From 00eafffe8ab98da76dce72a48466990eaf1c6971 Mon Sep 17 00:00:00 2001
From: Takashi Toyoshima <toyoshim@chromium.org>
Date: Mon, 17 Aug 2026 22:08:35 -0700
Subject: [PATCH] OOR-CORS: Use opaque origin as preflight cache key for tainted requests

Previously, PreflightController used the raw request_initiator as the
cache key for both cache insertion and lookup without checking the
tainted origin flag. As a result, a preflight response allowed for
'Origin: null' after a cross-origin redirect was cached under the
request initiator's origin, which incorrectly allowed subsequent
untainted requests to skip preflight (and vice-versa).

This CL updates PreflightController to use an opaque origin
(url::Origin()) as the cache key when the request origin is tainted.
This isolates tainted preflight cache entries from untainted requests
and matches the behavior of WebKit and Gecko.

A killswitch feature (kCorsPreflightCacheKeyTaintedOrigin) is added
and enabled by default.

Bug: 543464436
Change-Id: I0cfa366c26a20d9abee172d6cd4e8b05402ff891
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8260150
Reviewed-by: Kenichi Ishibashi <bashi@chromium.org>
Commit-Queue: Takashi Toyoshima <toyoshim@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1681108}
---
diff --git a/services/network/cors/preflight_controller.cc b/services/network/cors/preflight_controller.cc
index c8fdb86..01a39ea 100644
--- a/services/network/cors/preflight_controller.cc
+++ b/services/network/cors/preflight_controller.cc
@@ -43,6 +43,7 @@
 #include "services/network/public/mojom/url_loader_network_service_observer.mojom.h"
 #include "services/network/public/mojom/url_response_head.mojom.h"
 #include "url/gurl.h"
+#include "url/origin.h"
 
 namespace network::cors {
 
@@ -478,9 +479,12 @@
 
     if (!(original_request_.load_flags & net::LOAD_DISABLE_CACHE) &&
         net_error == net::OK) {
-      controller_->AppendToCache(*original_request_.request_initiator,
-                                 original_request_.url, network_isolation_key_,
-                                 std::move(result));
+      if (!tainted_ || !base::FeatureList::IsEnabled(
+                           features::kCorsPreflightCacheKeyTaintedOrigin)) {
+        controller_->AppendToCache(*original_request_.request_initiator,
+                                   original_request_.url,
+                                   network_isolation_key_, std::move(result));
+      }
     }
 
     CHECK(!detected_error_status.has_value() || net_error != net::OK);
@@ -614,6 +618,8 @@
                 : net::NetworkIsolationKey();
 
   if (!RetrieveCacheFlags(request.load_flags) &&
+      (!tainted || !base::FeatureList::IsEnabled(
+                       features::kCorsPreflightCacheKeyTaintedOrigin)) &&
       cache_.CheckIfRequestCanSkipPreflight(
           request.request_initiator.value(), request.url, network_isolation_key,
           request.credentials_mode, request.method, request.headers,
diff --git a/services/network/public/cpp/features.cc b/services/network/public/cpp/features.cc
index 56689dab..c7231a0 100644
--- a/services/network/public/cpp/features.cc
+++ b/services/network/public/cpp/features.cc
@@ -193,6 +193,12 @@
 BASE_FEATURE(kCorsNonWildcardRequestHeadersSupport,
              base::FEATURE_DISABLED_BY_DEFAULT);
 
+// When enabled, CORS preflight cache keys take the tainted origin flag into
+// account (using an opaque / null origin), preventing tainted preflight
+// results from satisfying untainted requests.
+BASE_FEATURE(kCorsPreflightCacheKeyTaintedOrigin,
+             base::FEATURE_ENABLED_BY_DEFAULT);
+
 // Do not send TLS client certificates in CORS preflight. Omit all client certs
 // and continue the handshake without sending one if requested.
 BASE_FEATURE(kOmitCorsClientCert, base::FEATURE_DISABLED_BY_DEFAULT);
diff --git a/services/network/public/cpp/features.h b/services/network/public/cpp/features.h
index c376342..57643afb 100644
--- a/services/network/public/cpp/features.h
+++ b/services/network/public/cpp/features.h
@@ -78,6 +78,9 @@
 BASE_DECLARE_FEATURE(kCorsNonWildcardRequestHeadersSupport);
 
