Low CVSS 2.4 chrome Logic Error 🔧 Commit mapped

Overview

Low
Severity
2.4
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInappropriate implementation in Chrome for iOS
DescriptionInappropriate implementation in Chrome for iOS
ComponentChrome for iOS
Sub-componentiOS
Bug ClassLogic Error
Tracker522479633
Fix commit1b6768698b4b (chromium/src) +39/-2
CWECWE-200 (Information exposure)
CVSS vectorCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA KEVNot listed
CreditedGoogle
Reported2026-06-11 (per vendor advisory)
Fix landed2026-06-16 (public git)
Disclosed2026-07-29
Patch gap43 days — fix public in source before the advisory

Changed Functions

FunctionChangeNotes
if
ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator.mm
modified
ReauthenticationCoordinatorTest
ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
modified

Files Changed

  • ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator.mm
  • ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
From 1b6768698b4b36c888cf30843e8b2959b22d2bd3 Mon Sep 17 00:00:00 2001
From: Rafał Godlewski <rgod@google.com>
Date: Tue, 16 Jun 2026 00:46:05 -0700
Subject: [PATCH] [iOS] Close UI on failed reauth VC push in foreground inactive

Fixed: 522479633
Change-Id: I7bba821c3699cef35cc74afe6f86e6183eb0b4b9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7927831
Reviewed-by: Ernesto Izquierdo Clua <eic@google.com>
Commit-Queue: Rafał Godlewski <rgod@google.com>
Cr-Commit-Position: refs/heads/main@{#1647368}
---

diff --git a/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator.mm b/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator.mm
index 0f6004eb..18faaa6 100644
--- a/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator.mm
+++ b/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator.mm
@@ -240,9 +240,11 @@
       }
       [[fallthrough]];
     case SceneActivationLevelForegroundInactive:
-      // Present reauth vc if not presented already.
+      // If pushing view controller fails, close the UI.
       if (!_reauthViewController) {
-        [self pushReauthenticationViewControllerWithRequestAuth:NO];
+        if (![self pushReauthenticationViewControllerWithRequestAuth:NO]) {
+          [self closeUI];
+        }
       }
       break;
 
diff --git a/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm b/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
index 5a6e51b6b..3d887457 100644
--- a/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
+++ b/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
@@ -63,6 +63,18 @@
 
 @end
 
+@interface FailedPushNavigationController : UINavigationController
+@end
+
+@implementation FailedPushNavigationController
+
+- (void)pushViewController:(UIViewController*)viewController
+                  animated:(BOOL)animated {
+  // Simulate push failure by doing nothing.
+}
+
+@end
+
 // Test fixture for LocalReauthenticationCoordinator.
 class ReauthenticationCoordinatorTest : public PlatformTest {
  protected:
@@ -351,3 +363,26 @@
       base_navigation_controller_.topViewController;
   EXPECT_TRUE(topViewController.modalInPresentation);
 }
+
+// Tests that if pushing the reauth view controller fails on ForegroundInactive,
+// the coordinator dismisses the sensitive UI.
+TEST_F(ReauthenticationCoordinatorTest,
+       ReauthViewControllerClosesUIOnFailedVCPush) {
+  FailedPushNavigationController* navigation_controller =
+      [[FailedPushNavigationController alloc]
+          initWithRootViewController:[[UIViewController alloc] init]];
+  scoped_window_.Get().rootViewController = navigation_controller;
+
+  LocalReauthenticationCoordinator* coordinator =
+      [[LocalReauthenticationCoordinator alloc]
+          initWithBaseNavigationController:navigation_controller
+                                   browser:browser_.get()
+                               authOnStart:NO];
+  coordinator.delegate = delegate_;
+  [coordinator start];
+
+  scene_state_.activationLevel = SceneActivationLevelForegroundInactive;
+  EXPECT_TRUE(delegate_.dismissUICalled);
+
+  [coordinator stop];
+}
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm b/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
index 5a6e51b6b..3d887457 100644
--- a/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
+++ b/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
@@ -63,6 +63,18 @@
 
 @end
 
+@interface FailedPushNavigationController : UINavigationController
+@end
+
+@implementation FailedPushNavigationController
+
+- (void)pushViewController:(UIViewController*)viewController
+                  animated:(BOOL)animated {
+  // Simulate push failure by doing nothing.
+}
+
+@end
+
 // Test fixture for LocalReauthenticationCoordinator.
 class ReauthenticationCoordinatorTest : public PlatformTest {
  protected:
@@ -351,3 +363,26 @@
       base_navigation_controller_.topViewController;
   EXPECT_TRUE(topViewController.modalInPresentation);
 }
+
+// Tests that if pushing the reauth view controller fails on ForegroundInactive,
+// the coordinator dismisses the sensitive UI.
+TEST_F(ReauthenticationCoordinatorTest,
+       ReauthViewControllerClosesUIOnFailedVCPush) {
+  FailedPushNavigationController* navigation_controller =
+      [[FailedPushNavigationController alloc]
+          initWithRootViewController:[[UIViewController alloc] init]];
+  scoped_window_.Get().rootViewController = navigation_controller;
+
+  LocalReauthenticationCoordinator* coordinator =
+      [[LocalReauthenticationCoordinator alloc]
+          initWithBaseNavigationController:navigation_controller
+                                   browser:browser_.get()
+                               authOnStart:NO];
+  coordinator.delegate = delegate_;
+  [coordinator start];
+
+  scene_state_.activationLevel = SceneActivationLevelForegroundInactive;
+  EXPECT_TRUE(delegate_.dismissUICalled);
+
+  [coordinator stop];
+}
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.