Chrome · Downloads
CVE-2026-7932
Logic Error in Downloads
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
chrome/browser/ui/webui/download_internals/download_internals_ui.ccchrome/browser/ui/webui/download_internals/download_internals_ui.h
Patch
From c521d7fb720c5ce0a5de9827a0f547d4e45316b0 Mon Sep 17 00:00:00 2001
From: Min Qin <qinmin@chromium.org>
Date: Thu, 26 Mar 2026 01:08:29 -0700
Subject: [PATCH] Don't allow download from chrome://download-internal for managed profile
chrome://download-internal is for testing background download service,
not supposed to work for managed profile.
Bug: 481634116
Change-Id: I2507207b7805a0771aeda605d20b2aa1a31d5022
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7691847
Reviewed-by: Tom Lukaszewicz <tluk@chromium.org>
Commit-Queue: Min Qin <qinmin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1605309}
---
diff --git a/chrome/browser/ui/webui/download_internals/download_internals_ui.cc b/chrome/browser/ui/webui/download_internals/download_internals_ui.cc
index efe1facb..af1be350 100644
--- a/chrome/browser/ui/webui/download_internals/download_internals_ui.cc
+++ b/chrome/browser/ui/webui/download_internals/download_internals_ui.cc
@@ -6,6 +6,7 @@
#include <utility>
+#include "chrome/browser/policy/profile_policy_connector.h"
#include "chrome/browser/profiles/profile.h"
#include "chrome/browser/ui/webui/download_internals/download_internals_ui_message_handler.h"
#include "chrome/common/url_constants.h"
@@ -16,6 +17,13 @@
#include "content/public/browser/web_ui_data_source.h"
#include "services/network/public/mojom/content_security_policy.mojom.h"
+bool DownloadInternalsUIConfig::IsWebUIEnabled(
+ content::BrowserContext* browser_context) {
+ return !Profile::FromBrowserContext(browser_context)
+ ->GetProfilePolicyConnector()
+ ->IsManaged();
+}
+
DownloadInternalsUI::DownloadInternalsUI(content::WebUI* web_ui)
: content::WebUIController(web_ui) {
// chrome://download-internals source.
diff --git a/chrome/browser/ui/webui/download_internals/download_internals_ui.h b/chrome/browser/ui/webui/download_internals/download_internals_ui.h
index a515ef4..ec9a49b 100644
--- a/chrome/browser/ui/webui/download_internals/download_internals_ui.h
+++ b/chrome/browser/ui/webui/download_internals/download_internals_ui.h
@@ -16,6 +16,8 @@
public:
DownloadInternalsUIConfig()
: DefaultInternalWebUIConfig(chrome::kChromeUIDownloadInternalsHost) {}
+
+ bool IsWebUIEnabled(content::BrowserContext* browser_context) override;
};
// The WebUI for chrome://download-internals.
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page