 COMPONENT_EXPORT(NETWORK_CPP_FLAGS_AND_SWITCHES)
+BASE_DECLARE_FEATURE(kCorsPreflightCacheKeyTaintedOrigin);
+
+COMPONENT_EXPORT(NETWORK_CPP_FLAGS_AND_SWITCHES)
 BASE_DECLARE_FEATURE(kOmitCorsClientCert);
 
 COMPONENT_EXPORT(NETWORK_CPP_FLAGS_AND_SWITCHES)
diff --git a/services/network/cors/cors_url_loader_unittest.cc b/services/network/cors/cors_url_loader_unittest.cc
index 512a86f..4a571f8 100644
--- a/services/network/cors/cors_url_loader_unittest.cc
+++ b/services/network/cors/cors_url_loader_unittest.cc
@@ -94,6 +94,25 @@
                          CorsURLLoaderTestWithSafeRevalidation,
                          testing::Bool());
 
+class CorsURLLoaderTestWithTaintedOriginCacheKey
+    : public CorsURLLoaderTestBase,
+      public testing::WithParamInterface<bool> {
+ public:
+  CorsURLLoaderTestWithTaintedOriginCacheKey() {
+    feature_list_.InitWithFeatureState(
+        features::kCorsPreflightCacheKeyTaintedOrigin, GetParam());
+  }
+
+  bool IsTaintedOriginCacheKeyEnabled() const { return GetParam(); }
+
+ private:
+  base::test::ScopedFeatureList feature_list_;
+};
+
+INSTANTIATE_TEST_SUITE_P(All,
+                         CorsURLLoaderTestWithTaintedOriginCacheKey,
+                         testing::Bool());
+
 class BadMessageTestHelper {
  public:
   BadMessageTestHelper()
@@ -2371,7 +2390,8 @@
   EXPECT_TRUE(GetRequest().headers.HasHeader(net::HttpRequestHeaders::kOrigin));
 }
 
-TEST_F(CorsURLLoaderTest, RestrictedPrefetchRedirectUpdatesIsolationInfo) {
+TEST_P(CorsURLLoaderTestWithTaintedOriginCacheKey,
+       RestrictedPrefetchRedirectUpdatesIsolationInfo) {
   url::Origin initiator = url::Origin::Create(GURL("https://example.com"));
   const GURL url("https://other.example.com/foo.png");
   const GURL new_url("https://other.example.org/bar.png");
@@ -2448,18 +2468,43 @@
 
   RunUntilCreateLoaderAndStartCalled();
 
-  // Verify that the preflight cache now contains the entry for
-  // other.example.org under expected_nik and NOT under the stale NIK!
-  EXPECT_TRUE(
-      network_context()
-          ->cors_preflight_controller()
-          ->GetPreflightCacheForTesting()
-          .DoesEntryExistForTesting(initiator, new_url.spec(), expected_nik));
-  EXPECT_FALSE(
-      network_context()
-          ->cors_preflight_controller()
-          ->GetPreflightCacheForTesting()
-          .DoesEntryExistForTesting(initiator, new_url.spec(), stale_nik));
+  if (IsTaintedOriginCacheKeyEnabled()) {
+    // When kCorsPreflightCacheKeyTaintedOrigin is enabled, tainted preflights
+    // are not cached, so no entry is added for new_url.
+    EXPECT_FALSE(
+        network_context()
+            ->cors_preflight_controller()
+            ->GetPreflightCacheForTesting()
+            .DoesEntryExistForTesting(initiator, new_url.spec(), expected_nik));
+    EXPECT_FALSE(
+        network_context()
+            ->cors_preflight_controller()
+            ->GetPreflightCacheForTesting()
+            .DoesEntryExistForTesting(initiator, new_url.spec(), stale_nik));
+    EXPECT_EQ(1u, network_context()
+                      ->cors_preflight_controller()
+                      ->GetPreflightCacheForTesting()
+                      .CountEntriesForTesting());
+  } else {
+    // When kCorsPreflightCacheKeyTaintedOrigin is disabled, the tainted
+    // preflight is keyed under `initiator`. Verify that the preflight cache
+    // contains the entry for other.example.org under expected_nik and NOT under
+    // the stale NIK.
+    EXPECT_TRUE(
+        network_context()
+            ->cors_preflight_controller()
+            ->GetPreflightCacheForTesting()
+            .DoesEntryExistForTesting(initiator, new_url.spec(), expected_nik));
+    EXPECT_FALSE(
+        network_context()
+            ->cors_preflight_controller()
+            ->GetPreflightCacheForTesting()
+            .DoesEntryExistForTesting(initiator, new_url.spec(), stale_nik));
+    EXPECT_EQ(2u, network_context()
+                      ->cors_preflight_controller()
+                      ->GetPreflightCacheForTesting()
+                      .CountEntriesForTesting());
+  }
 
