Low chrome Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInsufficient validation of untrusted input in Chrome for iOS
DescriptionInsufficient validation of untrusted input in Chrome for iOS
ComponentChrome for iOS
Bug ClassLogic Error
Tracker514070067
Fix commit293f9e2fb3a7 (chromium/src) +14/-5
CISA KEVNot listed
CreditedGoogle
Disclosed2026-06-30

Files Changed

  • components/ui_metrics/canonical_url_share_metrics_types.h
  • ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever.mm
  • ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mm
  • tools/metrics/histograms/metadata/mobile/enums.xml
From 293f9e2fb3a7e2955f6ca0f554e3112e3d0c749d Mon Sep 17 00:00:00 2001
From: Elmehdi Rahmaoui <erahmaoui@google.com>
Date: Thu, 21 May 2026 02:05:13 -0700
Subject: [PATCH] [iOS] Introduce FAILED_CANONICAL_URL_NOT_HTTP_NOR_HTTPS share metric

The aim of this CL is to update the CanonicalURLResult enum and
corresponding unit tests to introduce a dedicated failure metric for
non-HTTP/HTTPS canonical URLs.

Bug: 514070067
Change-Id: I2a8a848648149c8d85f211d920c87d73c20c2458
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7859830
Reviewed-by: Mark Cogan <marq@chromium.org>
Reviewed-by: Michael Thiessen <mthiesse@chromium.org>
Commit-Queue: Elmehdi Rahmaoui <erahmaoui@google.com>
Reviewed-by: Colin Blundell <blundell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1634123}
---

diff --git a/components/ui_metrics/canonical_url_share_metrics_types.h b/components/ui_metrics/canonical_url_share_metrics_types.h
index 0310e06..6fd8b31 100644
--- a/components/ui_metrics/canonical_url_share_metrics_types.h
+++ b/components/ui_metrics/canonical_url_share_metrics_types.h
@@ -37,6 +37,10 @@
   // (but the visible URL is).
   SUCCESS_CANONICAL_URL_NOT_HTTPS,
 
+  // The canonical URL retrieval failed because the retrieved canonical URL is
+  // not HTTP nor HTTPS.
+  FAILED_CANONICAL_URL_NOT_HTTP_NOR_HTTPS,
+
   // The count of canonical URL results. This must be the last item in the enum.
   CANONICAL_URL_RESULT_COUNT
 };
diff --git a/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever.mm b/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever.mm
index 59627810..aab817c8 100644
--- a/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever.mm
+++ b/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever.mm
@@ -46,9 +46,13 @@
   } else if (!canonical_url.is_valid()) {
     // Log result if an invalid canonical URL is found.
     LogCanonicalUrlResultHistogram(ui_metrics::FAILED_CANONICAL_URL_INVALID);
+  } else if (!canonical_url.SchemeIsHTTPOrHTTPS()) {
+    // Log result if a canonical URL is not HTTP nor HTTPS.
+    LogCanonicalUrlResultHistogram(
+        ui_metrics::FAILED_CANONICAL_URL_NOT_HTTP_NOR_HTTPS);
   } else {
-    // If the canonical URL is valid, then the retrieval was successful,
-    // and the success can be logged.
+    // If the canonical URL is valid, and HTTP or HTTPS then the retrieval was
+    // successful, and the success can be logged.
     LogCanonicalUrlResultHistogram(
         !canonical_url.SchemeIsCryptographic()
             ? ui_metrics::SUCCESS_CANONICAL_URL_NOT_HTTPS
@@ -57,8 +61,6 @@
             : ui_metrics::SUCCESS_CANONICAL_URL_DIFFERENT_FROM_VISIBLE);
   }
 
-  // TODO(crbug.com/514070067): Update the metric, to consider an non HTTP/HTTPS
-  // canonical_url as failure.
   return canonical_url.is_valid() && canonical_url.SchemeIsHTTPOrHTTPS()
              ? canonical_url
              : GURL();
diff --git a/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mm b/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mm
index 88a0d9b8..77893e61 100644
--- a/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mm
+++ b/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mm
@@ -188,5 +188,5 @@
   EXPECT_TRUE(url.is_empty());
   histogram_tester_.ExpectUniqueSample(
       ui_metrics::kCanonicalURLResultHistogram,
-      ui_metrics::SUCCESS_CANONICAL_URL_NOT_HTTPS, 1);
+      ui_metrics::FAILED_CANONICAL_URL_NOT_HTTP_NOR_HTTPS, 1);
 }
diff --git a/tools/metrics/histograms/metadata/mobile/enums.xml b/tools/metrics/histograms/metadata/mobile/enums.xml
index 9162281..66ad86c 100644
--- a/tools/metrics/histograms/metadata/mobile/enums.xml
+++ b/tools/metrics/histograms/metadata/mobile/enums.xml
@@ -46,6 +46,9 @@
   <int value="6"
       label="Canonical URL retrieved: Canonical URL not HTTPS (but visible
              URL is)"/>
+  <int value="7"
+      label="Canonical URL not retrieved: Canonical URL not HTTP nor HTTPS
+             (but visible URL is)"/>
 </enum>
 
 <enum name="ContextMenuIOSCopyImage">
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mm b/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mm
index 88a0d9b8..77893e61 100644
--- a/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mm
+++ b/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mm
@@ -188,5 +188,5 @@
   EXPECT_TRUE(url.is_empty());
   histogram_tester_.ExpectUniqueSample(
       ui_metrics::kCanonicalURLResultHistogram,
-      ui_metrics::SUCCESS_CANONICAL_URL_NOT_HTTPS, 1);
+      ui_metrics::FAILED_CANONICAL_URL_NOT_HTTP_NOR_HTTPS, 1);
 }
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.