CVE-2026-17900

Overview

Low

Severity

—

CVSS

No

Exploited ITW

Fixed

Fix Status

ImpactInappropriate implementation in Enterprise

DescriptionInappropriate implementation in Enterprise

ComponentEnterprise

Bug ClassLogic Error

Tracker496195854

Fix commit7a7ba7127467 (chromium/src) +9/-7

CISA KEVNot listed

CreditedGoogle

Disclosed2026-07-29

Changed Functions

Function	Change	Notes
`TEST` components/enterprise/common/proto/connectors_unittest.cc	modified

Files Changed

DEPS
components/enterprise/common/proto/connectors_unittest.cc
third_party/content_analysis_sdk/README.chromium
third_party/content_analysis_sdk/src

Patch

view commit

From 7a7ba71274678e80d40fa9a7c25c7cf7bf8957c2 Mon Sep 17 00:00:00 2001
From: Elias Homsi <eliashomsi@google.com>
Date: Thu, 25 Jun 2026 13:04:16 -0700
Subject: [PATCH] Fix response truncation for messages >4KB on Windows named-pipes

Created with:
  roll-dep src/third_party/content_analysis_sdk/src

Fixed: 496195854
Change-Id: I16d0b2ee4fe8e234a5d2d301ca4311bd0fff59d9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8006073
Commit-Queue: Dominique Fauteux-Chapleau <domfc@chromium.org>
Commit-Queue: Elias Homsi <eliashomsi@google.com>
Auto-Submit: Elias Homsi <eliashomsi@google.com>
Reviewed-by: Dominique Fauteux-Chapleau <domfc@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1652653}
---

diff --git a/DEPS b/DEPS
index 34ee3f9..9eb38308 100644
--- a/DEPS
+++ b/DEPS
@@ -2022,7 +2022,7 @@
     Var('chromium_git') + '/external/github.com/mozilla/readability.git' + '@' + 'd7949dc47dd9ed9ee1d3b34ffdcf3bce28cde435',
 
   'src/third_party/content_analysis_sdk/src':
-    Var('chromium_git') + '/external/github.com/chromium/content_analysis_sdk.git' + '@' + '3d82f7523b557d0d5c75e1acf28c3deb8081ead1',
+    Var('chromium_git') + '/external/github.com/chromium/content_analysis_sdk.git' + '@' + '2a8191af30a4d1f591e2f758e595bdeea139e93a',
 
   'src/third_party/dav1d/libdav1d':
     Var('chromium_git') + '/external/github.com/videolan/dav1d.git' + '@' + '14c73c7db38eebfd3202146b76a1ad4df90dd3a2',
diff --git a/components/enterprise/common/proto/connectors_unittest.cc b/components/enterprise/common/proto/connectors_unittest.cc
index e48ef1d..87eda8f 100644
--- a/components/enterprise/common/proto/connectors_unittest.cc
+++ b/components/enterprise/common/proto/connectors_unittest.cc
@@ -10,9 +10,8 @@
 
 TEST(EnterpriseConnectorsProtoTest, AnalysisConnectorEnum) {
   EXPECT_EQ(enterprise_connectors::AnalysisConnector_ARRAYSIZE, 7);
-  // TODO(eliashomsi): Add DATA_COPIED to the SDK proto.
   EXPECT_EQ(enterprise_connectors::AnalysisConnector_ARRAYSIZE,
-            content_analysis::sdk::AnalysisConnector_ARRAYSIZE + 1);
+            content_analysis::sdk::AnalysisConnector_ARRAYSIZE);
 
   EXPECT_EQ((int)enterprise_connectors::ANALYSIS_CONNECTOR_UNSPECIFIED,
             (int)content_analysis::sdk::ANALYSIS_CONNECTOR_UNSPECIFIED);
@@ -26,6 +25,8 @@
             (int)content_analysis::sdk::PRINT);
   EXPECT_EQ((int)enterprise_connectors::FILE_TRANSFER,
             (int)content_analysis::sdk::FILE_TRANSFER);
+  EXPECT_EQ((int)enterprise_connectors::DATA_COPIED,
+            (int)content_analysis::sdk::DATA_COPIED);
 }
 
 using ChromiumResult = enterprise_connectors::ContentAnalysisResponse::Result;
@@ -78,8 +79,7 @@
 
 TEST(EnterpriseConnectorsProtoTest, ReasonEnum) {
   EXPECT_EQ(ChromiumReason::Reason_ARRAYSIZE, 9);
-  // TODO(eliashomsi): Add CLIPBOARD_COPY to the SDK proto.
-  EXPECT_EQ(ChromiumReason::Reason_ARRAYSIZE, SdkReason::Reason_ARRAYSIZE + 1);
+  EXPECT_EQ(ChromiumReason::Reason_ARRAYSIZE, SdkReason::Reason_ARRAYSIZE);
 