   // The actual redirected request (GET) to `new_url`
   EXPECT_EQ(4, num_created_loaders());
diff --git a/services/network/cors/preflight_controller_unittest.cc b/services/network/cors/preflight_controller_unittest.cc
index ef04fb78..8001fcf 100644
--- a/services/network/cors/preflight_controller_unittest.cc
+++ b/services/network/cors/preflight_controller_unittest.cc
@@ -753,6 +753,105 @@
   EXPECT_EQ(1u, access_count());
 }
 
+TEST_F(PreflightControllerTest,
+       TaintedPreflightDoesNotSatisfyUntaintedRequest) {
+  ResourceRequest request;
+  request.mode = mojom::RequestMode::kCors;
+  request.credentials_mode = mojom::CredentialsMode::kOmit;
+  request.url = GetURL("/tainted");
+  request.request_initiator = test_initiator_origin();
+
+  // Tainted preflight check succeeds because the test server returns
+  // Access-Control-Allow-Origin: null for "/tainted".
+  PerformPreflightCheck(request, /*tainted=*/true);
+  EXPECT_EQ(net::OK, net_error());
+  ASSERT_FALSE(status());
+  EXPECT_EQ(1u, access_count());
+
+  // Untainted preflight check must not hit the cache from the tainted request.
+  // A new preflight is sent, and fails because the server returns "null" which
+  // does not match test_initiator_origin().
+  PerformPreflightCheck(request, /*tainted=*/false);
+  EXPECT_EQ(net::ERR_FAILED, net_error());
+  ASSERT_TRUE(status());
+  EXPECT_EQ(mojom::CorsError::kPreflightAllowOriginMismatch,
+            status()->cors_error);
+  EXPECT_EQ(2u, access_count());
+}
+
+TEST_F(PreflightControllerTest,
+       TaintedPreflightDoesNotSatisfyUntaintedRequest_FeatureDisabled) {
+  base::test::ScopedFeatureList scoped_feature_list;
+  scoped_feature_list.InitAndDisableFeature(
+      features::kCorsPreflightCacheKeyTaintedOrigin);
+
+  ResourceRequest request;
+  request.mode = mojom::RequestMode::kCors;
+  request.credentials_mode = mojom::CredentialsMode::kOmit;
+  request.url = GetURL("/tainted");
+  request.request_initiator = test_initiator_origin();
+
+  // Tainted preflight check succeeds.
+  PerformPreflightCheck(request, /*tainted=*/true);
+  EXPECT_EQ(net::OK, net_error());
+  ASSERT_FALSE(status());
+  EXPECT_EQ(1u, access_count());
+
+  // With the feature disabled, the tainted preflight is incorrectly cached
+  // under request_initiator, allowing the untainted request to skip preflight.
+  PerformPreflightCheck(request, /*tainted=*/false);
+  EXPECT_EQ(net::OK, net_error());
+  ASSERT_FALSE(status());
+  EXPECT_EQ(1u, access_count());
+}
+
+TEST_F(PreflightControllerTest,
+       UntaintedPreflightDoesNotSatisfyTaintedRequest) {
+  ResourceRequest request;
+  request.mode = mojom::RequestMode::kCors;
+  request.credentials_mode = mojom::CredentialsMode::kOmit;
+  request.url = GetURL("/allow");
+  request.request_initiator = test_initiator_origin();
+
+  // Untainted preflight check succeeds (Access-Control-Allow-Origin:
+  // test_initiator_origin()).
+  PerformPreflightCheck(request, /*tainted=*/false);
+  EXPECT_EQ(net::OK, net_error());
+  ASSERT_FALSE(status());
+  EXPECT_EQ(1u, access_count());
+
+  // Tainted preflight check must not hit the cache from the untainted
+  // request. A new preflight is sent with Origin: null, and fails because the
+  // server returns Access-Control-Allow-Origin: test_initiator_origin().
+  PerformPreflightCheck(request, /*tainted=*/true);
+  EXPECT_EQ(net::ERR_FAILED, net_error());
+  ASSERT_TRUE(status());
+  EXPECT_EQ(mojom::CorsError::kPreflightAllowOriginMismatch,
+            status()->cors_error);
+  EXPECT_EQ(2u, access_count());
+}
+
+TEST_F(PreflightControllerTest, TaintedPreflightsAreNotCached) {
+  ResourceRequest request;
+  request.mode = mojom::RequestMode::kCors;
+  request.credentials_mode = mojom::CredentialsMode::kOmit;
+  request.url = GetURL("/tainted");
+  request.request_initiator = test_initiator_origin();
+
+  // First tainted preflight check.
+  PerformPreflightCheck(request, /*tainted=*/true);
+  EXPECT_EQ(net::OK, net_error());
+  ASSERT_FALSE(status());
+  EXPECT_EQ(1u, access_count());
+
+  // Second tainted preflight check: tainted results are not cached, so a new
+  // preflight request is performed.
+  PerformPreflightCheck(request, /*tainted=*/true);
+  EXPECT_EQ(net::OK, net_error());
+  ASSERT_FALSE(status());
+  EXPECT_EQ(2u, access_count());
+}
+
