Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: A URL extraction desync exists between LaunchIntentDispatcher and CustomTabIntentDataProvider when launching Custom Tabs. When LaunchIntentDispatcher validates an incoming intent, scheme-gated extractors return a benign URL, but the intent’s data URI is subsequently rewritten while preserving unverified extras such as EXTRA_HANDOFF_URL. The resulting Custom Tab initializes without re-validating the intent, falling through to EXTRA_HANDOFF_URL and potentially allowing untrusted Android apps to navigate to privileged internal schemes like chrome://.

Affected files:

• chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDispatcher.java
• chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
• chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabIntentDataProvider.java
• chrome/android/java/src/org/chromium/chrome/browser/customtabs/content/CustomTabIntentHandler.java

Estimated timestamp from git blame: 2026-04-16

Summary

When launching a Custom Tab via LaunchIntentDispatcher, security validation via IntentHandler.shouldIgnoreIntent() is performed on the original incoming Intent. When createCustomTabActivityIntent() prepares the launch intent for CustomTabActivity, it rewrites the intent’s data URI to the extracted benign URL while copying all intent extras verbatim. Because URL extraction in IntentHandler.extractUrlFromIntent() relies on a prioritized chain where earlier extractors (getUrlForCustomTab and getUrlForWebapp) are gated on specific schemes (customtab:// or webapp://), rewriting the data scheme to https:// causes CustomTabIntentDataProvider to fall through to getUrlForHandoff() (EXTRA_HANDOFF_URL), which is ungated and unverified. CustomTabActivity initial tab creation does not re-run shouldIgnoreIntent(), leading to a potential security check bypass.

Affected Files

• chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDispatcher.java
• chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
• chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabIntentDataProvider.java
• chrome/android/java/src/org/chromium/chrome/browser/customtabs/content/CustomTabIntentHandler.java

Root Cause Analysis

1. Validation on Original Intent (LaunchIntentDispatcher.java:285-292): launchCustomTabActivity() validates the untrusted incoming intent:

   if (IntentHandler.shouldIgnoreIntent(mIntent, mActivity, isCustomTab)) {
       return false;
   }
   

   IntentHandler.extractUrlFromIntent(intent) (IntentHandler.java:1299-1310) evaluates getUrlForCustomTab(intent) before getUrlForHandoff(intent):

   private static @Nullable String extractUrlFromIntent(@Nullable Intent intent) {
       if (intent == null) return null;
       String url = getUrlFromVoiceSearchResult(intent);
       if (url == null) url = getUrlForCustomTab(intent);    // [Extractor 2]
       if (url == null) url = getUrlForWebapp(intent);       // [Extractor 3]
       if (url == null) url = getUrlFromShareIntent(intent); // [Extractor 4]
       if (url == null) url = getUrlForHandoff(intent);      // [Extractor 5]
       if (url == null) url = intent.getDataString();
       ...
   }
   

   For data = "customtab://x?https://benign.example", Extractor 2 (IntentHandler.java:1375-1381) matches the scheme and returns "https://benign.example". Because this URL is safe, IntentHandler.shouldIgnoreIntent() returns false.

2. Data Rewrite & Extra Propagation (LaunchIntentDispatcher.java:197-210): createCustomTabActivityIntent() creates a copy of the intent carrying over all extras (including EXTRA_HANDOFF_URL), but rewrites the data URI:

   String uriString = IntentHandler.getUrlFromIntent(intent); // "https://benign.example"
   Uri uri = Uri.parse(uriString);
   Intent newIntent = new Intent(intent);                     // Copies all extras
   if (ChromeFeatureList.isEnabled(ChromeFeatureList.CCT_DONT_OVERRIDE_INTENT_MIME_TYPE)) {
       newIntent.setDataAndType(uri, intent.getType());       // Data rewritten to https://...
   } else {
       newIntent.setAction(Intent.ACTION_VIEW);
       newIntent.setData(uri);
   }
   

3. Extractor Fallthrough in CustomTabActivity (CustomTabIntentDataProvider.java:1133-1148): When CustomTabActivity receives the launch intent, resolveUrlToLoad() calls IntentHandler.getUrlFromIntent():

   • Extractor 2 (getUrlForCustomTab) checks data.getScheme() == "customtab" $\rightarrow$ false.
   • Extractor 3 (getUrlForWebapp) checks data.getScheme() == "webapp" $\rightarrow$ false.
   • Extractor 4 (getUrlFromShareIntent) checks action == ACTION_SEND $\rightarrow$ false.
   • Extractor 5 (getUrlForHandoff, IntentHandler.java:1391-1394) checks EXTRA_HANDOFF_URL with no scheme check or sender verification $\rightarrow$ returns attacker-controlled URL (e.g. "chrome://flags").

4. Unvalidated Navigation (CustomTabIntentHandler.java:74-84 / DefaultCustomTabIntentHandlingStrategy.java:89-95): CustomTabIntentHandler.handleInitialIntent() executes without invoking IntentHandler.shouldIgnoreIntent(), navigating directly to the URL returned by getUrlToLoad() via tab.loadUrl().

Potential Reproduction Steps

(Note: These are suggested steps identified via static source code analysis; automated tooling does not execute code.)

1. From an installed Android application, construct an explicit Intent:

   Intent intent = new Intent(Intent.ACTION_VIEW);
   intent.setClassName("com.android.chrome", "com.google.android.apps.chrome.IntentDispatcher");
   intent.setData(Uri.parse("customtab://x?https://benign.example"));
   intent.putExtra("org.chromium.chrome.browser.handoff_url", "chrome://flags");
   Bundle bundle = new Bundle();
   bundle.putBinder("android.support.customtabs.extra.SESSION", null);
   intent.putExtras(bundle);
   

2. Call context.startActivity(intent).
3. ChromeLauncherActivity dispatches to LaunchIntentDispatcher.launchCustomTabActivity().
4. IntentHandler.shouldIgnoreIntent() verifies "https://benign.example" and allows the launch.
5. createCustomTabActivityIntent() rewrites the data URI to https://benign.example, preserving EXTRA_HANDOFF_URL.
6. CustomTabActivity extracts the URL to load, falling through to getUrlForHandoff(), which yields "chrome://flags".
7. CustomTabActivityNavigationController.navigate() loads "chrome://flags" into the Custom Tab.

Suggested Fix

1. Strip IntentHandler.EXTRA_HANDOFF_URL (and other unverified extras not intended for external consumption) in LaunchIntentDispatcher.launchCustomTabActivity() or createCustomTabActivityIntent() before launching CustomTabActivity.
2. Ensure getUrlForHandoff() validates that the sender is trustworthy (IntentHandler.wasIntentSenderChrome()) before extracting EXTRA_HANDOFF_URL.
3. Alternatively, re-verify the resolved URL in CustomTabIntentHandler.handleInitialIntent() or CustomTabIntentDataProvider using IntentHandler.shouldIgnoreIntent() or ExternalIntentUrlChecker.isUnsafeExternalIntentUrl().

Evaluated with Chrome root at commit: c6718ebbf2c677c6f63691e28c7801c563f6b19c

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

• If you are familiar with the severity guidelines, you may adjust the severity.
• If this is a false positive, and there’s no work to be done, please close as WAI.
• If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.