From c2ca57044b1fe69ab46bff64e914f50a389e59d6 Mon Sep 17 00:00:00 2001
From: Aman Verma <amanvr@google.com>
Date: Thu, 30 Jul 2026 10:12:19 -0700
Subject: [PATCH] Disallow background window container type on non-extension builds

ChromeContentBrowserClient::CanCreateWindow() previously returned true
unconditionally for WindowContainerType::BACKGROUND on non-extension
builds (such as Chrome for Android) where ENABLE_EXTENSIONS_CORE is
false. This allowed ordinary web content to bypass popup blocking when
calling window.open(url, name, 'background').

This change explicitly returns false for WindowContainerType::BACKGROUND
when ENABLE_EXTENSIONS_CORE is false, matching the behavior on Desktop
where ordinary web content lacking the extension background permission
is rejected.

A PlatformBrowserTest is added to platform_browser_tests (included in
both browser_tests and android_browsertests) to assert that calling
window.open(..., 'background') from ordinary web content returns null,
even when executed with transient user activation. Furthermore, it
verifies that no WebContents is created and includes a positive control
assertion that a standard popup without 'background' succeeds.

Bug: 520201931
Change-Id: I7b532a41121c6e2fb3eec984cfd88a5e37149d51
Fixed: 520201931
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8176283
Commit-Queue: Aman Verma <amanvr@google.com>
Reviewed-by: Dana Fried <dfried@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1671184}
---
diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
index b121c619..dd11264 100644
--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc
@@ -4518,9 +4518,11 @@
     if (extension && !extensions::BackgroundInfo::AllowJSAccess(extension)) {
       *no_javascript_access = true;
     }
-#endif
 
     return true;
+#else
+    return false;
+#endif
   }
 
 #if BUILDFLAG(ENABLE_EXTENSIONS_CORE) && BUILDFLAG(ENABLE_GUEST_VIEW)
diff --git a/chrome/browser/chrome_content_browser_client_platform_browsertest.cc b/chrome/browser/chrome_content_browser_client_platform_browsertest.cc
new file mode 100644
index 0000000..f183e34a
--- /dev/null
+++ b/chrome/browser/chrome_content_browser_client_platform_browsertest.cc
@@ -0,0 +1,69 @@
+// Copyright 2026 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/test/base/chrome_test_utils.h"
+#include "chrome/test/base/platform_browser_test.h"
+#include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
+#include "content/public/test/browser_test_utils.h"
+#include "net/dns/mock_host_resolver.h"
+#include "net/test/embedded_test_server/embedded_test_server.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "url/gurl.h"
+
+namespace {
+
+class ChromeContentBrowserClientPlatformBrowserTest
+    : public PlatformBrowserTest {
+ public:
+  void SetUpOnMainThread() override {
+    PlatformBrowserTest::SetUpOnMainThread();
+    host_resolver()->AddRule("*", "127.0.0.1");
+    ASSERT_TRUE(embedded_test_server()->Start());
+  }
+
+  content::WebContents* web_contents() {
+    return chrome_test_utils::GetActiveWebContents(this);
+  }
+};
+
+// window.open() with the 'background' window feature from ordinary web content
+// must not be allowed to open a new window, even with transient user
+// activation.
+IN_PROC_BROWSER_TEST_F(ChromeContentBrowserClientPlatformBrowserTest,
+                       BackgroundFeatureFromOrdinaryWebContentIsBlocked) {
+  ASSERT_TRUE(content::NavigateToURL(
+      web_contents(), embedded_test_server()->GetURL("/title1.html")));
+
+  const size_t initial_web_contents_count = content::GetAllWebContents().size();
+
+  // 1. Attempt to open a window with the 'background' feature.
+  // Using default EvalJs options executes with user_gesture = true, which is
+  // critical: without a user gesture, the standard popup blocker would reject
+  // the call before reaching ChromeContentBrowserClient::CanCreateWindow().
+  // Even with user activation, ordinary web content lacks extension background
+  // permissions and must be refused when requesting 'background' window
+  // features.
+  EXPECT_EQ(true,
+            content::EvalJs(
+                web_contents(),
+                "window.open('/title2.html', '', 'background') === null"));
+
+  // Verify browser-side state: no new WebContents or tab was created.
+  EXPECT_EQ(initial_web_contents_count, content::GetAllWebContents().size());
+
+  // 2. Control assertion: verify that an ordinary popup without 'background'
+  // succeeds with transient user activation, proving that the failure above
+  // was specifically due to the 'background' window feature and not because
+  // popups are globally disabled in the test environment.
+  EXPECT_EQ(true,
+            content::EvalJs(web_contents(),
+                            "window.open('/title2.html', '', '') !== null"));
+
+  // Verify that exactly one new WebContents was created by the control popup.
+  EXPECT_EQ(initial_web_contents_count + 1,
+            content::GetAllWebContents().size());
+}
+
+}  // namespace
diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
index c56e0ea..24995b9 100644
--- a/chrome/test/BUILD.gn
+++ b/chrome/test/BUILD.gn
@@ -1021,6 +1021,7 @@
   defines = [ "HAS_OUT_OF_PROC_TEST_RUNNER" ]
 