 TEST_F(PreflightControllerTest, CheckResponseWithNullHeaders) {
   GURL url = GURL("https://google.com/finullurl");
   const mojom::URLResponseHead response_head;
diff --git a/third_party/blink/web_tests/external/wpt/fetch/api/cors/cors-preflight-cache-tainted.any.js b/third_party/blink/web_tests/external/wpt/fetch/api/cors/cors-preflight-cache-tainted.any.js
new file mode 100644
index 0000000..7f1f5cf
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/fetch/api/cors/cors-preflight-cache-tainted.any.js
@@ -0,0 +1,107 @@
+// META: script=/common/get-host-info.sub.js
+// META: script=/common/utils.js
+// META: script=../resources/utils.js
+
+const host_info = get_host_info();
+const redir_url = host_info.HTTP_REMOTE_ORIGIN + dirname(location.pathname) +
+    RESOURCES_DIR + 'redirect.py';
+const cors_url = host_info.HTTP_ORIGIN_WITH_DIFFERENT_PORT +
+    dirname(location.pathname) + RESOURCES_DIR + 'preflight.py';
+
+promise_test((test) => {
+  const uuid_token = token();
+  const target_url = cors_url + '?token=' + uuid_token +
+      '&max_age=12000&allow_methods=POST' +
+      '&allow_headers=x-test-header';
+  const redirect_url = redir_url +
+      '?allow_headers=x-test-header&location=' + encodeURIComponent(target_url);
+
+  // Cross-origin redirect to target: preflight is sent with tainted origin
+  // (Origin: null).
+  return fetch(cors_url + '?token=' + uuid_token + '&clear-stash')
+      .then(() => {
+        return fetch(new Request(redirect_url, {
+          mode: 'cors',
+          method: 'POST',
+          headers: [['x-test-header', 'test1']]
+        }));
+      })
+      .then((resp) => {
+        assert_equals(resp.status, 200, 'Response status is 200');
+        assert_equals(resp.headers.get('x-did-preflight'), '1',
+                      'Tainted request performed preflight');
+        return fetch(cors_url + '?token=' + uuid_token + '&clear-stash');
+      })
+      .then((res) => res.text())
+      .then((txt) => {
+        assert_equals(txt, '1',
+                      'Preflight stash was recorded for tainted request');
+        // Direct (untainted) request to target: must NOT reuse tainted
+        // preflight cache.
+        return fetch(new Request(target_url, {
+          mode: 'cors',
+          method: 'POST',
+          headers: [['x-test-header', 'test2']]
+        }));
+      })
+      .then((resp) => {
+        assert_equals(resp.status, 200, 'Response status is 200');
+        assert_equals(resp.headers.get('x-did-preflight'), '1',
+                      'Untainted request performed new preflight');
+        return fetch(cors_url + '?token=' + uuid_token + '&clear-stash');
+      })
+      .then((res) => res.text())
+      .then((txt) => {
+        assert_equals(txt, '1',
+                      'Preflight stash was recorded for untainted request');
+      });
+}, 'Tainted CORS preflight cache entry is not reused for untainted requests');
+
+promise_test((test) => {
+  const uuid_token = token();
+  const target_url = cors_url + '?token=' + uuid_token +
+      '&max_age=12000&allow_methods=POST' +
+      '&allow_headers=x-test-header';
+  const redirect_url = redir_url +
+      '?allow_headers=x-test-header&location=' + encodeURIComponent(target_url);
+
+  // Direct (untainted) request to target: preflight is sent with untainted
+  // origin.
+  return fetch(cors_url + '?token=' + uuid_token + '&clear-stash')
+      .then(() => {
+        return fetch(new Request(target_url, {
+          mode: 'cors',
+          method: 'POST',
+          headers: [['x-test-header', 'test1']]
+        }));
+      })
+      .then((resp) => {
+        assert_equals(resp.status, 200, 'Response status is 200');
+        assert_equals(resp.headers.get('x-did-preflight'), '1',
+                      'Untainted request performed preflight');
+        return fetch(cors_url + '?token=' + uuid_token + '&clear-stash');
+      })
+      .then((res) => res.text())
+      .then((txt) => {
+        assert_equals(txt, '1',
+                      'Preflight stash was recorded for untainted request');
+        // Cross-origin redirected (tainted) request to target: must NOT
+        // reuse untainted preflight cache.
+        return fetch(new Request(redirect_url, {
+          mode: 'cors',
+          method: 'POST',
+          headers: [['x-test-header', 'test2']]
... (file diff truncated)

