Chrome · Chrome for iOS
CVE-2026-14137
Logic Error in Chrome for iOS
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
components/ui_metrics/canonical_url_share_metrics_types.hios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever.mmios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mmtools/metrics/histograms/metadata/mobile/enums.xml
Patch
From 293f9e2fb3a7e2955f6ca0f554e3112e3d0c749d Mon Sep 17 00:00:00 2001
From: Elmehdi Rahmaoui <erahmaoui@google.com>
Date: Thu, 21 May 2026 02:05:13 -0700
Subject: [PATCH] [iOS] Introduce FAILED_CANONICAL_URL_NOT_HTTP_NOR_HTTPS share metric
The aim of this CL is to update the CanonicalURLResult enum and
corresponding unit tests to introduce a dedicated failure metric for
non-HTTP/HTTPS canonical URLs.
Bug: 514070067
Change-Id: I2a8a848648149c8d85f211d920c87d73c20c2458
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7859830
Reviewed-by: Mark Cogan <marq@chromium.org>
Reviewed-by: Michael Thiessen <mthiesse@chromium.org>
Commit-Queue: Elmehdi Rahmaoui <erahmaoui@google.com>
Reviewed-by: Colin Blundell <blundell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1634123}
---
diff --git a/components/ui_metrics/canonical_url_share_metrics_types.h b/components/ui_metrics/canonical_url_share_metrics_types.h
index 0310e06..6fd8b31 100644
--- a/components/ui_metrics/canonical_url_share_metrics_types.h
+++ b/components/ui_metrics/canonical_url_share_metrics_types.h
@@ -37,6 +37,10 @@
// (but the visible URL is).
SUCCESS_CANONICAL_URL_NOT_HTTPS,
+ // The canonical URL retrieval failed because the retrieved canonical URL is
+ // not HTTP nor HTTPS.
+ FAILED_CANONICAL_URL_NOT_HTTP_NOR_HTTPS,
+
// The count of canonical URL results. This must be the last item in the enum.
CANONICAL_URL_RESULT_COUNT
};
diff --git a/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever.mm b/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever.mm
index 59627810..aab817c8 100644
--- a/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever.mm
+++ b/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever.mm
@@ -46,9 +46,13 @@
} else if (!canonical_url.is_valid()) {
// Log result if an invalid canonical URL is found.
LogCanonicalUrlResultHistogram(ui_metrics::FAILED_CANONICAL_URL_INVALID);
+ } else if (!canonical_url.SchemeIsHTTPOrHTTPS()) {
+ // Log result if a canonical URL is not HTTP nor HTTPS.
+ LogCanonicalUrlResultHistogram(
+ ui_metrics::FAILED_CANONICAL_URL_NOT_HTTP_NOR_HTTPS);
} else {
- // If the canonical URL is valid, then the retrieval was successful,
- // and the success can be logged.
+ // If the canonical URL is valid, and HTTP or HTTPS then the retrieval was
+ // successful, and the success can be logged.
LogCanonicalUrlResultHistogram(
!canonical_url.SchemeIsCryptographic()
? ui_metrics::SUCCESS_CANONICAL_URL_NOT_HTTPS
@@ -57,8 +61,6 @@
: ui_metrics::SUCCESS_CANONICAL_URL_DIFFERENT_FROM_VISIBLE);
}
- // TODO(crbug.com/514070067): Update the metric, to consider an non HTTP/HTTPS
- // canonical_url as failure.
return canonical_url.is_valid() && canonical_url.SchemeIsHTTPOrHTTPS()
? canonical_url
: GURL();
diff --git a/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mm b/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mm
index 88a0d9b8..77893e61 100644
--- a/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mm
+++ b/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mm
@@ -188,5 +188,5 @@
EXPECT_TRUE(url.is_empty());
histogram_tester_.ExpectUniqueSample(
ui_metrics::kCanonicalURLResultHistogram,
- ui_metrics::SUCCESS_CANONICAL_URL_NOT_HTTPS, 1);
+ ui_metrics::FAILED_CANONICAL_URL_NOT_HTTP_NOR_HTTPS, 1);
}
diff --git a/tools/metrics/histograms/metadata/mobile/enums.xml b/tools/metrics/histograms/metadata/mobile/enums.xml
index 9162281..66ad86c 100644
--- a/tools/metrics/histograms/metadata/mobile/enums.xml
+++ b/tools/metrics/histograms/metadata/mobile/enums.xml
@@ -46,6 +46,9 @@
<int value="6"
label="Canonical URL retrieved: Canonical URL not HTTPS (but visible
URL is)"/>
+ <int value="7"
+ label="Canonical URL not retrieved: Canonical URL not HTTP nor HTTPS
+ (but visible URL is)"/>
</enum>
<enum name="ContextMenuIOSCopyImage">
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mm b/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mm
index 88a0d9b8..77893e61 100644
--- a/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mm
+++ b/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mm
@@ -188,5 +188,5 @@
EXPECT_TRUE(url.is_empty());
histogram_tester_.ExpectUniqueSample(
ui_metrics::kCanonicalURLResultHistogram,
- ui_metrics::SUCCESS_CANONICAL_URL_NOT_HTTPS, 1);
+ ui_metrics::FAILED_CANONICAL_URL_NOT_HTTP_NOR_HTTPS, 1);
}
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page