Chrome · DevTools
CVE-2026-7915
Logic Error in DevTools
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
Patch
From f23db0dca7d17241f43f015369f58139b60bd4f9 Mon Sep 17 00:00:00 2001
From: Ryo Hashimoto <hashimoto@google.com>
Date: Wed, 01 Apr 2026 17:15:44 -0700
Subject: [PATCH] android: Filter devtools scheme
BUG=497936728
BUG=498454478
Change-Id: I10db3564d28d9ae97e1831a83da28acf9b6aafb3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7720562
Reviewed-by: Theresa Sullivan <twellington@chromium.org>
Commit-Queue: Ryo Hashimoto <hashimoto@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1608884}
---
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java b/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
index 563e76b8..cf04bc9 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
@@ -1069,6 +1069,7 @@
String lowerCaseScheme = scheme.toLowerCase(Locale.US);
if (UrlConstants.CHROME_SCHEME.equals(lowerCaseScheme)
|| UrlConstants.CHROME_NATIVE_SCHEME.equals(lowerCaseScheme)
+ || UrlConstants.DEVTOOLS_SCHEME.equals(lowerCaseScheme)
|| UrlConstants.DISTILLER_SCHEME.equals(lowerCaseScheme)
|| ContentUrlConstants.ABOUT_SCHEME.equals(lowerCaseScheme)) {
// Allow certain "safe" internal URLs to be launched by external
Loading diff…
Original Bug Report
reported by ha...@google.com
IntentHandler.intentHasUnsafeInternalScheme() should reject devtools:// URLs
(Split from issue 497936728)
IntentHandler.intentHasUnsafeInternalScheme() should reject devtools:// URLs
References
On This Page