Chrome · Enterprise
CVE-2026-17919
Logic Error in Enterprise
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
chrome/browser/ui/browser_command_controller.cc
Patch
From feccea5c2cbb0f00ca2e925f903a6504ad57bdf6 Mon Sep 17 00:00:00 2001
From: Avi Drissman <avi@chromium.org>
Date: Tue, 02 Jun 2026 07:23:26 -0700
Subject: [PATCH] Make enabling AppleScripting follow DevTools policy
Add handling for the kDevToolsShowPolicyDialog feature to the "Allow
JavaScript from Apple Events" menu item.
Fixed: 513291747
Change-Id: Id1735ce08bf75770d53f78d3eae7a1d56a6a6964
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7891094
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Commit-Queue: Avi Drissman <avi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1640146}
---
diff --git a/chrome/browser/ui/browser_command_controller.cc b/chrome/browser/ui/browser_command_controller.cc
index 9dcaf8c..102c6cd3 100644
--- a/chrome/browser/ui/browser_command_controller.cc
+++ b/chrome/browser/ui/browser_command_controller.cc
@@ -834,7 +834,14 @@
chrome::ToggleAlwaysShowToolbarInFullscreen(browser_);
break;
case IDC_TOGGLE_JAVASCRIPT_APPLE_EVENTS: {
- chrome::ToggleJavaScriptFromAppleEventsAllowed(browser_);
+ content::WebContents* web_contents =
+ browser_->tab_strip_model()->GetActiveWebContents();
+ if (base::FeatureList::IsEnabled(features::kDevToolsShowPolicyDialog) &&
+ !DevToolsWindow::AllowDevToolsFor(profile(), web_contents)) {
+ DevToolsPolicyDialog::Show(web_contents);
+ } else {
+ chrome::ToggleJavaScriptFromAppleEventsAllowed(browser_);
+ }
break;
}
#endif
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page