PatchGap
Chrome · Safebrowsing

CVE-2026-95292

Authorization Error in Safebrowsing
Low watch CVSS 4.8 chrome Authorization Error 🔧 Commit mapped 🧬 Authorization check exists but is not enforced on every path

Overview

Low
Severity
4.8
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactIncorrect authorization in Safebrowsing
DescriptionIncorrect authorization in Safebrowsing
ComponentSafebrowsing
Bug ClassAuthorization Error
Action tierwatch — logic/policy bug — security-relevant, no memory-unsafety
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.
Tracker513781838
Fix commit3611fb3173dc (chromium/src) +31/-0
CWECWE-863
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CISA KEVNot listed
CreditedGoogle
Reported2026-05-16 (per vendor advisory)
Fix landed2026-08-18 (public git)
Disclosed2026-09-22
Patch gap35 days — fix public in source before the advisory

Background

Site familiarity
Chrome’s Safe Browsing signal that decides whether a navigation target is “familiar” to the user, which governs whether the renderer process is granted the V8 optimizing tiers.
DSE (Default Search Engine)
the user’s configured search provider, whose search-results URLs are treated as inherently familiar via a fast-path that skips the normal deferral and history check.
`ExtractSearchTermsFromURL`
a TemplateURLRef method used to recognize a DSE search URL that compares only host, port and path, never the URL scheme.
`SchemeIsCryptographic`
a GURL predicate that returns true only for cryptographic schemes such as https, used by the fix to gate the DSE fast-path.

Root Cause Analysis

The vulnerable path is in SiteFamiliarityFetcher::Start in site_familiarity_fetcher.cc, where a navigation is short-circuited to “familiar” whenever kSkipSiteFamiliarityDeferralForDefaultSearchEngine is enabled and IsDefaultSearchEngineUrl(fetch_url_, profile_) returns true. Because IsDefaultSearchEngineUrl relies on TemplateURLRef::ExtractSearchTermsFromURL, which matches only host, port and path and ignores the scheme, an http:// URL with the DSE’s host and path is misidentified as the DSE. The violated invariant is that the “familiar” fast-path must apply only to the genuine, secure DSE origin, not to any scheme sharing its host and path. An on-path (network) attacker can therefore serve http://<dse-host>/<dse-path> and inherit the DSE’s familiar verdict, obtaining a renderer with V8 optimizing tiers enabled that would otherwise be withheld from an unfamiliar site.

The fix adds fetch_url_.SchemeIsCryptographic() as an additional precondition, so the fast-path is taken only for cryptographic-scheme URLs and insecure HTTP navigations fall back to normal deferral and the history-based familiarity check.

Key insight
The single mistake is that DSE matching authorized the fast-path on host/port/path alone while ignoring scheme, letting an insecure look-alike inherit the trusted DSE’s verdict; the fix restores the missing scheme check by requiring SchemeIsCryptographic() before granting the fast-path.

Attack Path

  1. Position on the network An on-path attacker intercepts the victim’s plaintext HTTP traffic, able to serve content for arbitrary http:// hosts.
  2. Serve a DSE look-alike over HTTP The attacker responds to http://<dse-host>/<dse-path> so the navigation’s host, port and path match the configured default search engine while the scheme is insecure.
  3. Inherit the familiar verdict IsDefaultSearchEngineUrl matches via ExtractSearchTermsFromURL (scheme-blind), so SiteFamiliarityFetcher::Start takes the fast-path and marks the attacker’s page familiar, skipping deferral and the history check.
  4. Obtain an optimized renderer The familiar verdict grants the renderer the V8 optimizing tiers that an unfamiliar site would not receive.
  5. Leverage optimized V8 as a broader attack surface (inferred) With the optimizing tiers enabled, the attacker-controlled page runs in a renderer whose V8 attack surface is larger, easing further exploitation.

