Low chrome Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInappropriate implementation in Views
DescriptionInappropriate implementation in Views
ComponentViews
Bug ClassLogic Error
Tracker517538206
Fix commit40956eeb5c3b (chromium/src) +7/-0
CISA KEVNot listed
CreditedGoogle
Disclosed2026-07-29

Changed Functions

FunctionChangeNotes
ShouldAllowKeyEventsDuringInputProtection
chrome/browser/ui/views/digital_credentials/digital_identity_multi_step_dialog.cc
modified

Files Changed

  • chrome/browser/ui/views/digital_credentials/digital_identity_multi_step_dialog.cc
From 40956eeb5c3b00ad5cd1c222944dc4acd189cd23 Mon Sep 17 00:00:00 2001
From: Mohamed Amir Yosef <mamir@chromium.org>
Date: Mon, 15 Jun 2026 01:38:28 -0700
Subject: [PATCH] Fix Input Activation Protection Bypass in Digital Credentials

This overrides ShouldAllowKeyEventsDuringInputProtection in
DigitalIdentityMultiStepDialogDelegate to return false, restricting key
events during the input protection period.

TAG=agy
CONV=eb2ccdcd-cb8c-4b94-b6fc-4e615bb1b30f

Fixed: 517538206
Change-Id: I8962253e5dbb2ac1164c5a40459458854c6138c7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7927972
Auto-Submit: Mohamed Amir Yosef <mamir@chromium.org>
Commit-Queue: Mohamed Amir Yosef <mamir@chromium.org>
Reviewed-by: Adem Derinel <derinel@google.com>
Commit-Queue: Adem Derinel <derinel@google.com>
Cr-Commit-Position: refs/heads/main@{#1646625}
---

diff --git a/chrome/browser/ui/views/digital_credentials/digital_identity_multi_step_dialog.cc b/chrome/browser/ui/views/digital_credentials/digital_identity_multi_step_dialog.cc
index 52418e4..db6ef17 100644
--- a/chrome/browser/ui/views/digital_credentials/digital_identity_multi_step_dialog.cc
+++ b/chrome/browser/ui/views/digital_credentials/digital_identity_multi_step_dialog.cc
@@ -69,6 +69,8 @@
 
   views::Widget::ClosedReason get_closed_reason() { return closed_reason_; }
 
+  bool ShouldAllowKeyEventsDuringInputProtection() const override;
+
  private:
   bool OnDialogAccepted();
   bool OnDialogCanceled();
@@ -217,6 +219,11 @@
   SetCloseCallback(base::OnceClosure());
 }
 
+bool DigitalIdentityMultiStepDialogDelegate::
+    ShouldAllowKeyEventsDuringInputProtection() const {
+  return false;
+}
+
 // static
 std::unique_ptr<views::BoxLayoutView>
 DigitalIdentityMultiStepDialog::CreateHeaderView(
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.