Low chrome Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactUI misrepresentation in Linux Toolkit Theming
DescriptionUI misrepresentation in Linux Toolkit Theming
ComponentLinux Toolkit Theming
Bug ClassLogic Error
Tracker503048520
Fix commit1580de16c61d (chromium/src) +4/-0
CISA KEVNot listed
CreditedFrancesco Topol
Disclosed2026-08-25

Files Changed

  • ui/gtk/gtk.sigs
  • ui/gtk/select_file_dialog_linux_gtk.cc
From 1580de16c61d14aa215901fab5eb0ffbab454cf5 Mon Sep 17 00:00:00 2001
From: Tom Anderson <thomasanderson@chromium.org>
Date: Tue, 07 Jul 2026 17:18:32 -0700
Subject: [PATCH] [GTK] Mitigate file picker accept button focus stealing

Explicitly set the file open and folder selection dialog's default
response to GTK_RESPONSE_CANCEL using gtk_dialog_set_default_response.

The previous mitigation (CL 7399531) used a custom 0 response ID to
attempt to prevent GTK from preselecting the accept button. However,
certain desktop environments like XFCE and custom GTK themes still focus
the first non-cancel button upon the dialog's appearance.

By designating GTK_RESPONSE_CANCEL as the default response for
open/upload dialogs, unintended Enter key presses will safely close the
dialog. Standard user selection via pressing Enter in the file list or
filename entry remains unaffected as they are handled internally by
GtkFileChooser via its file-activated signal.

This focus-prevention behavior is restricted to File Open and Select
Folder dialogs. Save As dialogs continue to use the default Save button
to avoid usability regressions when typing filenames.

Bug: 503048520
Change-Id: I5d2243c5ea2bf113180ea5a091945943fa34bab3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8061985
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Thomas Anderson <thomasanderson@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1658399}
---

diff --git a/ui/gtk/gtk.sigs b/ui/gtk/gtk.sigs
index 8e13d2d..a669940 100644
--- a/ui/gtk/gtk.sigs
+++ b/ui/gtk/gtk.sigs
@@ -196,3 +196,5 @@
 void gtk_window_set_modal(GtkWindow* window, gboolean modal);
 void gtk_print_settings_set_printer(GtkPrintSettings* settings, const gchar* printer);
 GType gtk_settings_get_type(void);
+GType gtk_dialog_get_type(void);
+void gtk_dialog_set_default_response(GtkDialog* dialog, gint response_id);
diff --git a/ui/gtk/select_file_dialog_linux_gtk.cc b/ui/gtk/select_file_dialog_linux_gtk.cc
index c354a04..e56fa5b 100644
--- a/ui/gtk/select_file_dialog_linux_gtk.cc
+++ b/ui/gtk/select_file_dialog_linux_gtk.cc
@@ -464,6 +464,7 @@
   GtkWidget* dialog = GtkFileChooserDialogNew(
       title.c_str(), nullptr, GTK_FILE_CHOOSER_ACTION_OPEN, GetCancelLabel(),
       GTK_RESPONSE_CANCEL, GetOpenLabel(), kResponseTypeAccept);
+  gtk_dialog_set_default_response(GTK_DIALOG(dialog), GTK_RESPONSE_CANCEL);
   SetGtkTransientForAura(dialog, parent, platform_);
   AddFilters(GTK_FILE_CHOOSER(dialog));
 
@@ -504,6 +505,7 @@
       title_string.c_str(), nullptr, GTK_FILE_CHOOSER_ACTION_SELECT_FOLDER,
       GetCancelLabel(), GTK_RESPONSE_CANCEL, accept_button_label.c_str(),
       kResponseTypeAccept);
+  gtk_dialog_set_default_response(GTK_DIALOG(dialog), GTK_RESPONSE_CANCEL);
   SetGtkTransientForAura(dialog, parent, platform_);
   GtkFileChooser* chooser = GTK_FILE_CHOOSER(dialog);
   if (type == SELECT_UPLOAD_FOLDER || type == SELECT_EXISTING_FOLDER)
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.