diff --git a/services/network/cors/cors_url_loader_unittest.cc b/services/network/cors/cors_url_loader_unittest.cc
index 512a86f..4a571f8 100644
--- a/services/network/cors/cors_url_loader_unittest.cc
+++ b/services/network/cors/cors_url_loader_unittest.cc
@@ -94,6 +94,25 @@
                          CorsURLLoaderTestWithSafeRevalidation,
                          testing::Bool());
 
+class CorsURLLoaderTestWithTaintedOriginCacheKey
+    : public CorsURLLoaderTestBase,
+      public testing::WithParamInterface<bool> {
+ public:
+  CorsURLLoaderTestWithTaintedOriginCacheKey() {
+    feature_list_.InitWithFeatureState(
+        features::kCorsPreflightCacheKeyTaintedOrigin, GetParam());
+  }
+
+  bool IsTaintedOriginCacheKeyEnabled() const { return GetParam(); }
+
+ private:
+  base::test::ScopedFeatureList feature_list_;
+};
+
+INSTANTIATE_TEST_SUITE_P(All,
+                         CorsURLLoaderTestWithTaintedOriginCacheKey,
+                         testing::Bool());
+
 class BadMessageTestHelper {
  public:
   BadMessageTestHelper()
@@ -2371,7 +2390,8 @@
   EXPECT_TRUE(GetRequest().headers.HasHeader(net::HttpRequestHeaders::kOrigin));
 }
 
