Medium chrome Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInsufficient policy enforcement in Downloads
DescriptionInsufficient policy enforcement in Downloads
ComponentDownloads
Bug ClassLogic Error
Tracker481634116
Fix commitc521d7fb720c (chromium/src) +10/-0
CISA KEVNot listed
CreditedPovcfe of Tencent Security Xuanwu Lab
Disclosed2026-05-05

Files Changed

  • chrome/browser/ui/webui/download_internals/download_internals_ui.cc
  • chrome/browser/ui/webui/download_internals/download_internals_ui.h
From c521d7fb720c5ce0a5de9827a0f547d4e45316b0 Mon Sep 17 00:00:00 2001
From: Min Qin <qinmin@chromium.org>
Date: Thu, 26 Mar 2026 01:08:29 -0700
Subject: [PATCH] Don't allow download from chrome://download-internal for managed profile

chrome://download-internal is for testing background download service,
not supposed to work for managed profile.

Bug: 481634116
Change-Id: I2507207b7805a0771aeda605d20b2aa1a31d5022
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7691847
Reviewed-by: Tom Lukaszewicz <tluk@chromium.org>
Commit-Queue: Min Qin <qinmin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1605309}
---

diff --git a/chrome/browser/ui/webui/download_internals/download_internals_ui.cc b/chrome/browser/ui/webui/download_internals/download_internals_ui.cc
index efe1facb..af1be350 100644
--- a/chrome/browser/ui/webui/download_internals/download_internals_ui.cc
+++ b/chrome/browser/ui/webui/download_internals/download_internals_ui.cc
@@ -6,6 +6,7 @@
 
 #include <utility>
 
+#include "chrome/browser/policy/profile_policy_connector.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/webui/download_internals/download_internals_ui_message_handler.h"
 #include "chrome/common/url_constants.h"
@@ -16,6 +17,13 @@
 #include "content/public/browser/web_ui_data_source.h"
 #include "services/network/public/mojom/content_security_policy.mojom.h"
 
+bool DownloadInternalsUIConfig::IsWebUIEnabled(
+    content::BrowserContext* browser_context) {
+  return !Profile::FromBrowserContext(browser_context)
+              ->GetProfilePolicyConnector()
+              ->IsManaged();
+}
+
 DownloadInternalsUI::DownloadInternalsUI(content::WebUI* web_ui)
     : content::WebUIController(web_ui) {
   // chrome://download-internals source.
diff --git a/chrome/browser/ui/webui/download_internals/download_internals_ui.h b/chrome/browser/ui/webui/download_internals/download_internals_ui.h
index a515ef4..ec9a49b 100644
--- a/chrome/browser/ui/webui/download_internals/download_internals_ui.h
+++ b/chrome/browser/ui/webui/download_internals/download_internals_ui.h
@@ -16,6 +16,8 @@
  public:
   DownloadInternalsUIConfig()
       : DefaultInternalWebUIConfig(chrome::kChromeUIDownloadInternalsHost) {}
+
+  bool IsWebUIEnabled(content::BrowserContext* browser_context) override;
 };
 
 // The WebUI for chrome://download-internals.
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.