Chrome · Browser
CVE-2026-17984
Logic Error in Browser
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
forchrome/browser/visited_url_ranking/android_tab_model_url_visit_data_fetcher.cc |
modified |
Files Changed
chrome/browser/visited_url_ranking/android_tab_model_url_visit_data_fetcher.cc
Patch
From b3668a394ae07f71a8a083fab10e60f6041a036f Mon Sep 17 00:00:00 2001
From: Xi Han <hanxi@google.com>
Date: Fri, 12 Jun 2026 13:15:27 -0700
Subject: [PATCH] [TabDonation] Add URL scheme checks.
Bug: 519978460
Change-Id: Ia49e9d37eeb0cf188525ce854f8959b804ffd48a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7930446
Reviewed-by: Siddhartha S <ssid@chromium.org>
Commit-Queue: Siddhartha S <ssid@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1646204}
---
diff --git a/chrome/browser/visited_url_ranking/android_tab_model_url_visit_data_fetcher.cc b/chrome/browser/visited_url_ranking/android_tab_model_url_visit_data_fetcher.cc
index b1225a8..1d682d7 100644
--- a/chrome/browser/visited_url_ranking/android_tab_model_url_visit_data_fetcher.cc
+++ b/chrome/browser/visited_url_ranking/android_tab_model_url_visit_data_fetcher.cc
@@ -149,7 +149,8 @@
for (int i = 0; i < count; ++i) {
auto* tab_android = model->GetTabAt(i);
GURL url = tab_android->GetURL();
- if (!url.is_valid() || url.spec() == chrome::kChromeUINativeNewTabURL) {
+ if (!url.is_valid() || url.spec() == chrome::kChromeUINativeNewTabURL ||
+ !url.SchemeIsHTTPOrHTTPS()) {
continue;
}
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page