-TEST_F(CorsURLLoaderTest, RestrictedPrefetchRedirectUpdatesIsolationInfo) {
+TEST_P(CorsURLLoaderTestWithTaintedOriginCacheKey,
+       RestrictedPrefetchRedirectUpdatesIsolationInfo) {
   url::Origin initiator = url::Origin::Create(GURL("https://example.com"));
   const GURL url("https://other.example.com/foo.png");
   const GURL new_url("https://other.example.org/bar.png");
@@ -2448,18 +2468,43 @@
 
   RunUntilCreateLoaderAndStartCalled();
 
-  // Verify that the preflight cache now contains the entry for
-  // other.example.org under expected_nik and NOT under the stale NIK!
-  EXPECT_TRUE(
-      network_context()
-          ->cors_preflight_controller()
-          ->GetPreflightCacheForTesting()
-          .DoesEntryExistForTesting(initiator, new_url.spec(), expected_nik));
-  EXPECT_FALSE(
-      network_context()
-          ->cors_preflight_controller()
-          ->GetPreflightCacheForTesting()
-          .DoesEntryExistForTesting(initiator, new_url.spec(), stale_nik));
+  if (IsTaintedOriginCacheKeyEnabled()) {
+    // When kCorsPreflightCacheKeyTaintedOrigin is enabled, tainted preflights
+    // are not cached, so no entry is added for new_url.
+    EXPECT_FALSE(
+        network_context()
+            ->cors_preflight_controller()
+            ->GetPreflightCacheForTesting()
+            .DoesEntryExistForTesting(initiator, new_url.spec(), expected_nik));
+    EXPECT_FALSE(
+        network_context()
+            ->cors_preflight_controller()
+            ->GetPreflightCacheForTesting()
+            .DoesEntryExistForTesting(initiator, new_url.spec(), stale_nik));
+    EXPECT_EQ(1u, network_context()
+                      ->cors_preflight_controller()
+                      ->GetPreflightCacheForTesting()
+                      .CountEntriesForTesting());
+  } else {
+    // When kCorsPreflightCacheKeyTaintedOrigin is disabled, the tainted
+    // preflight is keyed under `initiator`. Verify that the preflight cache
+    // contains the entry for other.example.org under expected_nik and NOT under
+    // the stale NIK.
+    EXPECT_TRUE(
+        network_context()
+            ->cors_preflight_controller()
+            ->GetPreflightCacheForTesting()
+            .DoesEntryExistForTesting(initiator, new_url.spec(), expected_nik));
+    EXPECT_FALSE(
+        network_context()
+            ->cors_preflight_controller()
+            ->GetPreflightCacheForTesting()
+            .DoesEntryExistForTesting(initiator, new_url.spec(), stale_nik));
+    EXPECT_EQ(2u, network_context()
+                      ->cors_preflight_controller()
+                      ->GetPreflightCacheForTesting()
+                      .CountEntriesForTesting());
+  }
 
   // The actual redirected request (GET) to `new_url`
   EXPECT_EQ(4, num_created_loaders());
diff --git a/services/network/cors/preflight_controller_unittest.cc b/services/network/cors/preflight_controller_unittest.cc
index ef04fb78..8001fcf 100644
--- a/services/network/cors/preflight_controller_unittest.cc
+++ b/services/network/cors/preflight_controller_unittest.cc
@@ -753,6 +753,105 @@
   EXPECT_EQ(1u, access_count());
 }
 
