CVE-2026-7915
Overview
Background
- `IntentHandler`
- the Chrome-for-Android class that validates and parses incoming Android
Intentdata (including intents originating from other, untrusted apps) before a URL becomes a navigation. - `devtools://` scheme
- a privileged internal WebUI scheme (
UrlConstants.DEVTOOLS_SCHEME) backing the DevTools frontend, expected to be reachable only from trusted contexts. - Internal-scheme classification
- the patched
ifcondition that lists the internal schemes (CHROME_SCHEME,CHROME_NATIVE_SCHEME,DISTILLER_SCHEME,ABOUT_SCHEME) given special, controlled handling when they arrive via external intents. - Untrusted input validation
- the requirement that scheme/URL data supplied by a foreign app be validated and correctly categorized before Chrome acts on it.
Root Cause Analysis
The single-line change adds UrlConstants.DEVTOOLS_SCHEME to the scheme-matching if in IntentHandler.java, placing it in the same recognized internal-scheme set as CHROME_SCHEME, CHROME_NATIVE_SCHEME, DISTILLER_SCHEME, and ABOUT_SCHEME whose retained comment reads “Allow certain ‘safe’ internal URLs to be launched by external [applications]”. Before the patch, a devtools:// URL arriving as external intent data was not matched by this classification, so the untrusted scheme value escaped the data-validation/handling that other privileged internal schemes receive. The violated invariant is that scheme data taken from a cross-app Intent must be validated and routed through the internal-scheme path for every privileged scheme, not silently fall through for devtools://.
The fix (BUG=497936728, BUG=498454478) adds the missing scheme so the untrusted devtools:// input is properly recognized and constrained. The enclosing method name is not present in the hunk context header, so I do not name it. No lines were removed; the old (deficient) behavior is simply the omission of DEVTOOLS_SCHEME.
devtools:// scheme from untrusted external intents because UrlConstants.DEVTOOLS_SCHEME was missing from IntentHandler’s internal-scheme set; the fix adds it so the scheme is validated and handled like the other privileged internal schemes.Attack Path
- Build a crafted intent
An external Android app creates an
Intentwhose URL carries thedevtools://scheme as attacker-controlled input. - Deliver to Chrome
Chrome receives the intent and
IntentHandlercomputeslowerCaseSchemefrom the supplied data for classification. - Fail classification (pre-patch)
Lacking
DEVTOOLS_SCHEMEin theif, the handler did not categorize the value as a recognized internal scheme, so the untrusted URL skipped the intended validation/handling branch. - Act on unvalidated scheme
The
devtools://URL could then be processed without the data-validation/policy constraints applied to other internal schemes, reaching privileged DevTools surface from untrusted input (inferred).
Impact Assessment
devtools:// URL through IntentHandler that was not subjected to the validation applied to other privileged internal schemes — an insufficient-data-validation flaw as the advisory states (“Insufficient data validation in DevTools,” severity high). The attacker gains the ability to have Chrome act on an unvalidated privileged-scheme URL supplied cross-app; any concrete escalation beyond that is not shown by this one-line diff and is (inferred). The advisory does not report exploitation in the wild.Files Changed
chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
Audit Directions
- Incomplete scheme enumerationsDiff every hardcoded internal-scheme list across Chrome (intent handling, external-navigation filters, WebUI gatekeepers) against the full set of privileged schemes in
UrlConstants, flagging any that omit one. - External-input data pathsTrace URL/scheme values that originate in third-party
Intents and confirm each is validated before use, especially where classification drives whether extra checks run. - Divergent handling by schemeWhere a privileged scheme is treated specially, verify newly added or less-common privileged schemes (
devtools://,chrome-untrusted://) are included everywhere the older ones are.
Patch
From f23db0dca7d17241f43f015369f58139b60bd4f9 Mon Sep 17 00:00:00 2001
From: Ryo Hashimoto <hashimoto@google.com>
Date: Wed, 01 Apr 2026 17:15:44 -0700
Subject: [PATCH] android: Filter devtools scheme
BUG=497936728
BUG=498454478
Change-Id: I10db3564d28d9ae97e1831a83da28acf9b6aafb3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7720562
Reviewed-by: Theresa Sullivan <twellington@chromium.org>
Commit-Queue: Ryo Hashimoto <hashimoto@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1608884}
---
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java b/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
index 563e76b8..cf04bc9 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
@@ -1069,6 +1069,7 @@
String lowerCaseScheme = scheme.toLowerCase(Locale.US);
if (UrlConstants.CHROME_SCHEME.equals(lowerCaseScheme)
|| UrlConstants.CHROME_NATIVE_SCHEME.equals(lowerCaseScheme)
+ || UrlConstants.DEVTOOLS_SCHEME.equals(lowerCaseScheme)
|| UrlConstants.DISTILLER_SCHEME.equals(lowerCaseScheme)
|| ContentUrlConstants.ABOUT_SCHEME.equals(lowerCaseScheme)) {
// Allow certain "safe" internal URLs to be launched by external
Original Bug Report
IntentHandler.intentHasUnsafeInternalScheme() should reject devtools:// URLs
(Split from issue 497936728)
IntentHandler.intentHasUnsafeInternalScheme() should reject devtools:// URLs