   EXPECT_EQ((int)ChromiumReason::UNKNOWN, (int)SdkReason::UNKNOWN);
   EXPECT_EQ((int)ChromiumReason::CLIPBOARD_PASTE,
@@ -95,6 +95,8 @@
             (int)SdkReason::NORMAL_DOWNLOAD);
   EXPECT_EQ((int)ChromiumReason::SAVE_AS_DOWNLOAD,
             (int)SdkReason::SAVE_AS_DOWNLOAD);
+  EXPECT_EQ((int)ChromiumReason::CLIPBOARD_COPY,
+            (int)SdkReason::CLIPBOARD_COPY);
 }
 
 }  // namespace enterprise_connectors
diff --git a/third_party/content_analysis_sdk/README.chromium b/third_party/content_analysis_sdk/README.chromium
index a6be122a..ad53614c 100644
--- a/third_party/content_analysis_sdk/README.chromium
+++ b/third_party/content_analysis_sdk/README.chromium
@@ -2,7 +2,7 @@
 Short Name: content_analysis_sdk
 URL: https://github.com/chromium/content_analysis_sdk
 Version: N/A
-Revision: 3d82f7523b557d0d5c75e1acf28c3deb8081ead1
+Revision: 2a8191af30a4d1f591e2f758e595bdeea139e93a
 Update Mechanism: Manual
 License: BSD-3-Clause
 License File: ./LICENSE
diff --git a/third_party/content_analysis_sdk/src b/third_party/content_analysis_sdk/src
index 3d82f752..2a8191a 160000
--- a/third_party/content_analysis_sdk/src
+++ b/third_party/content_analysis_sdk/src
@@ -1 +1 @@
-Subproject commit 3d82f7523b557d0d5c75e1acf28c3deb8081ead1
+Subproject commit 2a8191af30a4d1f591e2f758e595bdeea139e93a

Loading diff…

Regression Test / PoC

shipped with the fix

diff --git a/components/enterprise/common/proto/connectors_unittest.cc b/components/enterprise/common/proto/connectors_unittest.cc
index e48ef1d..87eda8f 100644
--- a/components/enterprise/common/proto/connectors_unittest.cc
+++ b/components/enterprise/common/proto/connectors_unittest.cc
@@ -10,9 +10,8 @@
 
 TEST(EnterpriseConnectorsProtoTest, AnalysisConnectorEnum) {
   EXPECT_EQ(enterprise_connectors::AnalysisConnector_ARRAYSIZE, 7);
-  // TODO(eliashomsi): Add DATA_COPIED to the SDK proto.
   EXPECT_EQ(enterprise_connectors::AnalysisConnector_ARRAYSIZE,
-            content_analysis::sdk::AnalysisConnector_ARRAYSIZE + 1);
+            content_analysis::sdk::AnalysisConnector_ARRAYSIZE);
 
   EXPECT_EQ((int)enterprise_connectors::ANALYSIS_CONNECTOR_UNSPECIFIED,
             (int)content_analysis::sdk::ANALYSIS_CONNECTOR_UNSPECIFIED);
@@ -26,6 +25,8 @@
             (int)content_analysis::sdk::PRINT);
   EXPECT_EQ((int)enterprise_connectors::FILE_TRANSFER,
             (int)content_analysis::sdk::FILE_TRANSFER);
+  EXPECT_EQ((int)enterprise_connectors::DATA_COPIED,
+            (int)content_analysis::sdk::DATA_COPIED);
 }
 
 using ChromiumResult = enterprise_connectors::ContentAnalysisResponse::Result;
@@ -78,8 +79,7 @@
 
 TEST(EnterpriseConnectorsProtoTest, ReasonEnum) {
   EXPECT_EQ(ChromiumReason::Reason_ARRAYSIZE, 9);
-  // TODO(eliashomsi): Add CLIPBOARD_COPY to the SDK proto.
-  EXPECT_EQ(ChromiumReason::Reason_ARRAYSIZE, SdkReason::Reason_ARRAYSIZE + 1);
+  EXPECT_EQ(ChromiumReason::Reason_ARRAYSIZE, SdkReason::Reason_ARRAYSIZE);
 
   EXPECT_EQ((int)ChromiumReason::UNKNOWN, (int)SdkReason::UNKNOWN);
   EXPECT_EQ((int)ChromiumReason::CLIPBOARD_PASTE,
@@ -95,6 +95,8 @@
             (int)SdkReason::NORMAL_DOWNLOAD);
   EXPECT_EQ((int)ChromiumReason::SAVE_AS_DOWNLOAD,
             (int)SdkReason::SAVE_AS_DOWNLOAD);
+  EXPECT_EQ((int)ChromiumReason::CLIPBOARD_COPY,
+            (int)SdkReason::CLIPBOARD_COPY);
 }
 
 }  // namespace enterprise_connectors

Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.

References

Vendor advisory Fix commit Bug tracker NVD