+TEST_F(PreflightControllerTest,
+       TaintedPreflightDoesNotSatisfyUntaintedRequest) {
+  ResourceRequest request;
+  request.mode = mojom::RequestMode::kCors;
+  request.credentials_mode = mojom::CredentialsMode::kOmit;
+  request.url = GetURL("/tainted");
+  request.request_initiator = test_initiator_origin();
+
+  // Tainted preflight check succeeds because the test server returns
+  // Access-Control-Allow-Origin: null for "/tainted".
+  PerformPreflightCheck(request, /*tainted=*/true);
+  EXPECT_EQ(net::OK, net_error());
+  ASSERT_FALSE(status());
+  EXPECT_EQ(1u, access_count());
+
+  // Untainted preflight check must not hit the cache from the tainted request.
+  // A new preflight is sent, and fails because the server returns "null" which
+  // does not match test_initiator_origin().
+  PerformPreflightCheck(request, /*tainted=*/false);
+  EXPECT_EQ(net::ERR_FAILED, net_error());
+  ASSERT_TRUE(status());
+  EXPECT_EQ(mojom::CorsError::kPreflightAllowOriginMismatch,
+            status()->cors_error);
+  EXPECT_EQ(2u, access_count());
+}
+
+TEST_F(PreflightControllerTest,
+       TaintedPreflightDoesNotSatisfyUntaintedRequest_FeatureDisabled) {
+  base::test::ScopedFeatureList scoped_feature_list;
+  scoped_feature_list.InitAndDisableFeature(
+      features::kCorsPreflightCacheKeyTaintedOrigin);
+
+  ResourceRequest request;
+  request.mode = mojom::RequestMode::kCors;
+  request.credentials_mode = mojom::CredentialsMode::kOmit;
+  request.url = GetURL("/tainted");
+  request.request_initiator = test_initiator_origin();
+
+  // Tainted preflight check succeeds.
+  PerformPreflightCheck(request, /*tainted=*/true);
+  EXPECT_EQ(net::OK, net_error());
+  ASSERT_FALSE(status());
+  EXPECT_EQ(1u, access_count());
+
+  // With the feature disabled, the tainted preflight is incorrectly cached
+  // under request_initiator, allowing the untainted request to skip preflight.
+  PerformPreflightCheck(request, /*tainted=*/false);
+  EXPECT_EQ(net::OK, net_error());
+  ASSERT_FALSE(status());
+  EXPECT_EQ(1u, access_count());
+}
+
+TEST_F(PreflightControllerTest,
+       UntaintedPreflightDoesNotSatisfyTaintedRequest) {
+  ResourceRequest request;
+  request.mode = mojom::RequestMode::kCors;
+  request.credentials_mode = mojom::CredentialsMode::kOmit;
+  request.url = GetURL("/allow");
+  request.request_initiator = test_initiator_origin();
+
+  // Untainted preflight check succeeds (Access-Control-Allow-Origin:
+  // test_initiator_origin()).
+  PerformPreflightCheck(request, /*tainted=*/false);
+  EXPECT_EQ(net::OK, net_error());
+  ASSERT_FALSE(status());
+  EXPECT_EQ(1u, access_count());
+
+  // Tainted preflight check must not hit the cache from the untainted
+  // request. A new preflight is sent with Origin: null, and fails because the
+  // server returns Access-Control-Allow-Origin: test_initiator_origin().
+  PerformPreflightCheck(request, /*tainted=*/true);
+  EXPECT_EQ(net::ERR_FAILED, net_error());
+  ASSERT_TRUE(status());
+  EXPECT_EQ(mojom::CorsError::kPreflightAllowOriginMismatch,
+            status()->cors_error);
+  EXPECT_EQ(2u, access_count());
+}
+
+TEST_F(PreflightControllerTest, TaintedPreflightsAreNotCached) {
+  ResourceRequest request;
+  request.mode = mojom::RequestMode::kCors;
+  request.credentials_mode = mojom::CredentialsMode::kOmit;
+  request.url = GetURL("/tainted");
+  request.request_initiator = test_initiator_origin();
+
+  // First tainted preflight check.
+  PerformPreflightCheck(request, /*tainted=*/true);
+  EXPECT_EQ(net::OK, net_error());
+  ASSERT_FALSE(status());
+  EXPECT_EQ(1u, access_count());
+
+  // Second tainted preflight check: tainted results are not cached, so a new
+  // preflight request is performed.
+  PerformPreflightCheck(request, /*tainted=*/true);
+  EXPECT_EQ(net::OK, net_error());
+  ASSERT_FALSE(status());
+  EXPECT_EQ(2u, access_count());
+}
+
 TEST_F(PreflightControllerTest, CheckResponseWithNullHeaders) {
   GURL url = GURL("https://google.com/finullurl");
   const mojom::URLResponseHead response_head;
