Low chrome Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInsufficient policy enforcement in DevTools
DescriptionInsufficient policy enforcement in DevTools
ComponentDevTools
Bug ClassLogic Error
Tracker375959766
Fix commit48f965098f72 (devtools/devtools-frontend) +30/-1
CISA KEVNot listed
Creditedasnine
Disclosed2026-07-29

Changed Functions

FunctionChangeNotes
if
front_end/panels/common/ExtensionServer.ts
modified

Files Changed

  • front_end/core/host/InspectorFrontendHostAPI.ts
  • front_end/core/host/UserMetrics.ts
  • front_end/devtools_compatibility.js
  • front_end/panels/common/ExtensionServer.ts
From 48f965098f72daf2d89b5ded468d3264299fb095 Mon Sep 17 00:00:00 2001
From: Danil Somsikov <dsv@chromium.org>
Date: Wed, 11 Mar 2026 08:56:17 -0700
Subject: [PATCH] Record metrics for extension evaluation targets.

This change introduces a new enumerated histogram to log the type of
target an extension is evaluating code against: a standard web page, the
same extension, or a different extension. The target type is determined
by inspecting the URL of the frame being evaluated.

Bug: 375959766
Change-Id: I5bf7538adb78b6e3d749395f2449b3f6599a6fbc
Reviewed-on: https://chromium-review.googlesource.com/c/devtools/devtools-frontend/+/7657603
Auto-Submit: Danil Somsikov <dsv@chromium.org>
Reviewed-by: Philip Pfaffe <pfaffe@chromium.org>
Commit-Queue: Danil Somsikov <dsv@chromium.org>
---

diff --git a/front_end/core/host/InspectorFrontendHostAPI.ts b/front_end/core/host/InspectorFrontendHostAPI.ts
index 03a0a11..627f62d 100644
--- a/front_end/core/host/InspectorFrontendHostAPI.ts
+++ b/front_end/core/host/InspectorFrontendHostAPI.ts
@@ -556,5 +556,6 @@
   LighthouseCategoryUsed = 'DevTools.LighthouseCategoryUsed',
   SwatchActivated = 'DevTools.SwatchActivated',
   BuiltInAiAvailability = 'DevTools.BuiltInAiAvailability',
+  ExtensionEvalTarget = 'DevTools.ExtensionEvalTarget',
   // LINT.ThenChange(/front_end/devtools_compatibility.js:EnumeratedHistogram)
 }
diff --git a/front_end/core/host/UserMetrics.ts b/front_end/core/host/UserMetrics.ts
index 49a8235..15697cf 100644
--- a/front_end/core/host/UserMetrics.ts
+++ b/front_end/core/host/UserMetrics.ts
@@ -322,6 +322,11 @@
     InspectorFrontendHostInstance.recordPerformanceHistogram(
         'DevTools.Insights.ShortTeaserGenerationTime', timeInMilliseconds);
   }
+
+  extensionEvalTarget(target: ExtensionEvalTarget): void {
+    InspectorFrontendHostInstance.recordEnumeratedHistogram(
+        EnumeratedHistogram.ExtensionEvalTarget, target, ExtensionEvalTarget.MAX_VALUE);
+  }
 }
 
 /**
@@ -1264,3 +1269,10 @@
   DISABLED_NO_GPU = 9,
   MAX_VALUE = 10,
 }
+
+export const enum ExtensionEvalTarget {
+  WEB_PAGE = 0,
+  SAME_EXTENSION = 1,
+  OTHER_EXTENSION = 2,
+  MAX_VALUE = 3,
+}
diff --git a/front_end/devtools_compatibility.js b/front_end/devtools_compatibility.js
index 894969c..68e99f9 100644
--- a/front_end/devtools_compatibility.js
+++ b/front_end/devtools_compatibility.js
@@ -444,7 +444,8 @@
     TimelineNavigationSettingState: 'DevTools.TimelineNavigationSettingState',
     SyncSetting: 'DevTools.SyncSetting',
     SwatchActivated: 'DevTools.SwatchActivated',
-    BuiltInAiAvailability: 'DevTools.BuiltInAiAvailability'
+    BuiltInAiAvailability: 'DevTools.BuiltInAiAvailability',
+    ExtensionEvalTarget: 'DevTools.ExtensionEvalTarget'
     // LINT.ThenChange(/front_end/core/host/InspectorFrontendHostAPI.ts:EnumeratedHistogram)
   };
 
diff --git a/front_end/panels/common/ExtensionServer.ts b/front_end/panels/common/ExtensionServer.ts
index 0a5ec62..b336860 100644
--- a/front_end/panels/common/ExtensionServer.ts
+++ b/front_end/panels/common/ExtensionServer.ts
@@ -1574,6 +1574,21 @@
       return this.status.E_FAILED('Permission denied');
     }
 
+    try {
+      const parsedUrl = new URL(frame.url);
+      let targetType = Host.UserMetrics.ExtensionEvalTarget.WEB_PAGE;
+      if (parsedUrl.protocol === 'chrome-extension:') {
+        if (parsedUrl.origin === securityOrigin) {
+          targetType = Host.UserMetrics.ExtensionEvalTarget.SAME_EXTENSION;
+        } else {
+          targetType = Host.UserMetrics.ExtensionEvalTarget.OTHER_EXTENSION;
+        }
+      }
+      Host.userMetrics.extensionEvalTarget(targetType);
+    } catch {
+      // Ignore invalid URLs.
+    }
+
     void context
         .evaluate(
             {
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.