Chrome · DevTools
CVE-2026-17899
Logic Error in DevTools
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
iffront_end/panels/common/ExtensionServer.ts |
modified |
Files Changed
front_end/core/host/InspectorFrontendHostAPI.tsfront_end/core/host/UserMetrics.tsfront_end/devtools_compatibility.jsfront_end/panels/common/ExtensionServer.ts
Patch
From 48f965098f72daf2d89b5ded468d3264299fb095 Mon Sep 17 00:00:00 2001
From: Danil Somsikov <dsv@chromium.org>
Date: Wed, 11 Mar 2026 08:56:17 -0700
Subject: [PATCH] Record metrics for extension evaluation targets.
This change introduces a new enumerated histogram to log the type of
target an extension is evaluating code against: a standard web page, the
same extension, or a different extension. The target type is determined
by inspecting the URL of the frame being evaluated.
Bug: 375959766
Change-Id: I5bf7538adb78b6e3d749395f2449b3f6599a6fbc
Reviewed-on: https://chromium-review.googlesource.com/c/devtools/devtools-frontend/+/7657603
Auto-Submit: Danil Somsikov <dsv@chromium.org>
Reviewed-by: Philip Pfaffe <pfaffe@chromium.org>
Commit-Queue: Danil Somsikov <dsv@chromium.org>
---
diff --git a/front_end/core/host/InspectorFrontendHostAPI.ts b/front_end/core/host/InspectorFrontendHostAPI.ts
index 03a0a11..627f62d 100644
--- a/front_end/core/host/InspectorFrontendHostAPI.ts
+++ b/front_end/core/host/InspectorFrontendHostAPI.ts
@@ -556,5 +556,6 @@
LighthouseCategoryUsed = 'DevTools.LighthouseCategoryUsed',
SwatchActivated = 'DevTools.SwatchActivated',
BuiltInAiAvailability = 'DevTools.BuiltInAiAvailability',
+ ExtensionEvalTarget = 'DevTools.ExtensionEvalTarget',
// LINT.ThenChange(/front_end/devtools_compatibility.js:EnumeratedHistogram)
}
diff --git a/front_end/core/host/UserMetrics.ts b/front_end/core/host/UserMetrics.ts
index 49a8235..15697cf 100644
--- a/front_end/core/host/UserMetrics.ts
+++ b/front_end/core/host/UserMetrics.ts
@@ -322,6 +322,11 @@
InspectorFrontendHostInstance.recordPerformanceHistogram(
'DevTools.Insights.ShortTeaserGenerationTime', timeInMilliseconds);
}
+
+ extensionEvalTarget(target: ExtensionEvalTarget): void {
+ InspectorFrontendHostInstance.recordEnumeratedHistogram(
+ EnumeratedHistogram.ExtensionEvalTarget, target, ExtensionEvalTarget.MAX_VALUE);
+ }
}
/**
@@ -1264,3 +1269,10 @@
DISABLED_NO_GPU = 9,
MAX_VALUE = 10,
}
+
+export const enum ExtensionEvalTarget {
+ WEB_PAGE = 0,
+ SAME_EXTENSION = 1,
+ OTHER_EXTENSION = 2,
+ MAX_VALUE = 3,
+}
diff --git a/front_end/devtools_compatibility.js b/front_end/devtools_compatibility.js
index 894969c..68e99f9 100644
--- a/front_end/devtools_compatibility.js
+++ b/front_end/devtools_compatibility.js
@@ -444,7 +444,8 @@
TimelineNavigationSettingState: 'DevTools.TimelineNavigationSettingState',
SyncSetting: 'DevTools.SyncSetting',
SwatchActivated: 'DevTools.SwatchActivated',
- BuiltInAiAvailability: 'DevTools.BuiltInAiAvailability'
+ BuiltInAiAvailability: 'DevTools.BuiltInAiAvailability',
+ ExtensionEvalTarget: 'DevTools.ExtensionEvalTarget'
// LINT.ThenChange(/front_end/core/host/InspectorFrontendHostAPI.ts:EnumeratedHistogram)
};
diff --git a/front_end/panels/common/ExtensionServer.ts b/front_end/panels/common/ExtensionServer.ts
index 0a5ec62..b336860 100644
--- a/front_end/panels/common/ExtensionServer.ts
+++ b/front_end/panels/common/ExtensionServer.ts
@@ -1574,6 +1574,21 @@
return this.status.E_FAILED('Permission denied');
}
+ try {
+ const parsedUrl = new URL(frame.url);
+ let targetType = Host.UserMetrics.ExtensionEvalTarget.WEB_PAGE;
+ if (parsedUrl.protocol === 'chrome-extension:') {
+ if (parsedUrl.origin === securityOrigin) {
+ targetType = Host.UserMetrics.ExtensionEvalTarget.SAME_EXTENSION;
+ } else {
+ targetType = Host.UserMetrics.ExtensionEvalTarget.OTHER_EXTENSION;
+ }
+ }
+ Host.userMetrics.extensionEvalTarget(targetType);
+ } catch {
+ // Ignore invalid URLs.
+ }
+
void context
.evaluate(
{
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page