PatchGap
Chrome · Downloads

CVE-2026-7932

Policy Bypass in Downloads
Medium watch CVSS 4.4 chrome Policy Bypass 🔧 Commit mapped

Overview

Medium
Severity
4.4
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInsufficient policy enforcement in Downloads
DescriptionInsufficient policy enforcement in Downloads
ComponentDownloads
Bug ClassPolicy Bypass
Action tierwatch — logic/policy bug — security-relevant, no memory-unsafety
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.
Tracker481634116
Fix commitc521d7fb720c (chromium/src) +10/-0
CWECWE-693
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CISA KEVNot listed
CreditedPovcfe of Tencent Security Xuanwu Lab
Reported2026-02-04 (per vendor advisory)
Fix landed2026-03-26 (public git)
Disclosed2026-05-05
Patch gap40 days — fix public in source before the advisory

Background

`chrome://download-internals`
a WebUI page for testing the background download service, not intended for end-user or enterprise-managed use.
`WebUIConfig::IsWebUIEnabled`
a per-WebUI hook the framework calls to decide whether a given chrome:// host may be instantiated in a particular BrowserContext; returning false disables the page.
`DefaultInternalWebUIConfig`
the base config DownloadInternalsUIConfig derives from, which by default leaves the internal WebUI enabled.
`ProfilePolicyConnector::IsManaged`
reports whether the profile is under enterprise policy management.

Root Cause Analysis

DownloadInternalsUIConfig previously inherited the default behavior and did not override IsWebUIEnabled, so chrome://download-internals was reachable in any profile — including enterprise-managed profiles. That page drives the background download service directly, which can be used to initiate downloads outside the paths that enforce download-related enterprise policy, so exposing it to managed profiles is an insufficient-policy-enforcement gap.

The fix adds an IsWebUIEnabled override that consults the profile’s ProfilePolicyConnector and returns !...->IsManaged(), i.e. the WebUI is enabled only for unmanaged profiles and disabled whenever the profile is managed. This closes the gap by preventing the test-only page from being instantiated under enterprise management, so its download capability can no longer be used to sidestep policy.

Key insight
The core mistake was shipping the chrome://download-internals test page with default (always-enabled) availability so managed profiles could reach it; the fix overrides IsWebUIEnabled to return false for managed profiles.

Attack Path

  1. Managed profile A user on an enterprise-managed Chrome profile (where download policy is expected to be enforced) navigates to chrome://download-internals.
  2. Page is instantiated Pre-patch, no IsWebUIEnabled override exists, so the default config allows the internal WebUI to load even under management.
  3. Drive background downloads The page’s controls over the background download service let the user trigger downloads through the testing surface, outside the normal policy-enforced download flow, achieving the policy bypass the advisory describes.

Impact Assessment

The affected party is an enterprise administrator whose download policy can be bypassed by a user on a managed profile reaching the test-only chrome://download-internals page; exploitation requires access to that profile and navigating to the internal URL. The advisory rates this medium severity and classifies it as insufficient policy enforcement in Downloads; it does not report in-the-wild exploitation. No memory corruption or code execution is involved.

Files Changed

  • chrome/browser/ui/webui/download_internals/download_internals_ui.cc
  • chrome/browser/ui/webui/download_internals/download_internals_ui.h

Audit Directions

  • Internal/test WebUIs under policy
    Audit other chrome://*-internals/debug WebUIs that inherit DefaultInternalWebUIConfig without an IsWebUIEnabled override, since they may be reachable in managed profiles.
  • Capability surfaces bypassing policy flows
    Review WebUI/debug pages that can initiate downloads, navigations, or other policy-governed actions outside the enforced code paths.
  • Managed-profile gating
    Check that features which should be restricted under enterprise management actually query ProfilePolicyConnector::IsManaged (or equivalent) at their entry points, not only in the main user flow.

Patch

view commit
From c521d7fb720c5ce0a5de9827a0f547d4e45316b0 Mon Sep 17 00:00:00 2001
From: Min Qin <qinmin@chromium.org>
Date: Thu, 26 Mar 2026 01:08:29 -0700
Subject: [PATCH] Don't allow download from chrome://download-internal for managed profile

chrome://download-internal is for testing background download service,
not supposed to work for managed profile.

Bug: 481634116
Change-Id: I2507207b7805a0771aeda605d20b2aa1a31d5022
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7691847
Reviewed-by: Tom Lukaszewicz <tluk@chromium.org>
Commit-Queue: Min Qin <qinmin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1605309}
---

diff --git a/chrome/browser/ui/webui/download_internals/download_internals_ui.cc b/chrome/browser/ui/webui/download_internals/download_internals_ui.cc
index efe1facb..af1be350 100644
--- a/chrome/browser/ui/webui/download_internals/download_internals_ui.cc
+++ b/chrome/browser/ui/webui/download_internals/download_internals_ui.cc
@@ -6,6 +6,7 @@
 
 #include <utility>
 
+#include "chrome/browser/policy/profile_policy_connector.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/webui/download_internals/download_internals_ui_message_handler.h"
 #include "chrome/common/url_constants.h"
@@ -16,6 +17,13 @@
 #include "content/public/browser/web_ui_data_source.h"
 #include "services/network/public/mojom/content_security_policy.mojom.h"
 
+bool DownloadInternalsUIConfig::IsWebUIEnabled(
+    content::BrowserContext* browser_context) {
+  return !Profile::FromBrowserContext(browser_context)
+              ->GetProfilePolicyConnector()
+              ->IsManaged();
+}
+
 DownloadInternalsUI::DownloadInternalsUI(content::WebUI* web_ui)
     : content::WebUIController(web_ui) {
   // chrome://download-internals source.
diff --git a/chrome/browser/ui/webui/download_internals/download_internals_ui.h b/chrome/browser/ui/webui/download_internals/download_internals_ui.h
index a515ef4..ec9a49b 100644
--- a/chrome/browser/ui/webui/download_internals/download_internals_ui.h
+++ b/chrome/browser/ui/webui/download_internals/download_internals_ui.h
@@ -16,6 +16,8 @@
  public:
   DownloadInternalsUIConfig()
       : DefaultInternalWebUIConfig(chrome::kChromeUIDownloadInternalsHost) {}
+
+  bool IsWebUIEnabled(content::BrowserContext* browser_context) override;
 };
 
 // The WebUI for chrome://download-internals.
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
On This Page