Chrome · FullScreen
CVE-2026-17938
Logic Error in FullScreen
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifchrome/android/java/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java |
modified |
Files Changed
chrome/android/java/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.javachrome/android/java/src/org/chromium/chrome/browser/tab/TabWebContentsDelegateAndroidImpl.javachrome/android/java/src/org/chromium/chrome/browser/ui/ExclusiveAccessManager.javachrome/android/junit/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroidUnitTest.javachrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.ccchrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.h
Patch
From f24902ec479eaab7f0235e214248372e211022c8 Mon Sep 17 00:00:00 2001
From: Abdelrahman Eed <abdoeed@google.com>
Date: Wed, 03 Jun 2026 00:50:56 -0700
Subject: [PATCH] Add canEnterFullscreenModeForTab to WebContentsDelegateAndroid.
This change introduces a new method `canEnterFullscreenModeForTab` in WebContentsDelegateAndroid and its implementations. This allows embedders to control whether a RenderFrameHost is permitted to enter fullscreen mode. In Chrome, this check is routed through the ExclusiveAccessManager when the feature is enabled.
Bug: 513989304
Change-Id: Ibf7ae4dfc48bf9a76c77d11887aad5240139904b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7895236
Reviewed-by: Bo Liu <boliu@chromium.org>
Reviewed-by: Peter Conn <peconn@chromium.org>
Commit-Queue: Abdelrahman Eed <abdoeed@google.com>
Cr-Commit-Position: refs/heads/main@{#1640757}
---
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java b/chrome/android/java/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java
index a354709..86345ab6 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java
@@ -578,6 +578,16 @@
}
@Override
+ public boolean canEnterFullscreenModeForTab(RenderFrameHost renderFrameHost) {
+ if (ChromeFeatureList.sEnableExclusiveAccessManager.isEnabled()) {
+ if (mExclusiveAccessManager != null) {
+ return mExclusiveAccessManager.canEnterFullscreenModeForTab(renderFrameHost);
+ }
+ }
+ return super.canEnterFullscreenModeForTab(renderFrameHost);
+ }
+
+ @Override
public void enterFullscreenModeForTab(
RenderFrameHost renderFrameHost,
boolean prefersNavigationBar,
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabWebContentsDelegateAndroidImpl.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabWebContentsDelegateAndroidImpl.java
index 2cb8287..dd27b7d4 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabWebContentsDelegateAndroidImpl.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabWebContentsDelegateAndroidImpl.java
@@ -243,6 +243,11 @@
}
@Override
+ public boolean canEnterFullscreenModeForTab(RenderFrameHost renderFrameHost) {
+ return mDelegate.canEnterFullscreenModeForTab(renderFrameHost);
+ }
+
+ @Override
public void enterFullscreenModeForTab(
RenderFrameHost renderFrameHost,
boolean prefersNavigationBar,
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ui/ExclusiveAccessManager.java b/chrome/android/java/src/org/chromium/chrome/browser/ui/ExclusiveAccessManager.java
index dfb6cbca..b22a550 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ui/ExclusiveAccessManager.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ui/ExclusiveAccessManager.java
@@ -168,6 +168,19 @@
}
/**
+ * EAM frontend to check if a frame can enter fullscreen.
+ *
+ * @param renderFrameHost the render frame host asking for fullscreen
+ * @return true if the frame can enter fullscreen
+ */
+ public boolean canEnterFullscreenModeForTab(RenderFrameHost renderFrameHost) {
+ if (mExclusiveAccessManagerAndroidNativePointer == 0) return false;
+ return ExclusiveAccessManagerJni.get()
+ .canEnterFullscreenModeForTab(
+ mExclusiveAccessManagerAndroidNativePointer, renderFrameHost);
+ }
+
+ /**
* EAM frontend for WebContentsDelegate to enter fullscreen
*
* @param renderFrameHost the render frame host requesting fullscreen
@@ -388,6 +401,9 @@
FullscreenManager fullscreenManager,
ActivityTabProvider activityTabProvider);
+ boolean canEnterFullscreenModeForTab(
+ long nativeExclusiveAccessManagerAndroid, RenderFrameHost renderFrameHost);
+
void enterFullscreenModeForTab(
long nativeExclusiveAccessManagerAndroid,
RenderFrameHost renderFrameHost,
diff --git a/chrome/android/junit/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroidUnitTest.java b/chrome/android/junit/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroidUnitTest.java
index af3b26b..5222aeb 100644
--- a/chrome/android/junit/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroidUnitTest.java
