Chrome · DevTools
CVE-2026-17974
Logic Error in DevTools
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifchrome/browser/renderer_context_menu/render_view_context_menu.cc |
modified |
Files Changed
chrome/browser/renderer_context_menu/render_view_context_menu.cc
Patch
From a70db992f53bb8bb2b8923c124624e4c876031b8 Mon Sep 17 00:00:00 2001
From: Avi Drissman <avi@chromium.org>
Date: Mon, 08 Jun 2026 08:17:45 -0700
Subject: [PATCH] Enforce DevTools policy for View Frame Source
Fixed: 519232592
Change-Id: I541bb241419205f165569f9b90d6abd56a6a6964
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7895540
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Auto-Submit: Avi Drissman <avi@chromium.org>
Commit-Queue: Avi Drissman <avi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1643214}
---
diff --git a/chrome/browser/renderer_context_menu/render_view_context_menu.cc b/chrome/browser/renderer_context_menu/render_view_context_menu.cc
index fe6d599b..2f47249cb 100644
--- a/chrome/browser/renderer_context_menu/render_view_context_menu.cc
+++ b/chrome/browser/renderer_context_menu/render_view_context_menu.cc
@@ -3911,14 +3911,22 @@
break;
case IDC_VIEW_SOURCE:
+ case IDC_CONTENT_CONTEXT_VIEWFRAMESOURCE:
+ // The policy on the source_web_contents_ applies; when performing the
+ // action, do it on the appropriate target (the embedder_web_contents_ or
+ // the RenderFrameHost, respectively).
if (base::FeatureList::IsEnabled(features::kDevToolsShowPolicyDialog) &&
!DevToolsWindow::AllowDevToolsFor(GetProfile(),
- embedder_web_contents_)) {
+ source_web_contents_)) {
#if !BUILDFLAG(IS_ANDROID)
- DevToolsPolicyDialog::Show(embedder_web_contents_);
+ DevToolsPolicyDialog::Show(source_web_contents_);
#endif
} else {
- embedder_web_contents_->GetPrimaryMainFrame()->ViewSource();
+ if (id == IDC_VIEW_SOURCE) {
+ embedder_web_contents_->GetPrimaryMainFrame()->ViewSource();
+ } else if (GetRenderFrameHost()) {
+ GetRenderFrameHost()->ViewSource();
+ }
}
break;
@@ -3950,12 +3958,6 @@
source_web_contents_->ReloadFocusedFrame();
break;
- case IDC_CONTENT_CONTEXT_VIEWFRAMESOURCE:
- if (GetRenderFrameHost()) {
- GetRenderFrameHost()->ViewSource();
- }
- break;
-
case IDC_CONTENT_CONTEXT_UNDO:
source_web_contents_->Undo();
break;
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page