Chrome · Chromoting › Remoting
CVE-2026-106236
Spoofing in Chromoting (Remoting)
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
remoting/host/disconnect_window_win.cc
Patch
From 785e12f4a8030d38e0f6252f327e3f26ee41c90b Mon Sep 17 00:00:00 2001 From: Joe Downing <[email protected]> Date: Tue, 08 Sep 2026 10:28:03 -0700 Subject: [PATCH] [remoting] Use ElideEmail in Windows host disconnect dialog Applies remoting::ElideEmail in DisconnectWindowWin on Windows so that client emails are bounded in length while preserving the username prefix and authentic domain suffix. Also removes post-format truncation at kMaxSharingWithTextLength and sanitizes directional formatting after elision. Bug: 556233068 Change-Id: I51216458ff99341d4101a26fa7a08517f28cae1e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8360396 Reviewed-by: Jamie Walch <[email protected]> Commit-Queue: Jamie Walch <[email protected]> Auto-Submit: Joe Downing <[email protected]> Cr-Commit-Position: refs/heads/main@{#1693890} --- diff --git a/remoting/host/disconnect_window_win.cc b/remoting/host/disconnect_window_win.cc index 808ba541..f7642ad1 100644 --- a/remoting/host/disconnect_window_win.cc +++ b/remoting/host/disconnect_window_win.cc @@ -15,6 +15,7 @@ #include "base/compiler_specific.h" #include "base/functional/bind.h" +#include "base/i18n/rtl.h" #include "base/location.h" #include "base/logging.h" #include "base/memory/weak_ptr.h" @@ -26,6 +27,7 @@ #include "base/win/scoped_gdi_object.h" #include "base/win/scoped_hdc.h" #include "base/win/scoped_select_object.h" +#include "remoting/base/email_utils.h" #include "remoting/host/client_session_control.h" #include "remoting/host/host_window.h" #include "remoting/host/input_monitor/local_input_monitor.h" @@ -39,10 +41,6 @@ constexpr int DISCONNECT_HOTKEY_ID = 1000; -// Maximum length of "Your desktop is shared with ..." message in UTF-16 -// characters. -constexpr size_t kMaxSharingWithTextLength = 100; - constexpr wchar_t kShellTrayWindowName[] = L"Shell_TrayWnd"; constexpr int kWindowBorderRadius = 14; @@ -144,8 +142,8 @@ // Used to watch for local input which will trigger the dialog to be reshown. std::unique_ptr<LocalInputMonitor> local_input_monitor_; - // Specifies the remote user name. - std::string username_; + // Specifies the remote user's email address. + std::string email_; bool was_auto_hidden_ = false; base::OneShotTimer auto_hide_timer_; @@ -212,7 +210,7 @@ client_session_control_ = client_session_control; std::string client_jid = client_session_control_->client_jid(); - username_ = client_jid.substr(0, client_jid.find('/')); + email_ = client_jid.substr(0, client_jid.find('/')); if (!BeginDialog()) { EndDialog(); return; @@ -605,12 +603,15 @@ return false; } - // Format and truncate "Your desktop is shared with ..." message. + // Format "Your desktop is shared with ..." message. + std::u16string email = base::UTF8ToUTF16(email_); + email = base::CollapseWhitespace(email, + /*trim_sequences_with_line_breaks=*/true); + email = ElideEmail(email); + base::i18n::SanitizeUserSuppliedString(&email); + message_text = base::AsWString(base::ReplaceStringPlaceholders( - base::AsString16(message_text), base::UTF8ToUTF16(username_), nullptr)); - if (message_text.length() > kMaxSharingWithTextLength) { - message_text.erase(kMaxSharingWithTextLength); - } + base::AsString16(message_text), email, nullptr)); if (!SetWindowText(hwnd_message, message_text.c_str())) { return false;
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page