From fe692728450f6a95d10bdd753dcb7f8af14aeb81 Mon Sep 17 00:00:00 2001
From: Alex Moshchuk <alexmos@chromium.org>
Date: Fri, 17 Jul 2026 09:09:47 -0700
Subject: [PATCH] Use browser-side origin for checks in ShouldLoadWithStorageAccess().

Currently, the same-origin check in ShouldLoadWithStorageAccess() uses
the renderer-provided initiator_origin. While this is validated via
ChildProcessSecurityPolicy, it could be forged to another origin
living in the same process. While the impact of that might be limited,
it's better to be safe and use the browser-side last committed origin
of previous_document_rfh. This should be correct because the
navigation in question is already guaranteed to be self-initiated
(i.e., the navigation's initiator is always the same as the frame's
previous RFH).

Bug: 517540292
Change-Id: I5706e9a0a5ce7fc47e9be9de3f07cfc7ec364532
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8109159
Reviewed-by: Chris Fredrickson <cfredric@chromium.org>
Commit-Queue: Alex Moshchuk <alexmos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1663940}
---

diff --git a/content/browser/renderer_host/navigation_request.cc b/content/browser/renderer_host/navigation_request.cc
index 1a9c2983..876fda9 100644
--- a/content/browser/renderer_host/navigation_request.cc
+++ b/content/browser/renderer_host/navigation_request.cc
@@ -1175,8 +1175,8 @@
     // Navigation was not self-initiated.
     return net::StorageAccessApiStatus::kNone;
   }
-  if (!common_params.initiator_origin ||
-      !common_params.initiator_origin->IsSameOriginWith(response_url) ||
+  if (!previous_document_rfh->GetLastCommittedOrigin().IsSameOriginWith(
+          response_url) ||
       did_encounter_cross_origin_redirect) {
     // Navigation is not fully same-origin.
     return net::StorageAccessApiStatus::kNone;