Chrome · Linux Toolkit Theming
CVE-2026-78974
Logic Error in Linux Toolkit Theming
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
ui/gtk/gtk.sigsui/gtk/select_file_dialog_linux_gtk.cc
Patch
From 1580de16c61d14aa215901fab5eb0ffbab454cf5 Mon Sep 17 00:00:00 2001
From: Tom Anderson <thomasanderson@chromium.org>
Date: Tue, 07 Jul 2026 17:18:32 -0700
Subject: [PATCH] [GTK] Mitigate file picker accept button focus stealing
Explicitly set the file open and folder selection dialog's default
response to GTK_RESPONSE_CANCEL using gtk_dialog_set_default_response.
The previous mitigation (CL 7399531) used a custom 0 response ID to
attempt to prevent GTK from preselecting the accept button. However,
certain desktop environments like XFCE and custom GTK themes still focus
the first non-cancel button upon the dialog's appearance.
By designating GTK_RESPONSE_CANCEL as the default response for
open/upload dialogs, unintended Enter key presses will safely close the
dialog. Standard user selection via pressing Enter in the file list or
filename entry remains unaffected as they are handled internally by
GtkFileChooser via its file-activated signal.
This focus-prevention behavior is restricted to File Open and Select
Folder dialogs. Save As dialogs continue to use the default Save button
to avoid usability regressions when typing filenames.
Bug: 503048520
Change-Id: I5d2243c5ea2bf113180ea5a091945943fa34bab3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8061985
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Thomas Anderson <thomasanderson@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1658399}
---
diff --git a/ui/gtk/gtk.sigs b/ui/gtk/gtk.sigs
index 8e13d2d..a669940 100644
--- a/ui/gtk/gtk.sigs
+++ b/ui/gtk/gtk.sigs
@@ -196,3 +196,5 @@
void gtk_window_set_modal(GtkWindow* window, gboolean modal);
void gtk_print_settings_set_printer(GtkPrintSettings* settings, const gchar* printer);
GType gtk_settings_get_type(void);
+GType gtk_dialog_get_type(void);
+void gtk_dialog_set_default_response(GtkDialog* dialog, gint response_id);
diff --git a/ui/gtk/select_file_dialog_linux_gtk.cc b/ui/gtk/select_file_dialog_linux_gtk.cc
index c354a04..e56fa5b 100644
--- a/ui/gtk/select_file_dialog_linux_gtk.cc
+++ b/ui/gtk/select_file_dialog_linux_gtk.cc
@@ -464,6 +464,7 @@
GtkWidget* dialog = GtkFileChooserDialogNew(
title.c_str(), nullptr, GTK_FILE_CHOOSER_ACTION_OPEN, GetCancelLabel(),
GTK_RESPONSE_CANCEL, GetOpenLabel(), kResponseTypeAccept);
+ gtk_dialog_set_default_response(GTK_DIALOG(dialog), GTK_RESPONSE_CANCEL);
SetGtkTransientForAura(dialog, parent, platform_);
AddFilters(GTK_FILE_CHOOSER(dialog));
@@ -504,6 +505,7 @@
title_string.c_str(), nullptr, GTK_FILE_CHOOSER_ACTION_SELECT_FOLDER,
GetCancelLabel(), GTK_RESPONSE_CANCEL, accept_button_label.c_str(),
kResponseTypeAccept);
+ gtk_dialog_set_default_response(GTK_DIALOG(dialog), GTK_RESPONSE_CANCEL);
SetGtkTransientForAura(dialog, parent, platform_);
GtkFileChooser* chooser = GTK_FILE_CHOOSER(dialog);
if (type == SELECT_UPLOAD_FOLDER || type == SELECT_EXISTING_FOLDER)
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page