   sources = [
+    "../browser/chrome_content_browser_client_platform_browsertest.cc",
     "../browser/loadtimes_extension_bindings_browsertest.cc",
     "../browser/no_best_effort_tasks_browsertest.cc",
     "../browser/safe_browsing/client_side_detection_service_browsertest.cc",

diff --git a/chrome/browser/chrome_content_browser_client_platform_browsertest.cc b/chrome/browser/chrome_content_browser_client_platform_browsertest.cc
new file mode 100644
index 0000000..f183e34a
--- /dev/null
+++ b/chrome/browser/chrome_content_browser_client_platform_browsertest.cc
@@ -0,0 +1,69 @@
+// Copyright 2026 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/test/base/chrome_test_utils.h"
+#include "chrome/test/base/platform_browser_test.h"
+#include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
+#include "content/public/test/browser_test_utils.h"
+#include "net/dns/mock_host_resolver.h"
+#include "net/test/embedded_test_server/embedded_test_server.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "url/gurl.h"
+
+namespace {
+
+class ChromeContentBrowserClientPlatformBrowserTest
+    : public PlatformBrowserTest {
+ public:
+  void SetUpOnMainThread() override {
+    PlatformBrowserTest::SetUpOnMainThread();
+    host_resolver()->AddRule("*", "127.0.0.1");
+    ASSERT_TRUE(embedded_test_server()->Start());
+  }
+
+  content::WebContents* web_contents() {
+    return chrome_test_utils::GetActiveWebContents(this);
+  }
+};
+
+// window.open() with the 'background' window feature from ordinary web content
+// must not be allowed to open a new window, even with transient user
+// activation.
+IN_PROC_BROWSER_TEST_F(ChromeContentBrowserClientPlatformBrowserTest,
+                       BackgroundFeatureFromOrdinaryWebContentIsBlocked) {
+  ASSERT_TRUE(content::NavigateToURL(
+      web_contents(), embedded_test_server()->GetURL("/title1.html")));
+
+  const size_t initial_web_contents_count = content::GetAllWebContents().size();
+
+  // 1. Attempt to open a window with the 'background' feature.
+  // Using default EvalJs options executes with user_gesture = true, which is
+  // critical: without a user gesture, the standard popup blocker would reject
+  // the call before reaching ChromeContentBrowserClient::CanCreateWindow().
+  // Even with user activation, ordinary web content lacks extension background
+  // permissions and must be refused when requesting 'background' window
+  // features.
+  EXPECT_EQ(true,
+            content::EvalJs(
+                web_contents(),
+                "window.open('/title2.html', '', 'background') === null"));
+
+  // Verify browser-side state: no new WebContents or tab was created.
+  EXPECT_EQ(initial_web_contents_count, content::GetAllWebContents().size());
+
+  // 2. Control assertion: verify that an ordinary popup without 'background'
+  // succeeds with transient user activation, proving that the failure above
+  // was specifically due to the 'background' window feature and not because
+  // popups are globally disabled in the test environment.
+  EXPECT_EQ(true,
+            content::EvalJs(web_contents(),
+                            "window.open('/title2.html', '', '') !== null"));
+
+  // Verify that exactly one new WebContents was created by the control popup.
+  EXPECT_EQ(initial_web_contents_count + 1,
+            content::GetAllWebContents().size());
+}
+
+}  // namespace
diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
index c56e0ea..24995b9 100644
--- a/chrome/test/BUILD.gn
+++ b/chrome/test/BUILD.gn
@@ -1021,6 +1021,7 @@
   defines = [ "HAS_OUT_OF_PROC_TEST_RUNNER" ]
 
   sources = [
+    "../browser/chrome_content_browser_client_platform_browsertest.cc",
     "../browser/loadtimes_extension_bindings_browsertest.cc",
     "../browser/no_best_effort_tasks_browsertest.cc",
     "../browser/safe_browsing/client_side_detection_service_browsertest.cc",