From ac42c6ad9f1ede6fa3a7b4bab0f0dfb4a625c9d4 Mon Sep 17 00:00:00 2001
From: Rakina Zata Amni <rakina@chromium.org>
Date: Tue, 16 Jun 2026 08:33:45 -0700
Subject: [PATCH] Add IsInactiveAndDisallowActivation check for StartDragging

This prevents inactive documents from starting dragging, thinking it's
coming from the current/active document

Fixed: 496569497
Change-Id: I85b544b09c577dd8b5875993289ef75eb6fde1eb
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7893716
Auto-Submit: Rakina Zata Amni <rakina@chromium.org>
Reviewed-by: Kartar Singh <kartarsingh@google.com>
Commit-Queue: Kartar Singh <kartarsingh@google.com>
Cr-Commit-Position: refs/heads/main@{#1647590}
---

diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
index 2cd0fa37..ec356e15 100644
--- a/content/browser/renderer_host/render_frame_host_impl.cc
+++ b/content/browser/renderer_host/render_frame_host_impl.cc
@@ -11109,6 +11109,12 @@
     const gfx::Vector2d& cursor_offset_in_dip,
     const gfx::Rect& drag_obj_rect_in_dip,
     blink::mojom::DragEventSourceInfoPtr event_info) {
+  if (IsInactiveAndDisallowActivation(
+          DisallowActivationReasonId::kStartDragging)) {
+    // Don't process dragging from inactive documents.
+    // TODO(crbug.com/523886022): Add more checks for e.g. visibility.
+    return;
+  }
 #if BUILDFLAG(IS_ANDROID)
   RenderWidgetHostImpl* widget = GetRenderWidgetHost();
   RenderWidgetHostViewBase* view = (widget) ? widget->GetView() : nullptr;
diff --git a/content/browser/renderer_host/render_widget_host_impl.cc b/content/browser/renderer_host/render_widget_host_impl.cc
index a196581b..7ec2a59 100644
--- a/content/browser/renderer_host/render_widget_host_impl.cc
+++ b/content/browser/renderer_host/render_widget_host_impl.cc
@@ -95,6 +95,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/device_service.h"
+#include "content/public/browser/disallow_activation_reason.h"
 #include "content/public/browser/keyboard_event_processing_result.h"
 #include "content/public/browser/peak_gpu_memory_tracker_factory.h"
 #include "content/public/browser/render_frame_metadata_provider.h"
@@ -3101,6 +3102,12 @@
     // nothing will happen.
     return;
   }
+  if (source_rfh->IsInactiveAndDisallowActivation(
+          DisallowActivationReasonId::kStartDragging)) {
+    // Don't process dragging from inactive documents.
+    // TODO(crbug.com/523886022): Add more checks for e.g. visibility.
+    return;
+  }
 
   StartDragging(*source_rfh, std::move(drag_data), drag_operations_mask,
                 unsafe_bitmap, cursor_offset_in_dip, drag_obj_rect_in_dip,
diff --git a/content/public/browser/disallow_activation_reason.h b/content/public/browser/disallow_activation_reason.h
index f0c9fed..83992ed3 100644
--- a/content/public/browser/disallow_activation_reason.h
+++ b/content/public/browser/disallow_activation_reason.h
@@ -66,6 +66,7 @@
   kBrowserInitiatedErrorPage = 42,
   kDidChangeOpener = 43,
   kDidCommitNavigation = 44,
+  kStartDragging = 45,
   // New entries go above here. New entries should be added to
   // tools/metrics/histograms/enums.xml .
   kMinEmbedderDisallowActivationReason = 2 << 16,
diff --git a/tools/metrics/histograms/enums.xml b/tools/metrics/histograms/enums.xml
index 8618ab5..a3c03de0 100644
--- a/tools/metrics/histograms/enums.xml
+++ b/tools/metrics/histograms/enums.xml
@@ -5881,6 +5881,13 @@
   <int value="43" label="kDidChangeOpener">
     A request was received to change window.opener to a frame in BFCache.
   </int>
+  <int value="44" label="kDidCommitNavigation">
+    A request was received to finish committing a navigation within a BFCached
+    page.
+  </int>
+  <int value="45" label="kStartDragging">
+    A request was received to start dragging from within an inactive page.
+  </int>
 </enum>
 
 <enum name="IncidentType">