Chrome · Browser › Android
CVE-2026-79225
Authorization Error in Browser (Android)
Overview
Low
Severity
4.3
CVSS
No
Exploited ITW
Fixed
Fix Status
Background
- Renderer debug URLs
- special URLs such as
javascript:,chrome://crash,chrome://killand similar that instruct the renderer to perform debug actions, and which are gated because they can be triggered programmatically. - DevTools access policy
- an enterprise/profile setting that can block DevTools for a page; when DevTools is blocked, debug URLs are supposed to be blocked too.
- `ENABLE_DEVTOOLS_FRONTEND`
- a build flag indicating the DevTools frontend is compiled in; it can be false even on non-Android desktop builds and is generally false where DevTools is not shipped.
- `IS_ANDROID`
- a build flag that is true on Android builds.
Root Cause Analysis
The changed function (the enclosing name is not in the hunk; from the file it is ChromeContentBrowserClient::ShouldBlockRendererDebugURL (inferred)) decides whether a renderer debug URL should be blocked, and it contains a block that consults the DevTools access policy: “If devtools access is blocked for the page, debug URLs should also be blocked.”
Pre-patch, that block was compiled under #if !BUILDFLAG(IS_ANDROID), meaning the DevTools-blocked-implies-debug-URL-blocked check was simply skipped on Android.
As a result, on Android a debug URL could be permitted even when DevTools access was blocked for the page, an incorrect authorization.
The fix changes the guard to #if BUILDFLAG(ENABLE_DEVTOOLS_FRONTEND) and moves the devtools_window.h include under the same flag, so the policy check now runs on Android (where DevTools frontend is enabled) and correctly ties debug-URL blocking to DevTools blocking, while excluding builds that lack the DevTools frontend entirely.
Key insight
The DevTools-access check that gates debug URLs was conditioned on the wrong build flag (
!IS_ANDROID), excluding Android entirely; the fix re-conditions it on ENABLE_DEVTOOLS_FRONTEND so the check runs wherever DevTools exists, including Android.Attack Path
- Target an Android profile with DevTools blocked A page runs in a context where the DevTools access policy blocks DevTools for that page, which should also block debug URLs.
- Invoke a renderer debug URL The page attempts to navigate to or trigger a renderer debug URL that the debug-URL handler evaluates.
- Skip the policy check on Android
Because the DevTools-blocked check was compiled out under
#if !BUILDFLAG(IS_ANDROID), the handler does not consult the DevTools policy on Android and fails to block the debug URL. - Debug action proceeds
The debug URL is honored despite the DevTools/debug restriction, violating the intended authorization (the concrete downstream effect is not shown in the diff)
(inferred).
Impact Assessment
On Android, a page that should have debug URLs blocked (because DevTools access is blocked for it) could nonetheless invoke renderer debug URLs, bypassing the intended DevTools-based restriction in the browser process’s decision path. The precondition is a build/configuration where DevTools access is blocked for the page. The vendor advisory rates this low severity and does not report in-the-wild exploitation; NVD scores it CVSS 4.3.
Files Changed
chrome/browser/chrome_content_browser_client.cc
Audit Directions
- Platform-conditional security checksSearch for
#if !BUILDFLAG(IS_ANDROID)(or other platform guards) wrapping authorization or policy checks; verify the platform exclusion is intentional rather than accidentally disabling enforcement. - Feature-flag vs platform-flag mismatchLook for checks that depend on a subsystem (e.g., DevTools) but are gated on a platform flag instead of the subsystem’s own capability flag (e.g.,
ENABLE_DEVTOOLS_FRONTEND). - Debug/privileged URL gatingAudit all decision points that permit
javascript:/chrome://debug URLs to ensure each consults the relevant access policies uniformly across every platform.
Patch
From ea3598ed49db149f49fea869b5cb4d1bde0de32e Mon Sep 17 00:00:00 2001
From: Ryo Hashimoto <hashimoto@google.com>
Date: Thu, 16 Jul 2026 09:24:51 -0700
Subject: [PATCH] android: Block renderer debug URL if DevTools is not allowed
BUG=533059149
Change-Id: I5315837844c3d801778762a5fea5465a0c3d9d96
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8068618
Reviewed-by: Danil Somsikov <dsv@chromium.org>
Commit-Queue: Ryo Hashimoto <hashimoto@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1663171}
---
diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
index 7a8f0d2..9c1c3cc 100644
--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc
@@ -549,7 +549,6 @@
#include "chrome/browser/actor/actor_keyed_service.h"
#include "chrome/browser/actor/actor_keyed_service_factory.h"
#include "chrome/browser/devtools/chrome_devtools_manager_delegate.h"
-#include "chrome/browser/devtools/devtools_window.h"
#include "chrome/browser/digital_credentials/digital_identity_provider_desktop.h"
#include "chrome/browser/direct_sockets/chrome_direct_sockets_delegate.h"
#include "chrome/browser/indigo/onboarding/indigo_onboarding_dialog.h"
@@ -640,6 +639,10 @@
#include "components/captive_portal/content/captive_portal_url_loader_throttle.h"
#endif
+#if BUILDFLAG(ENABLE_DEVTOOLS_FRONTEND)
+#include "chrome/browser/devtools/devtools_window.h"
+#endif
+
#if BUILDFLAG(ENABLE_EXTENSIONS_CORE)
#include "chrome/browser/extensions/chrome_content_browser_client_extensions_part.h"
#include "chrome/browser/extensions/chrome_extension_cookies.h"
@@ -7790,7 +7793,7 @@
const GURL& url,
content::BrowserContext* context,
content::RenderFrameHost* render_frame_host) {
-#if !BUILDFLAG(IS_ANDROID)
+#if BUILDFLAG(ENABLE_DEVTOOLS_FRONTEND)
// If devtools access is blocked for the page, debug URLs should also be
// blocked for the page.
Profile* profile = Profile::FromBrowserContext(context);
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page