From 0a587d5886da25124d5c597ecd5e6961f2800faa Mon Sep 17 00:00:00 2001
From: Anna Tsvirchkova <atsvirchkova@google.com>
Date: Tue, 07 Jul 2026 00:51:22 -0700
Subject: [PATCH] Fix potential UI spoofing via password generation popup triggered by BFCached frame

Bug: 519242511
Change-Id: Ie0cedcb03613d519bcb2fd7ca1e8740e4d96f5a5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8035089
Reviewed-by: Ioana Treib <ioanap@chromium.org>
Commit-Queue: Anna Tsvirchkova <atsvirchkova@google.com>
Cr-Commit-Position: refs/heads/main@{#1657751}
---

diff --git a/chrome/browser/password_manager/chrome_password_manager_client.cc b/chrome/browser/password_manager/chrome_password_manager_client.cc
index 0767097a..232dec7 100644
--- a/chrome/browser/password_manager/chrome_password_manager_client.cc
+++ b/chrome/browser/password_manager/chrome_password_manager_client.cc
@@ -2163,6 +2163,11 @@
   if (!ui_data || !driver) {
     return;
   }
+  // The reply is renderer-controlled and may arrive after the originating RFH
+  // has been BFCached / become non-primary; do not show UI for inactive RFHs.
+  if (!CheckFrameActiveAndNotPrerendering(driver->render_frame_host())) {
+    return;
+  }
   // Check the data because it's a Mojo callback and the input isn't trusted.
   if (!password_manager::bad_message::CheckChildProcessSecurityPolicyForURL(
           driver->render_frame_host(), ui_data->form_data.url(),