsukkim@chromium.org>
Date: Thu, 21 May 2026 06:19:40 -0700
Subject: [PATCH] [EphemeralTab] Use the last-committed URL for opening in a new tab

Uses the last-committed URL when opening in a new tab if the full
page URL was not specified. This addresses the vulnerability that
could lead to having the user navigate to an attacker-controlled
page.

Fixed: 514018024
Change-Id: Ic6e4e7d08a473ae0ad2b486a4a9a724260bfa91c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7859268
Commit-Queue: Jinsuk Kim <jinsukkim@chromium.org>
Reviewed-by: Shakti Sahu <shaktisahu@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1634210}
---

diff --git a/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabCoordinator.java b/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabCoordinator.java
index 128cc10..7aff9dd6 100644
--- a/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabCoordinator.java
+++ b/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabCoordinator.java
@@ -274,7 +274,10 @@
             assumeNonNull(mSheetContent);
             mBottomSheetController.hideContent(
                     mSheetContent, /* animate= */ true, StateChangeReason.PROMOTE_TAB);
-            var params = new LoadUrlParams(mFullPageUrl != null ? mFullPageUrl : mUrl);
+            if (mFullPageUrl == null) {
+                mFullPageUrl = assumeNonNull(mWebContents).getLastCommittedUrl();
+            }
+            var params = new LoadUrlParams(mFullPageUrl);
             mTabCreator.get().createNewTab(params, TabLaunchType.FROM_LINK, mTabProvider.get());
         }
     }