PatchGap
Chrome · Blink

CVE-2026-17962

Logic Error in Blink
Low chrome Logic Error 🔧 Commit mapped

Overview

Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInappropriate implementation in Blink
DescriptionInappropriate implementation in Blink
ComponentBlink
Bug ClassLogic Error
Tracker517757268
Fix commit502e39bb1be1 (chromium/src) +19/-2
CISA KEVNot listed
CreditedGoogle
Disclosed2026-07-29

Files Changed

  • third_party/blink/renderer/core/html/parser/html_construction_site.cc
  • third_party/blink/web_tests/external/wpt/sanitizer-api/sanitizer-in-adoption-agency.html

Patch

view commit
From 502e39bb1be1e310500e6edf4be679f77a8fbfac Mon Sep 17 00:00:00 2001
From: Noam Rosenthal <nrosenthal@chromium.org>
Date: Mon, 08 Jun 2026 05:01:22 -0700
Subject: [PATCH] Ensure streaming sanitizer run throughout adoption agency

Bug: 517757268
Change-Id: Ib8ac97eb91bd9f461688eb75fca969c6053dc92f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7902583
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Noam Rosenthal <nrosenthal@google.com>
Cr-Commit-Position: refs/heads/main@{#1643101}
---

diff --git a/third_party/blink/renderer/core/html/parser/html_construction_site.cc b/third_party/blink/renderer/core/html/parser/html_construction_site.cc
index 2b1f3be..805756b 100644
--- a/third_party/blink/renderer/core/html/parser/html_construction_site.cc
+++ b/third_party/blink/renderer/core/html/parser/html_construction_site.cc
@@ -419,8 +419,6 @@
 
   if (sanitizer_ && task.child && task.parent &&
       !task.parent->IsDocumentNode() &&
-      task.operation !=
-          HTMLConstructionSiteTask::Operation::kInsertAlreadyParsedChild &&
       task.operation != HTMLConstructionSiteTask::Operation::kTakeAllChildren) {
     CHECK(RuntimeEnabledFeatures::StreamingSanitizerEnabled());
     if (!sanitizer_->Sanitize(task.child)) {
diff --git a/third_party/blink/web_tests/external/wpt/sanitizer-api/sanitizer-in-adoption-agency.html b/third_party/blink/web_tests/external/wpt/sanitizer-api/sanitizer-in-adoption-agency.html
new file mode 100644
index 0000000..6dce7c5
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/sanitizer-api/sanitizer-in-adoption-agency.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Sanitizer AAA bypass test</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+</head>
+<body>
+<div id="test"></div>
+<script>
+test(t => {
+  const container = document.createElement('div');
+  container.setHTML('<b><i onclick="alert(1)"><div></b>x');
+  assert_equals(container.querySelectorAll('[onclick]').length, 0,
+                "No element should have onclick attribute");
+}, "Sanitizer should remove onclick attribute during Adoption Agency Algorithm element reconstruction.");
+</script>
+</body>
+</html>
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/third_party/blink/web_tests/external/wpt/sanitizer-api/sanitizer-in-adoption-agency.html b/third_party/blink/web_tests/external/wpt/sanitizer-api/sanitizer-in-adoption-agency.html
new file mode 100644
index 0000000..6dce7c5
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/sanitizer-api/sanitizer-in-adoption-agency.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Sanitizer AAA bypass test</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+</head>
+<body>
+<div id="test"></div>
+<script>
+test(t => {
+  const container = document.createElement('div');
+  container.setHTML('<b><i onclick="alert(1)"><div></b>x');
+  assert_equals(container.querySelectorAll('[onclick]').length, 0,
+                "No element should have onclick attribute");
+}, "Sanitizer should remove onclick attribute during Adoption Agency Algorithm element reconstruction.");
+</script>
+</body>
+</html>
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
On This Page