Chrome · Select
CVE-2026-78946
Authorization Error in Select
Overview
Low
Severity
4.3
CVSS
No
Exploited ITW
Fixed
Fix Status
Background
- Trusted vs. untrusted events
- Browser-generated input events have
isTrusted() == true. Events made by script (dispatchEvent(new MouseEvent('mousedown'))) are untrusted and should not trigger actions that need a real user, such as opening a<select>picker. - `is_trusted_or_click`
- a local in Blink’s event dispatcher (
event_dispatcher.cc) that decides whether an event counts as user-originated for default-action handling. - `GetWideViewportQuirkEnabled()`
- a Blink
Settingsvalue that, according to the code comments, is turned on for Android WebView. The old quirk relied on it to identify WebView. - `SelectWebViewUntrustedEventRemoval`
- a new runtime-enabled feature,
status: "experimental". When enabled, it removes the WebView hack that let untrustedmousedownevents open<select>pickers.
Root Cause Analysis
Blink’s event dispatcher had a compatibility hack (TODO(dtapuska), crbug.com/643705). For an untrusted mousedown MouseEvent targeting an HTMLSelectElement, it set is_trusted_or_click = settings->GetWideViewportQuirkEnabled(). On WebView, script-generated mousedowns were therefore treated as user-initiated for <select>, and could open the picker without a real gesture. That is the incorrect authorization: an untrusted event got trusted-event privileges.
The patch adds !RuntimeEnabledFeatures::SelectWebViewUntrustedEventRemovalEnabled() to the condition, so the upgrade is skipped when the feature is on. Apart from that guard and a TODO, the patch adds no new check. The feature is experimental, so it is off by default in the code. It is turned on only through fieldtrial_testing_config.json (testing/variations), the WebView developer flag list (ProductionSupportedFlagList.java), or a later default flip, which is (inferred). This commit makes the fix possible to roll out; on its own it does not change behavior on stable WebView.
Key insight
A platform quirk let a synthetic
mousedown count as trusted for opening <select>. The patch puts that upgrade behind a kill-switch feature (SelectWebViewUntrustedEventRemoval) so the hack can be turned off and later removed.Attack Path
- Content loaded in an Android WebView
An attacker’s page runs in an app’s WebView. That is where
GetWideViewportQuirkEnabled()is true according to the code comments, and the quirk does not apply elsewhere. - Synthetic mousedown on a `<select>`
Page script dispatches an untrusted
mousedownMouseEventon anHTMLSelectElement, with no user gesture. - Event upgraded to trusted
With the feature disabled (the default), the dispatcher sets
is_trusted_or_clickfrom the WebView quirk setting, so the event is handled as if the user clicked. - Picker opens without user activation
The
<select>picker opens programmatically, which ordinary web content should not be able to do. Using this for UI spoofing or click redirection is (inferred).
Impact Assessment
The bug lets web content in Android WebView skip the user-activation requirement for opening a
<select> picker, in the renderer and in the native picker UI it requests. The diff shows no memory-safety issue or cross-origin data access. Practical impact is likely limited to gesture bypass and UI-confusion scenarios (inferred). It is limited to WebView, or wherever the wide-viewport quirk setting is on, and it remains reachable until SelectWebViewUntrustedEventRemoval is enabled. The vendor advisory rates this low severity and does not report in-the-wild exploitation; NVD scores it CVSS 4.3.Files Changed
testing/variations/fieldtrial_testing_config.jsonthird_party/blink/renderer/platform/runtime_enabled_features.json5android_webview/java/src/org/chromium/android_webview/common/ProductionSupportedFlagList.javathird_party/blink/renderer/core/dom/events/event_dispatcher.cc
Audit Directions
- Trust upgrades for synthetic eventsSearch Blink for code that sets or overrides trust flags (
is_trusted_or_click,SetTrusted,isTrusted()checks with platform exceptions). Any quirk that treats script-dispatched events as user-initiated weakens a gesture boundary. - Settings-gated compatibility hacksReview quirks keyed on embedder
Settings(WebView-only flags such asGetWideViewportQuirkEnabled) that relax security-relevant checks. They tend to persist and are rarely re-examined. - Picker and popup openersCheck other controls that open native UI (
<input type=date/color/file>,showPicker(),<select>withappearance: base-select) for paths reachable from untrusted events or without transient user activation.