Impact Assessment

An on-path attacker gains an incorrect “familiar” authorization for an insecure HTTP page impersonating the DSE, causing the resulting renderer process to be granted the V8 optimizing tiers that should be withheld from unfamiliar sites. The precondition is a network (on-path) position over plaintext HTTP plus the kSkipSiteFamiliarityDeferralForDefaultSearchEngine feature being enabled. The advisory classifies this as incorrect authorization in Safe Browsing and does not state exploited-in-the-wild status; any escalation from the optimized renderer to memory corruption or code execution is (inferred) rather than demonstrated by the patch.

Files Changed

  • chrome/browser/site_protection/site_familiarity_fetcher.cc
  • chrome/browser/site_protection/site_familiarity_process_selection_deferring_condition_unittest.cc

Audit Directions

  • Scheme-blind identity matching
    Audit other callers of ExtractSearchTermsFromURL and IsDefaultSearchEngineUrl (and similar host/path comparisons) that make security decisions without also checking the scheme or origin.
  • Trust fast-paths gated on partial URL fields
    Review any code that skips deferral, familiarity, or Safe Browsing checks based on a URL matching a trusted target, confirming the match includes scheme and full origin, not just host/port/path.
  • Feature-flag-gated authorization shortcuts
    Examine other base::FeatureList-guarded shortcuts that bypass normal security checks (e.g., kSkipSiteFamiliarityDeferralForDefaultSearchEngine) for missing cryptographic-scheme or origin preconditions.

Patch

view commit
From 3611fb3173dc8ee282575797b8f0269b5a442e7b Mon Sep 17 00:00:00 2001
From: Javier Castro <jacastro@chromium.org>
Date: Tue, 18 Aug 2026 09:04:14 -0700
Subject: [PATCH] Require cryptographic scheme for DSE fast-path in SiteFamiliarityFetcher

TemplateURLRef::ExtractSearchTermsFromURL only compares host, port and
path, but does not compare scheme. Restrict the fast-path to
cryptographic schemes so an on-path attacker serving
http://<dse-host>/<dse-path> cannot inherit the DSE's "familiar" verdict
and obtain a renderer with the V8 optimizing tiers enabled.

Fixed: 513781838
TAG=agy
CONV=22e0f5f6-8a43-49d2-9165-df7d153ab58d

Change-Id: I1ed81e3dd3ae49945dae2becc0f373533ee1bac8
Bug: 513781838
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8263180
Reviewed-by: Tiffany Song <tiffanysong@google.com>
Commit-Queue: Javier Castro <jacastro@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1681438}
---
diff --git a/chrome/browser/site_protection/site_familiarity_fetcher.cc b/chrome/browser/site_protection/site_familiarity_fetcher.cc
index 214eb28b..bc04c7e 100644
--- a/chrome/browser/site_protection/site_familiarity_fetcher.cc
+++ b/chrome/browser/site_protection/site_familiarity_fetcher.cc
@@ -114,6 +114,12 @@
 
   if (base::FeatureList::IsEnabled(
           kSkipSiteFamiliarityDeferralForDefaultSearchEngine) &&
+      // TemplateURLRef::ExtractSearchTermsFromURL only compares host, port and
+      // path; it never compares scheme. Restrict the fast-path to cryptographic
+      // schemes so an on-path attacker serving http://<dse-host>/<dse-path>
+      // cannot inherit the DSE's "familiar" verdict and obtain a renderer with
+      // the V8 optimizing tiers enabled.
+      fetch_url_.SchemeIsCryptographic() &&
       IsDefaultSearchEngineUrl(fetch_url_, profile_)) {
     // Assume the default search engine search results are familiar to the user.
     CRSBLOG << "SiteFamiliarityFetcher::Start [URL]: " << fetch_url_
diff --git a/chrome/browser/site_protection/site_familiarity_process_selection_deferring_condition_unittest.cc b/chrome/browser/site_protection/site_familiarity_process_selection_deferring_condition_unittest.cc
index f02f0a3..fd5aae3 100644
--- a/chrome/browser/site_protection/site_familiarity_process_selection_deferring_condition_unittest.cc
+++ b/chrome/browser/site_protection/site_familiarity_process_selection_deferring_condition_unittest.cc
@@ -1036,6 +1036,31 @@
   CheckSiteFamiliar(navigation_handle);
 }
 
