CVE-2026-8565
Overview
Files Changed
chrome/app/generated_resources.grdchrome/app/generated_resources_grd/IDS_DOWNLOAD_BY_EXTENSION_URL.png.sha1
Patch
From 69626ea817c67a6450bf47627483671e030fa5d5 Mon Sep 17 00:00:00 2001
From: Yaw Frempong <yawfrempong@google.com>
Date: Thu, 19 Mar 2026 11:23:03 -0700
Subject: [PATCH] [Downloads Origin] Update String for Download by Extension URL
Details: Update the text for downloads triggered by an extension URL to
make spoofing attempts more obvious to the end-user.
Screenshot: https://crbug.com/442860473#attachment74524550
Bug: 442860473
Change-Id: Ibb900e954a2d4cb1ba9b0852846a9634d842db7a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7681374
Reviewed-by: Lily Chen <chlily@chromium.org>
Reviewed-by: Andrew Liu <liu@chromium.org>
Commit-Queue: Yaw Frempong <yawfrempong@google.com>
Cr-Commit-Position: refs/heads/main@{#1602119}
---
diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
index 2971987..5e61840 100644
--- a/chrome/app/generated_resources.grd
+++ b/chrome/app/generated_resources.grd
@@ -2554,7 +2554,7 @@
</message>
<message name="IDS_DOWNLOAD_BY_EXTENSION_URL"
desc="Indicates which extension downloaded this file by name and URL.">
- Downloaded by <a href="<ph name="URL">$1<ex>adblock.com</ex></ph>"><ph name="EXTENSION">$2<ex>The Best Chrome Extension Ever</ex></ph></a>
+ Downloaded by extension: <a href="<ph name="URL">$1<ex>adblock.com</ex></ph>"><ph name="EXTENSION">$2<ex>The Best Chrome Extension Ever</ex></ph></a>
</message>
<message name="IDS_DOWNLOADS_PAGE_INITIATOR_LINE" desc="Line that indicates the site that initiated a file download.">
From <ph name="DISPLAY_INITIATOR_ORIGIN">$1<ex>https://example.com</ex></ph>
diff --git a/chrome/app/generated_resources_grd/IDS_DOWNLOAD_BY_EXTENSION_URL.png.sha1 b/chrome/app/generated_resources_grd/IDS_DOWNLOAD_BY_EXTENSION_URL.png.sha1
new file mode 100644
index 0000000..bd9577f
--- /dev/null
+++ b/chrome/app/generated_resources_grd/IDS_DOWNLOAD_BY_EXTENSION_URL.png.sha1
@@ -0,0 +1 @@
+be7e7e58432e297c51f8baff1f3365b9c45e41f1
\ No newline at end of file
Original Bug Report
File Source Origin Spoofing via Extension Name
Steps to reproduce the problem
- Load the extension
- Go to chrome://extensions
- Reload the extension
- Go to chrome://downloads and you will see the google.apk origin is pointing to https://google.com
Problem Description
This vulnerability occurs when the chrome://downloads source origin can be spoofed via the extension name. By default, if we install an extension that downloads a file, Chrome will set the downloaded file’s origin to the extension’s name. For example, if a file is downloaded by an extension named “Frozzipies Extension”, Chrome will display the origin as “Downloaded by Frozzipies Extension”.
However, in this case, we can use any valid URL (like https://google.com) as the extension name, which causes Chrome to display the file origin as “Downloaded by https://google.com”, leading to an origin spoofing issue.
Summary
File Source Origin Spoofing via Extension Name
Additional Data
Category: Security
Chrome Channel: Not sure
Regression: N/A \