Chrome · Chrome for iOS
CVE-2026-18011
Logic Error in Chrome for iOS
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator.mm |
modified | |
ReauthenticationCoordinatorTestios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm |
modified |
Files Changed
ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator.mmios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
Patch
From 1b6768698b4b36c888cf30843e8b2959b22d2bd3 Mon Sep 17 00:00:00 2001
From: Rafał Godlewski <rgod@google.com>
Date: Tue, 16 Jun 2026 00:46:05 -0700
Subject: [PATCH] [iOS] Close UI on failed reauth VC push in foreground inactive
Fixed: 522479633
Change-Id: I7bba821c3699cef35cc74afe6f86e6183eb0b4b9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7927831
Reviewed-by: Ernesto Izquierdo Clua <eic@google.com>
Commit-Queue: Rafał Godlewski <rgod@google.com>
Cr-Commit-Position: refs/heads/main@{#1647368}
---
diff --git a/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator.mm b/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator.mm
index 0f6004eb..18faaa6 100644
--- a/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator.mm
+++ b/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator.mm
@@ -240,9 +240,11 @@
}
[[fallthrough]];
case SceneActivationLevelForegroundInactive:
- // Present reauth vc if not presented already.
+ // If pushing view controller fails, close the UI.
if (!_reauthViewController) {
- [self pushReauthenticationViewControllerWithRequestAuth:NO];
+ if (![self pushReauthenticationViewControllerWithRequestAuth:NO]) {
+ [self closeUI];
+ }
}
break;
diff --git a/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm b/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
index 5a6e51b6b..3d887457 100644
--- a/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
+++ b/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
@@ -63,6 +63,18 @@
@end
+@interface FailedPushNavigationController : UINavigationController
+@end
+
+@implementation FailedPushNavigationController
+
+- (void)pushViewController:(UIViewController*)viewController
+ animated:(BOOL)animated {
+ // Simulate push failure by doing nothing.
+}
+
+@end
+
// Test fixture for LocalReauthenticationCoordinator.
class ReauthenticationCoordinatorTest : public PlatformTest {
protected:
@@ -351,3 +363,26 @@
base_navigation_controller_.topViewController;
EXPECT_TRUE(topViewController.modalInPresentation);
}
+
+// Tests that if pushing the reauth view controller fails on ForegroundInactive,
+// the coordinator dismisses the sensitive UI.
+TEST_F(ReauthenticationCoordinatorTest,
+ ReauthViewControllerClosesUIOnFailedVCPush) {
+ FailedPushNavigationController* navigation_controller =
+ [[FailedPushNavigationController alloc]
+ initWithRootViewController:[[UIViewController alloc] init]];
+ scoped_window_.Get().rootViewController = navigation_controller;
+
+ LocalReauthenticationCoordinator* coordinator =
+ [[LocalReauthenticationCoordinator alloc]
+ initWithBaseNavigationController:navigation_controller
+ browser:browser_.get()
+ authOnStart:NO];
+ coordinator.delegate = delegate_;
+ [coordinator start];
+
+ scene_state_.activationLevel = SceneActivationLevelForegroundInactive;
+ EXPECT_TRUE(delegate_.dismissUICalled);
+
+ [coordinator stop];
+}
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm b/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
index 5a6e51b6b..3d887457 100644
--- a/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
+++ b/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
@@ -63,6 +63,18 @@
@end
+@interface FailedPushNavigationController : UINavigationController
+@end
+
+@implementation FailedPushNavigationController
+
+- (void)pushViewController:(UIViewController*)viewController
+ animated:(BOOL)animated {
+ // Simulate push failure by doing nothing.
+}
+
+@end
+
// Test fixture for LocalReauthenticationCoordinator.
class ReauthenticationCoordinatorTest : public PlatformTest {
protected:
@@ -351,3 +363,26 @@
base_navigation_controller_.topViewController;
EXPECT_TRUE(topViewController.modalInPresentation);
}
+
+// Tests that if pushing the reauth view controller fails on ForegroundInactive,
+// the coordinator dismisses the sensitive UI.
+TEST_F(ReauthenticationCoordinatorTest,
+ ReauthViewControllerClosesUIOnFailedVCPush) {
+ FailedPushNavigationController* navigation_controller =
+ [[FailedPushNavigationController alloc]
+ initWithRootViewController:[[UIViewController alloc] init]];
+ scoped_window_.Get().rootViewController = navigation_controller;
+
+ LocalReauthenticationCoordinator* coordinator =
+ [[LocalReauthenticationCoordinator alloc]
+ initWithBaseNavigationController:navigation_controller
+ browser:browser_.get()
+ authOnStart:NO];
+ coordinator.delegate = delegate_;
+ [coordinator start];
+
+ scene_state_.activationLevel = SceneActivationLevelForegroundInactive;
+ EXPECT_TRUE(delegate_.dismissUICalled);
+
+ [coordinator stop];
+}
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page