+// Test that an insecure HTTP navigation matching the DSE search URL is deferred
+// and is unfamiliar, rather than taking the DSE fast-path.
+TEST_F(SiteFamiliarityDefaultSearchEngineSkipFamiliarityCheckTest,
+       InsecureHttpSearchUrl) {
+  GURL kHttpSearchUrl("http://www.example.com/search?q=test2");
+  SetSiteEngagementScore(kHttpSearchUrl,
+                         kMinSiteEngagementScoreForFamiliarity - 1);
+  content::MockNavigationHandle navigation_handle(kHttpSearchUrl, main_rfh());
+  base::HistogramTester histogram_tester;
+  MockConditionCallback callback;
+  SiteFamiliarityProcessSelectionDeferringCondition condition(
+      navigation_handle);
+
+  EXPECT_EQ(content::ProcessSelectionDeferringCondition::Result::kDefer,
+            condition.OnWillSelectFinalProcess(callback.Get()));
+
+  // Complete history fetch.
+  raw_ptr<ManualCallbackEmptyHistoryService> mock_history_service =
+      static_cast<ManualCallbackEmptyHistoryService*>(history_service());
+  mock_history_service->RunNextCallback();
+  CheckSiteUnfamiliar(navigation_handle);
+  histogram_tester.ExpectTotalCount(
+      kSiteFamiliarityDeferNavigationDurationHistogram, 1);
+}
+
 // Test that a navigation to a non-search page on the DSE's origin is deferred
 // and is unfamiliar.
 TEST_F(SiteFamiliarityDefaultSearchEngineSkipFamiliarityCheckTest,
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/chrome/browser/site_protection/site_familiarity_process_selection_deferring_condition_unittest.cc b/chrome/browser/site_protection/site_familiarity_process_selection_deferring_condition_unittest.cc
index f02f0a3..fd5aae3 100644
--- a/chrome/browser/site_protection/site_familiarity_process_selection_deferring_condition_unittest.cc
+++ b/chrome/browser/site_protection/site_familiarity_process_selection_deferring_condition_unittest.cc
@@ -1036,6 +1036,31 @@
   CheckSiteFamiliar(navigation_handle);
 }
 
+// Test that an insecure HTTP navigation matching the DSE search URL is deferred
+// and is unfamiliar, rather than taking the DSE fast-path.
+TEST_F(SiteFamiliarityDefaultSearchEngineSkipFamiliarityCheckTest,
+       InsecureHttpSearchUrl) {
+  GURL kHttpSearchUrl("http://www.example.com/search?q=test2");
+  SetSiteEngagementScore(kHttpSearchUrl,
+                         kMinSiteEngagementScoreForFamiliarity - 1);
+  content::MockNavigationHandle navigation_handle(kHttpSearchUrl, main_rfh());
+  base::HistogramTester histogram_tester;
+  MockConditionCallback callback;
+  SiteFamiliarityProcessSelectionDeferringCondition condition(
+      navigation_handle);
+
+  EXPECT_EQ(content::ProcessSelectionDeferringCondition::Result::kDefer,
+            condition.OnWillSelectFinalProcess(callback.Get()));
+
+  // Complete history fetch.
+  raw_ptr<ManualCallbackEmptyHistoryService> mock_history_service =
+      static_cast<ManualCallbackEmptyHistoryService*>(history_service());
+  mock_history_service->RunNextCallback();
+  CheckSiteUnfamiliar(navigation_handle);
+  histogram_tester.ExpectTotalCount(
+      kSiteFamiliarityDeferNavigationDurationHistogram, 1);
+}
+
 // Test that a navigation to a non-search page on the DSE's origin is deferred
 // and is unfamiliar.
 TEST_F(SiteFamiliarityDefaultSearchEngineSkipFamiliarityCheckTest,
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
On This Page