CVE-2026-8565
Overview
Background
- Downloads origin attribution
- the download UI surface shows who initiated a download, including a dedicated string for downloads triggered by an extension URL.
- `IDS_DOWNLOAD_BY_EXTENSION_URL`
- the localized message resource (in
chrome/app/generated_resources.grd) rendering the “Downloaded by …” attribution line with the extension name linked to its URL. - UI spoofing
- misleading the user about the true source/trust of content; here, an extension-initiated download could be presented so it reads like an ordinary site download.
- `.grd` message / `.png.sha1` screenshot baseline
- the resource string plus a checked-in screenshot hash used by the translation/screenshot tooling.
Root Cause Analysis
This is a user-facing string change, not a code-logic fix. The IDS_DOWNLOAD_BY_EXTENSION_URL message previously read “Downloaded by <extension link>”, which did not clearly convey that an extension (rather than a website) initiated the download, enabling spoofing where an extension-triggered download looked like a normal one.
The patch changes the text to “Downloaded by extension: <extension link>”, explicitly labeling the initiator as an extension so spoofing attempts are more obvious to the end user. The only other change is a new IDS_DOWNLOAD_BY_EXTENSION_URL.png.sha1 screenshot-baseline file for the translation pipeline. No validation, parsing, or control-flow logic is altered; this neither tightens nor relaxes any runtime check — it is purely clarifying copy.
Attack Path
- Extension triggers a download
A download is initiated via an extension URL, so the download UI renders
IDS_DOWNLOAD_BY_EXTENSION_URL. - Ambiguous attribution
Pre-patch, the line reads “Downloaded by
<name/URL>” without signaling it was an extension, so the user may read it as an ordinary site download. - User misjudges trust Relying on the unclear attribution, the user may trust or act on the downloaded file believing it came from a benign source (a spoofing/social-engineering outcome; no memory-safety sink is involved).
Impact Assessment
Files Changed
chrome/app/generated_resources.grdchrome/app/generated_resources_grd/IDS_DOWNLOAD_BY_EXTENSION_URL.png.sha1
Audit Directions
- Initiator/origin attribution stringsReview download and permission UI strings that attribute an action to a site vs. an extension vs. the browser, ensuring the actor type is always explicit to resist spoofing.
- Extension-sourced UI surfacesAudit other places where extension-driven activity (downloads, notifications, prompts) is rendered to confirm the extension origin is clearly disclosed.
- Linkified names in trust decisionsWhere a user-visible link embeds an attacker-influenced name/URL, verify surrounding copy prevents the link from masquerading as a first-party or site-initiated action.
Patch
From 69626ea817c67a6450bf47627483671e030fa5d5 Mon Sep 17 00:00:00 2001
From: Yaw Frempong <yawfrempong@google.com>
Date: Thu, 19 Mar 2026 11:23:03 -0700
Subject: [PATCH] [Downloads Origin] Update String for Download by Extension URL
Details: Update the text for downloads triggered by an extension URL to
make spoofing attempts more obvious to the end-user.
Screenshot: https://crbug.com/442860473#attachment74524550
Bug: 442860473
Change-Id: Ibb900e954a2d4cb1ba9b0852846a9634d842db7a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7681374
Reviewed-by: Lily Chen <chlily@chromium.org>
Reviewed-by: Andrew Liu <liu@chromium.org>
Commit-Queue: Yaw Frempong <yawfrempong@google.com>
Cr-Commit-Position: refs/heads/main@{#1602119}
---
diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
index 2971987..5e61840 100644
--- a/chrome/app/generated_resources.grd
+++ b/chrome/app/generated_resources.grd
@@ -2554,7 +2554,7 @@
</message>
<message name="IDS_DOWNLOAD_BY_EXTENSION_URL"
desc="Indicates which extension downloaded this file by name and URL.">
- Downloaded by <a href="<ph name="URL">$1<ex>adblock.com</ex></ph>"><ph name="EXTENSION">$2<ex>The Best Chrome Extension Ever</ex></ph></a>
+ Downloaded by extension: <a href="<ph name="URL">$1<ex>adblock.com</ex></ph>"><ph name="EXTENSION">$2<ex>The Best Chrome Extension Ever</ex></ph></a>
</message>
<message name="IDS_DOWNLOADS_PAGE_INITIATOR_LINE" desc="Line that indicates the site that initiated a file download.">
From <ph name="DISPLAY_INITIATOR_ORIGIN">$1<ex>https://example.com</ex></ph>
diff --git a/chrome/app/generated_resources_grd/IDS_DOWNLOAD_BY_EXTENSION_URL.png.sha1 b/chrome/app/generated_resources_grd/IDS_DOWNLOAD_BY_EXTENSION_URL.png.sha1
new file mode 100644
index 0000000..bd9577f
--- /dev/null
+++ b/chrome/app/generated_resources_grd/IDS_DOWNLOAD_BY_EXTENSION_URL.png.sha1
@@ -0,0 +1 @@
+be7e7e58432e297c51f8baff1f3365b9c45e41f1
\ No newline at end of file
Original Bug Report
File Source Origin Spoofing via Extension Name
Steps to reproduce the problem
- Load the extension
- Go to chrome://extensions
- Reload the extension
- Go to chrome://downloads and you will see the google.apk origin is pointing to https://google.com
Problem Description
This vulnerability occurs when the chrome://downloads source origin can be spoofed via the extension name. By default, if we install an extension that downloads a file, Chrome will set the downloaded file’s origin to the extension’s name. For example, if a file is downloaded by an extension named “Frozzipies Extension”, Chrome will display the origin as “Downloaded by Frozzipies Extension”.
However, in this case, we can use any valid URL (like https://google.com) as the extension name, which causes Chrome to display the file origin as “Downloaded by https://google.com”, leading to an origin spoofing issue.
Summary
File Source Origin Spoofing via Extension Name
Additional Data
Category: Security
Chrome Channel: Not sure
Regression: N/A \