Patch
From 1918c92684315e4c284e52c7e03729754513c1c3 Mon Sep 17 00:00:00 2001
From: Joey Arhar <jarhar@chromium.org>
Date: Mon, 01 Jun 2026 13:10:13 -0700
Subject: [PATCH] Move <select> WebView untrusted click fix behind flag
This hack which allows untrusted mousedown events to open select pickers
on WebView has low enough usage that it should be removable. This patch
moves it behind a flag so that we can remove it.
Bug: 41273490, 517718241
Change-Id: Id7bbf6741c3dcf23d54f58758784d99f22ff246d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7886363
Reviewed-by: David Grogan <dgrogan@chromium.org>
Commit-Queue: David Grogan <dgrogan@chromium.org>
Reviewed-by: Joey Arhar <jarhar@chromium.org>
Commit-Queue: Joey Arhar <jarhar@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1639616}
---
diff --git a/android_webview/java/src/org/chromium/android_webview/common/ProductionSupportedFlagList.java b/android_webview/java/src/org/chromium/android_webview/common/ProductionSupportedFlagList.java
index 3e2fa34..094089f8 100644
--- a/android_webview/java/src/org/chromium/android_webview/common/ProductionSupportedFlagList.java
+++ b/android_webview/java/src/org/chromium/android_webview/common/ProductionSupportedFlagList.java
@@ -1402,6 +1402,10 @@
Flag.baseFeature(
AwFeatures.WEBVIEW_CPP_METRICS_FILTERING,
"Enables WebView UMA metrics filtering in C++ instead of Java."),
+ Flag.baseFeature(
+ BlinkFeatures.SELECT_WEBVIEW_UNTRUSTED_EVENT_REMOVAL,
+ "Enables the removal of a WebView-specific hack to allow select elements to be"
+ + " opened with untrusted mousedown events."),
// Add new commandline switches and features above. The final entry should have a
// trailing comma for cleaner diffs.
};
diff --git a/testing/variations/fieldtrial_testing_config.json b/testing/variations/fieldtrial_testing_config.json
index 152fd23..e0c1f97 100644
--- a/testing/variations/fieldtrial_testing_config.json
+++ b/testing/variations/fieldtrial_testing_config.json
@@ -21631,6 +21631,26 @@
]
}
],
+ "SelectWebViewUntrustedEventRemoval": [
+ {
+ "platforms": [
+ "android",
+ "android_webview",
+ "chromeos",
+ "linux",
+ "mac",
+ "windows"
+ ],
+ "experiments": [
+ {
+ "name": "Enabled",
+ "enable_features": [
+ "SelectWebViewUntrustedEventRemoval"
+ ]
+ }
+ ]
+ }
+ ],
"SensitiveContent": [
{
"platforms": [
diff --git a/third_party/blink/renderer/core/dom/events/event_dispatcher.cc b/third_party/blink/renderer/core/dom/events/event_dispatcher.cc
index d22ef41c..9168a5b 100644
--- a/third_party/blink/renderer/core/dom/events/event_dispatcher.cc
+++ b/third_party/blink/renderer/core/dom/events/event_dispatcher.cc
@@ -428,7 +428,8 @@
// TODO(dtapuska): Change this to a target SDK quirk crbug.com/643705
if (!is_trusted_or_click && event_->IsMouseEvent() &&
event_->type() == event_type_names::kMousedown &&
- IsA<HTMLSelectElement>(*node_)) {
+ IsA<HTMLSelectElement>(*node_) &&
+ !RuntimeEnabledFeatures::SelectWebViewUntrustedEventRemovalEnabled()) {
if (Settings* settings = node_->GetDocument().GetSettings()) {
is_trusted_or_click = settings->GetWideViewportQuirkEnabled();
}
@@ -476,6 +477,8 @@
// Track the usage of sending a mousedown event to a select element to force
// it to open. This measures a possible breakage of not allowing untrusted
// events to open select boxes.
+ // TODO(crbug.com/41273490): Obsolete this UseCounter and remove this code
+ // after removing the corresponding functionality.
if (!event_->isTrusted() && event_->IsMouseEvent() &&
event_->type() == event_type_names::kMousedown &&
IsA<HTMLSelectElement>(*node_)) {
diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
index 4f47db3..b7ecb44e 100644
--- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
+++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
@@ -5353,6 +5353,14 @@
status: "stable",
},
{
+ // Removes a hack which allows select elements to be opened with a script
+ // dispatched mousedown event on WebView, as opposed to a real user
+ // click.
+ // https://issues.chromium.org/issues/41273490
+ name: "SelectWebViewUntrustedEventRemoval",
+ status: "experimental",
+ },
+ {
name: "SendBeaconThrowForBlobWithNonSimpleType",
public: true,
status: "stable",
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page