Medium chrome Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactSide-channel information leakage in Navigation
DescriptionSide-channel information leakage in Navigation
ComponentNavigation
Bug ClassLogic Error
Tracker40057534
Fix commit6896f2f774f9 (chromium/src) +1/-0
CISA KEVNot listed
CreditedGoogle
Disclosed2026-05-12

Files Changed

  • components/page_load_metrics/browser/observers/use_counter/ukm_features.cc
From 6896f2f774f9b2bbfd8b13bc0a0edb4d73962c06 Mon Sep 17 00:00:00 2001
From: Camille Lamy <clamy@chromium.org>
Date: Tue, 17 Mar 2026 11:47:35 -0700
Subject: [PATCH] Add UKM for same-document navs with a cross-origin initiator

This CL adds the use counter for same-document navigations with a
cross-origin initator to the list of use counters tracked by UKMs. These
navigations have the potential to leak cross-origin information, so we'd
like to force all navigations with cross-origin initiators to be
cross-document. However, we want to better understand the compatibility
impact, hence the UKM.

Bug: 40057534
Change-Id: Ica85008a13220bc8c75476b26219dade6b470a88
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7666301
Auto-Submit: Camille Lamy <clamy@chromium.org>
Commit-Queue: Camille Lamy <clamy@chromium.org>
Reviewed-by: Alexei Svitkine <asvitkine@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1600696}
---

diff --git a/components/page_load_metrics/browser/observers/use_counter/ukm_features.cc b/components/page_load_metrics/browser/observers/use_counter/ukm_features.cc
index b179c50e..746dfd6 100644
--- a/components/page_load_metrics/browser/observers/use_counter/ukm_features.cc
+++ b/components/page_load_metrics/browser/observers/use_counter/ukm_features.cc
@@ -473,6 +473,7 @@
           WebFeature::kSvgFilterPaintedOnLocalFrame,
           WebFeature::kSvgFilterPaintedOnRemoteFrame,
           WebFeature::kSvgFilterPaintedOnWebPlugin,
+          WebFeature::kSameDocumentCrossOriginInitiator,
           // NOTE: before adding new use counters here, verify in UMA that
           // their emissions are very rare, e.g. <1% of page loads.
       }));
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.