Medium chrome Logic Error 📄 Reporter bug report 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInsufficient policy enforcement in Network
DescriptionInsufficient policy enforcement in Network
ComponentNetwork
Bug ClassLogic Error
Tracker465466773
Fix commit0f08f8e435a8 (chromium/src) +14/-6
CISA KEVNot listed
CreditedGoogle
Disclosed2026-01-13

Files Changed

  • services/network/cors/cors_url_loader.cc
From 0f08f8e435a81e6d3e8442715a195d5efbe00ac5 Mon Sep 17 00:00:00 2001
From: Kenichi Ishibashi <[email protected]>
Date: Wed, 03 Dec 2025 23:52:59 -0800
Subject: [PATCH] Use HttpRequestHeaders::NetLogParams() for CORS preflight request netlog

To have the same eliding as other request headers logging.

Bug: 465466773
Change-Id: I1476d57902c3430c8698b68af849c8d52b1fb8ab
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7226493
Reviewed-by: mmenke <[email protected]>
Commit-Queue: Kenichi Ishibashi <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1553835}
---

diff --git a/services/network/cors/cors_url_loader.cc b/services/network/cors/cors_url_loader.cc
index 119edf0..6bc7eff 100644
--- a/services/network/cors/cors_url_loader.cc
+++ b/services/network/cors/cors_url_loader.cc
@@ -23,7 +23,9 @@
 #include "net/cookies/cookie_partition_key.h"
 #include "net/cookies/cookie_setting_override.h"
 #include "net/cookies/cookie_util.h"
+#include "net/http/http_log_util.h"
 #include "net/http/http_status_code.h"
+#include "net/http/http_util.h"
 #include "net/log/net_log_util.h"
 #include "net/log/net_log_values.h"
 #include "net/shared_dictionary/shared_dictionary.h"
@@ -113,12 +115,18 @@
       break;
   }
 
-  return base::Value::Dict()
-      .Set("url", SanitizeUrlForNetLog(request.url, capture_mode))
-      .Set("method", request.method)
-      .Set("headers", net::NetLogStringValue(request.headers.ToString()))
-      .Set("is_revalidating", request.is_revalidating)
-      .Set("cors_preflight_policy", cors_preflight_policy);
+  auto params = base::Value::Dict()
+                    .Set("url", SanitizeUrlForNetLog(request.url, capture_mode))
+                    .Set("is_revalidating", request.is_revalidating)
+                    .Set("cors_preflight_policy", cors_preflight_policy);
+
+  if (request.url.is_valid()) {
+    std::string request_line = net::HttpUtil::GenerateRequestLine(
+        request.method, request.url, /*is_for_get_to_http_proxy=*/false);
+    params.Set("request_headers",
+               request.headers.NetLogParams(request_line, capture_mode));
+  }
+  return params;
 }
 
 base::Value::Dict NetLogPreflightRequiredParams(
Loading diff…

Original Bug Report

reported by [email protected]

NetLog: Unredacted sensitive credential in CORS Preflight Request Header

Security Bug


In chrome://net-export -> "Strip private information" mode, I found that the header of CORS Preflight requests contain credentials, e.g., Chrome Sync OAuth token: https://screenshot.googleplex.com/C6zW7g32E4bHuE4

Related code:

I imagine this information should be stripped away with NetLogRequestHeaders.

VERSION

  • Chrome Version:
    • Linux: 142.0.7444.175 stable
    • MacOS arm64: 142.0.7444.177 stable
  • Operating System: Tested on
    • gLinux: Linux 6.16.12-1rodete1-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.16.12-1rodete1 (2025-10-16) x86_64 GNU/Linux
    • MacOS: Darwin 24.6.0 Darwin Kernel Version 24.6.0: Wed Oct 15 21:09:41 PDT 2025; root:xnu-11417.140.69.703.14~1/RELEASE_ARM64_T8122 arm64

REPRODUCTION CASE

Go to chrome://net-export and record network traffic with the “Strip private information” option.

View on issue tracker