diff --git a/third_party/blink/web_tests/external/wpt/fetch/api/cors/cors-preflight-cache-tainted.any.js b/third_party/blink/web_tests/external/wpt/fetch/api/cors/cors-preflight-cache-tainted.any.js
new file mode 100644
index 0000000..7f1f5cf
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/fetch/api/cors/cors-preflight-cache-tainted.any.js
@@ -0,0 +1,107 @@
+// META: script=/common/get-host-info.sub.js
+// META: script=/common/utils.js
+// META: script=../resources/utils.js
+
+const host_info = get_host_info();
+const redir_url = host_info.HTTP_REMOTE_ORIGIN + dirname(location.pathname) +
+    RESOURCES_DIR + 'redirect.py';
+const cors_url = host_info.HTTP_ORIGIN_WITH_DIFFERENT_PORT +
+    dirname(location.pathname) + RESOURCES_DIR + 'preflight.py';
+
+promise_test((test) => {
+  const uuid_token = token();
+  const target_url = cors_url + '?token=' + uuid_token +
+      '&max_age=12000&allow_methods=POST' +
+      '&allow_headers=x-test-header';
+  const redirect_url = redir_url +
+      '?allow_headers=x-test-header&location=' + encodeURIComponent(target_url);
+
+  // Cross-origin redirect to target: preflight is sent with tainted origin
+  // (Origin: null).
+  return fetch(cors_url + '?token=' + uuid_token + '&clear-stash')
+      .then(() => {
+        return fetch(new Request(redirect_url, {
+          mode: 'cors',
+          method: 'POST',
+          headers: [['x-test-header', 'test1']]
+        }));
+      })
+      .then((resp) => {
+        assert_equals(resp.status, 200, 'Response status is 200');
+        assert_equals(resp.headers.get('x-did-preflight'), '1',
+                      'Tainted request performed preflight');
+        return fetch(cors_url + '?token=' + uuid_token + '&clear-stash');
+      })
+      .then((res) => res.text())
+      .then((txt) => {
+        assert_equals(txt, '1',
+                      'Preflight stash was recorded for tainted request');
+        // Direct (untainted) request to target: must NOT reuse tainted
+        // preflight cache.
+        return fetch(new Request(target_url, {
+          mode: 'cors',
+          method: 'POST',
+          headers: [['x-test-header', 'test2']]
+        }));
+      })
+      .then((resp) => {
+        assert_equals(resp.status, 200, 'Response status is 200');
+        assert_equals(resp.headers.get('x-did-preflight'), '1',
+                      'Untainted request performed new preflight');
+        return fetch(cors_url + '?token=' + uuid_token + '&clear-stash');
+      })
+      .then((res) => res.text())
+      .then((txt) => {
+        assert_equals(txt, '1',
+                      'Preflight stash was recorded for untainted request');
+      });
+}, 'Tainted CORS preflight cache entry is not reused for untainted requests');
+
+promise_test((test) => {
+  const uuid_token = token();
+  const target_url = cors_url + '?token=' + uuid_token +
+      '&max_age=12000&allow_methods=POST' +
+      '&allow_headers=x-test-header';
+  const redirect_url = redir_url +
+      '?allow_headers=x-test-header&location=' + encodeURIComponent(target_url);
+
+  // Direct (untainted) request to target: preflight is sent with untainted
+  // origin.
+  return fetch(cors_url + '?token=' + uuid_token + '&clear-stash')
+      .then(() => {
+        return fetch(new Request(target_url, {
+          mode: 'cors',
+          method: 'POST',
+          headers: [['x-test-header', 'test1']]
+        }));
+      })
+      .then((resp) => {
+        assert_equals(resp.status, 200, 'Response status is 200');
+        assert_equals(resp.headers.get('x-did-preflight'), '1',
+                      'Untainted request performed preflight');
+        return fetch(cors_url + '?token=' + uuid_token + '&clear-stash');
+      })
+      .then((res) => res.text())
+      .then((txt) => {
+        assert_equals(txt, '1',
+                      'Preflight stash was recorded for untainted request');
+        // Cross-origin redirected (tainted) request to target: must NOT
... (truncated)