Low chrome Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInsufficient policy enforcement in DevTools
DescriptionInsufficient policy enforcement in DevTools
ComponentDevTools
Bug ClassLogic Error
Tracker519232592
Fix commita70db992f53b (chromium/src) +11/-9
CISA KEVNot listed
CreditedGoogle
Disclosed2026-07-29

Changed Functions

FunctionChangeNotes
if
chrome/browser/renderer_context_menu/render_view_context_menu.cc
modified

Files Changed

  • chrome/browser/renderer_context_menu/render_view_context_menu.cc
From a70db992f53bb8bb2b8923c124624e4c876031b8 Mon Sep 17 00:00:00 2001
From: Avi Drissman <avi@chromium.org>
Date: Mon, 08 Jun 2026 08:17:45 -0700
Subject: [PATCH] Enforce DevTools policy for View Frame Source

Fixed: 519232592
Change-Id: I541bb241419205f165569f9b90d6abd56a6a6964
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7895540
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Auto-Submit: Avi Drissman <avi@chromium.org>
Commit-Queue: Avi Drissman <avi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1643214}
---

diff --git a/chrome/browser/renderer_context_menu/render_view_context_menu.cc b/chrome/browser/renderer_context_menu/render_view_context_menu.cc
index fe6d599b..2f47249cb 100644
--- a/chrome/browser/renderer_context_menu/render_view_context_menu.cc
+++ b/chrome/browser/renderer_context_menu/render_view_context_menu.cc
@@ -3911,14 +3911,22 @@
       break;
 
     case IDC_VIEW_SOURCE:
+    case IDC_CONTENT_CONTEXT_VIEWFRAMESOURCE:
+      // The policy on the source_web_contents_ applies; when performing the
+      // action, do it on the appropriate target (the embedder_web_contents_ or
+      // the RenderFrameHost, respectively).
       if (base::FeatureList::IsEnabled(features::kDevToolsShowPolicyDialog) &&
           !DevToolsWindow::AllowDevToolsFor(GetProfile(),
-                                            embedder_web_contents_)) {
+                                            source_web_contents_)) {
 #if !BUILDFLAG(IS_ANDROID)
-        DevToolsPolicyDialog::Show(embedder_web_contents_);
+        DevToolsPolicyDialog::Show(source_web_contents_);
 #endif
       } else {
-        embedder_web_contents_->GetPrimaryMainFrame()->ViewSource();
+        if (id == IDC_VIEW_SOURCE) {
+          embedder_web_contents_->GetPrimaryMainFrame()->ViewSource();
+        } else if (GetRenderFrameHost()) {
+          GetRenderFrameHost()->ViewSource();
+        }
       }
       break;
 
@@ -3950,12 +3958,6 @@
       source_web_contents_->ReloadFocusedFrame();
       break;
 
-    case IDC_CONTENT_CONTEXT_VIEWFRAMESOURCE:
-      if (GetRenderFrameHost()) {
-        GetRenderFrameHost()->ViewSource();
-      }
-      break;
-
     case IDC_CONTENT_CONTEXT_UNDO:
       source_web_contents_->Undo();
       break;
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.