Low chrome Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactIncorrect authorization in DOM
DescriptionIncorrect authorization in DOM
ComponentDOM
Bug ClassLogic Error
Tracker533079345
Fix commit46163c79cd40 (chromium/src) +40/-3
CISA KEVNot listed
CreditedGoogle
Disclosed2026-08-25

Changed Functions

FunctionChangeNotes
TEST_F
third_party/blink/renderer/core/dom/element_test.cc
modified

Files Changed

  • third_party/blink/renderer/core/dom/element.cc
  • third_party/blink/renderer/core/dom/element_test.cc
From 46163c79cd4062bd154712e57e2fbbe2a66846f6 Mon Sep 17 00:00:00 2001
From: David Baron <dbaron@chromium.org>
Date: Tue, 21 Jul 2026 11:42:02 -0700
Subject: [PATCH] Propagate FocusType when forwarding Element::Focus.

Propagate FocusType when forwarding Element::Focus to the result of
GetFocusableArea() so that we don't incorrectly set
WasLastFocusFromUserGesture.

Both the fix and the test are AI-authored, though from different AI
tools.  (I shortened a verbose code comment in the fix.)

Fixed: 533079345
Change-Id: Ib44c0ea96a127ccbf5236449c96a0c77e59771e7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8116087
Reviewed-by: Mason Freed <masonf@chromium.org>
Commit-Queue: David Baron <dbaron@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1665655}
---

diff --git a/third_party/blink/renderer/core/dom/element.cc b/third_party/blink/renderer/core/dom/element.cc
index d484712..ade778c 100644
--- a/third_party/blink/renderer/core/dom/element.cc
+++ b/third_party/blink/renderer/core/dom/element.cc
@@ -8356,9 +8356,11 @@
     if (Element* new_focus_target = GetFocusableArea()) {
       // Unlike the specification, we re-run focus() for new_focus_target
       // because we can't change |this| in a member function.
-      new_focus_target->Focus(FocusParams(
-          SelectionBehaviorOnFocus::kReset, mojom::blink::FocusType::kForward,
-          /*capabilities=*/nullptr, params_to_use.options));
+      // Forward the caller's FocusType so we don't set
+      // WasLastFocusFromUserGesture incorrectly.
+      new_focus_target->Focus(
+          FocusParams(SelectionBehaviorOnFocus::kReset, params_to_use.type,
+                      /*capabilities=*/nullptr, params_to_use.options));
     }
     // 2. If new focus target is null, then:
     //  2.1. If no fallback target was specified, then return.
diff --git a/third_party/blink/renderer/core/dom/element_test.cc b/third_party/blink/renderer/core/dom/element_test.cc
index 42f169c..9ff0b1e1 100644
--- a/third_party/blink/renderer/core/dom/element_test.cc
+++ b/third_party/blink/renderer/core/dom/element_test.cc
@@ -1844,4 +1844,39 @@
   backdrop->DispatchEvent(*event);
 }
 
+TEST_F(ElementTest, DelegatesFocusWasLastFocusFromUserGesture) {
+  SetBodyContent("<div id='host'></div>");
+  ShadowRoot* shadow_root =
+      SetShadowContent("<div id='probe' contenteditable='true'></div>", "host");
+  shadow_root->SetDelegatesFocus(true);
+  UpdateAllLifecyclePhasesForTest();
+
+  Element* host = GetElementById("host");
+  Element* probe = shadow_root->getElementById(AtomicString("probe"));
+  ASSERT_TRUE(host);
+  ASSERT_TRUE(probe);
+
+  EXPECT_FALSE(probe->WasLastFocusFromUserGesture());
+
+  host->Focus();
+  EXPECT_EQ(probe, GetDocument().FocusedElement());
+  EXPECT_FALSE(probe->WasLastFocusFromUserGesture());
+
+  probe->blur();
+  EXPECT_NE(probe, GetDocument().FocusedElement());
+
+  host->Focus(FocusParams(SelectionBehaviorOnFocus::kRestore,
+                          mojom::blink::FocusType::kScript, nullptr));
+  EXPECT_EQ(probe, GetDocument().FocusedElement());
+  EXPECT_FALSE(probe->WasLastFocusFromUserGesture());
+
+  probe->blur();
+  EXPECT_NE(probe, GetDocument().FocusedElement());
+
+  host->Focus(FocusParams(SelectionBehaviorOnFocus::kRestore,
+                          mojom::blink::FocusType::kMouse, nullptr));
+  EXPECT_EQ(probe, GetDocument().FocusedElement());
+  EXPECT_TRUE(probe->WasLastFocusFromUserGesture());
+}
+
 }  // namespace blink
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/third_party/blink/renderer/core/dom/element_test.cc b/third_party/blink/renderer/core/dom/element_test.cc
index 42f169c..9ff0b1e1 100644
--- a/third_party/blink/renderer/core/dom/element_test.cc
+++ b/third_party/blink/renderer/core/dom/element_test.cc
@@ -1844,4 +1844,39 @@
   backdrop->DispatchEvent(*event);
 }
 
+TEST_F(ElementTest, DelegatesFocusWasLastFocusFromUserGesture) {
+  SetBodyContent("<div id='host'></div>");
+  ShadowRoot* shadow_root =
+      SetShadowContent("<div id='probe' contenteditable='true'></div>", "host");
+  shadow_root->SetDelegatesFocus(true);
+  UpdateAllLifecyclePhasesForTest();
+
+  Element* host = GetElementById("host");
+  Element* probe = shadow_root->getElementById(AtomicString("probe"));
+  ASSERT_TRUE(host);
+  ASSERT_TRUE(probe);
+
+  EXPECT_FALSE(probe->WasLastFocusFromUserGesture());
+
+  host->Focus();
+  EXPECT_EQ(probe, GetDocument().FocusedElement());
+  EXPECT_FALSE(probe->WasLastFocusFromUserGesture());
+
+  probe->blur();
+  EXPECT_NE(probe, GetDocument().FocusedElement());
+
+  host->Focus(FocusParams(SelectionBehaviorOnFocus::kRestore,
+                          mojom::blink::FocusType::kScript, nullptr));
+  EXPECT_EQ(probe, GetDocument().FocusedElement());
+  EXPECT_FALSE(probe->WasLastFocusFromUserGesture());
+
+  probe->blur();
+  EXPECT_NE(probe, GetDocument().FocusedElement());
+
+  host->Focus(FocusParams(SelectionBehaviorOnFocus::kRestore,
+                          mojom::blink::FocusType::kMouse, nullptr));
+  EXPECT_EQ(probe, GetDocument().FocusedElement());
+  EXPECT_TRUE(probe->WasLastFocusFromUserGesture());
+}
+
 }  // namespace blink
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.