Chrome · Navigation
CVE-2026-8562
Logic Error in Navigation
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
components/page_load_metrics/browser/observers/use_counter/ukm_features.cc
Patch
From 6896f2f774f9b2bbfd8b13bc0a0edb4d73962c06 Mon Sep 17 00:00:00 2001
From: Camille Lamy <clamy@chromium.org>
Date: Tue, 17 Mar 2026 11:47:35 -0700
Subject: [PATCH] Add UKM for same-document navs with a cross-origin initiator
This CL adds the use counter for same-document navigations with a
cross-origin initator to the list of use counters tracked by UKMs. These
navigations have the potential to leak cross-origin information, so we'd
like to force all navigations with cross-origin initiators to be
cross-document. However, we want to better understand the compatibility
impact, hence the UKM.
Bug: 40057534
Change-Id: Ica85008a13220bc8c75476b26219dade6b470a88
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7666301
Auto-Submit: Camille Lamy <clamy@chromium.org>
Commit-Queue: Camille Lamy <clamy@chromium.org>
Reviewed-by: Alexei Svitkine <asvitkine@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1600696}
---
diff --git a/components/page_load_metrics/browser/observers/use_counter/ukm_features.cc b/components/page_load_metrics/browser/observers/use_counter/ukm_features.cc
index b179c50e..746dfd6 100644
--- a/components/page_load_metrics/browser/observers/use_counter/ukm_features.cc
+++ b/components/page_load_metrics/browser/observers/use_counter/ukm_features.cc
@@ -473,6 +473,7 @@
WebFeature::kSvgFilterPaintedOnLocalFrame,
WebFeature::kSvgFilterPaintedOnRemoteFrame,
WebFeature::kSvgFilterPaintedOnWebPlugin,
+ WebFeature::kSameDocumentCrossOriginInitiator,
// NOTE: before adding new use counters here, verify in UMA that
// their emissions are very rare, e.g. <1% of page loads.
}));
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page