+++ b/chrome/android/junit/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroidUnitTest.java
@@ -51,9 +51,11 @@
import org.chromium.chrome.browser.tabmodel.TabCreatorManager;
import org.chromium.chrome.browser.tabmodel.TabGroupMergeNotificationType;
import org.chromium.chrome.browser.tabmodel.TabModel;
+import org.chromium.chrome.browser.ui.ExclusiveAccessManager;
import org.chromium.chrome.browser.util.AndroidTaskUtils;
import org.chromium.chrome.browser.util.PictureInPictureWindowOptions;
import org.chromium.chrome.browser.util.WindowFeatures;
+import org.chromium.content_public.browser.RenderFrameHost;
import org.chromium.content_public.browser.WebContents;
import org.chromium.ui.display.DisplayAndroid;
import org.chromium.ui.display.DisplayAndroidManager;
@@ -86,7 +88,8 @@
Tab tab,
Activity activity,
TabCreatorManager tabCreatorManager,
- TabModel tabModel) {
+ TabModel tabModel,
+ ExclusiveAccessManager exclusiveAccessManager) {
super(
tab,
activity,
@@ -99,7 +102,7 @@
mock(Supplier.class),
mock(Supplier.class),
mock(Supplier.class),
- null);
+ exclusiveAccessManager);
mTabModel = tabModel;
mTabMap = new HashMap<>();
}
@@ -154,6 +157,8 @@
@Mock AppTask mAppTask;
@Mock PopupCreator mPopupCreator;
@Mock MultiWindowUtils mMultiWindowUtils;
+ @Mock ExclusiveAccessManager mExclusiveAccessManager;
+ @Mock RenderFrameHost mRenderFrameHost;
@Captor private ArgumentCaptor<CompletableFuture<Boolean>> mFutureCaptor;
@@ -173,7 +178,7 @@
PopupCreatorFactory.setInstanceForTesting(mPopupCreator);
mTabWebContentsDelegateAndroid =
new TestActivityTabWebContentsDelegateAndroid(
- mTab, mActivity, mTabCreatorManager, mTabModel);
+ mTab, mActivity, mTabCreatorManager, mTabModel, mExclusiveAccessManager);
DisplayAndroidManager.setInstanceForTesting(mDisplayAndroidManager);
AconfigFlaggedApiDelegate.setInstanceForTesting(mFlaggedApiDelegate);
AndroidTaskUtils.setAppTaskForTesting(mAppTask);
@@ -464,4 +469,23 @@
verify(mFlaggedApiDelegate, never()).moveTaskTo(any(), anyInt(), any());
}
+ @Test
+ @DisableFeatures({ChromeFeatureList.ENABLE_EXCLUSIVE_ACCESS_MANAGER})
+ public void testCanEnterFullscreenModeForTab_exclusiveAccessManagerDisabled() {
+ assertTrue(mTabWebContentsDelegateAndroid.canEnterFullscreenModeForTab(mRenderFrameHost));
+ verify(mExclusiveAccessManager, never()).canEnterFullscreenModeForTab(any());
+ }
+
+ @Test
+ @EnableFeatures({ChromeFeatureList.ENABLE_EXCLUSIVE_ACCESS_MANAGER})
+ public void testCanEnterFullscreenModeForTab_exclusiveAccessManagerEnabled() {
+ when(mExclusiveAccessManager.canEnterFullscreenModeForTab(mRenderFrameHost))
+ .thenReturn(true);
+ assertTrue(mTabWebContentsDelegateAndroid.canEnterFullscreenModeForTab(mRenderFrameHost));
+ verify(mExclusiveAccessManager, times(1)).canEnterFullscreenModeForTab(mRenderFrameHost);
+
+ when(mExclusiveAccessManager.canEnterFullscreenModeForTab(mRenderFrameHost))
+ .thenReturn(false);
+ assertFalse(mTabWebContentsDelegateAndroid.canEnterFullscreenModeForTab(mRenderFrameHost));
+ }
}
diff --git a/chrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.cc b/chrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.cc
index a3daf42c..c4ac856 100644
--- a/chrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.cc
+++ b/chrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.cc
@@ -30,6 +30,15 @@
ExclusiveAccessManagerAndroid::~ExclusiveAccessManagerAndroid() = default;
+bool ExclusiveAccessManagerAndroid::CanEnterFullscreenModeForTab(
+ JNIEnv* env,
+ const jni_zero::JavaRef<jobject>& jrender_frame_host_android) {
+ content::RenderFrameHost* rfh =
+ content::RenderFrameHost::FromJavaRenderFrameHost(
+ jrender_frame_host_android);
+ return eam_.fullscreen_controller()->CanEnterFullscreenModeForTab(rfh);
+}
+
void ExclusiveAccessManagerAndroid::EnterFullscreenModeForTab(
JNIEnv* env,
const jni_zero::JavaRef<jobject>& jrender_frame_host_android,
diff --git a/chrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.h b/chrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.h
index 9f7491c..293c635 100644
--- a/chrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.h
+++ b/chrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.h
@@ -30,6 +30,10 @@
void Destroy(JNIEnv* env);
+ bool CanEnterFullscreenModeForTab(
+ JNIEnv* env,
+ const jni_zero::JavaRef<jobject>& jrender_frame_host_android);
+
void EnterFullscreenModeForTab(
JNIEnv* env,
const jni_zero::JavaRef<jobject>& jrender_frame_host_android,
diff --git a/components/embedder_support/android/delegate/web_contents_delegate_android.cc b/components/embedder_support/android/delegate/web_contents_delegate_android.cc
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page