From 18da9e36a6a0153211aacdceb52179c5fadfa819 Mon Sep 17 00:00:00 2001
From: Thomas Nguyen <[email protected]>
Date: Thu, 03 Sep 2026 05:30:17 -0700
Subject: [PATCH] [CE]: Correct console warning in fenced frame

Sending console messages through GetOutermostMainFrame() traverses out
of the fenced frame tree, into the embedder's renderer process rather
than the fenced frame's renderer process. This creates a potential
communication that violates the fenced frame isolation model.

Fixed: 553255283

Change-Id: Ifdafcd3790624c194227cf990c99a9950c4b13f1
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8304541
Reviewed-by: Judith Hemp <[email protected]>
Commit-Queue: Thomas Nguyen <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1691507}
---
diff --git a/content/browser/permissions/permission_controller_impl.cc b/content/browser/permissions/permission_controller_impl.cc
index 454bcb2..05881bf 100644
--- a/content/browser/permissions/permission_controller_impl.cc
+++ b/content/browser/permissions/permission_controller_impl.cc
@@ -178,7 +178,7 @@
     if (result.status == PermissionStatus::DENIED) {
       switch (result.source) {
         case PermissionStatusSource::FENCED_FRAME:
-          render_frame_host->GetOutermostMainFrame()->AddMessageToConsole(
+          render_frame_host->AddMessageToConsole(
               blink::mojom::ConsoleMessageLevel::kWarning,
               blink::GetPermissionString(permission_type) +
                   " permission has been blocked because it was requested "
diff --git a/chrome/browser/permissions/permission_request_manager_browsertest.cc b/chrome/browser/permissions/permission_request_manager_browsertest.cc
index ebba9d4..2521d3a3 100644
--- a/chrome/browser/permissions/permission_request_manager_browsertest.cc
+++ b/chrome/browser/permissions/permission_request_manager_browsertest.cc
@@ -1784,7 +1784,7 @@
          const content::WebContentsConsoleObserver::Message& message) {
         return message.source_frame == render_frame_host;
       },
-      fenced_frame_host->GetOutermostMainFrame()));
+      fenced_frame_host));
   console_observer.SetPattern(kExpectedConsolePattern);
 
   EXPECT_EQ(

diff --git a/chrome/browser/permissions/permission_request_manager_browsertest.cc b/chrome/browser/permissions/permission_request_manager_browsertest.cc
index ebba9d4..2521d3a3 100644
--- a/chrome/browser/permissions/permission_request_manager_browsertest.cc
+++ b/chrome/browser/permissions/permission_request_manager_browsertest.cc
@@ -1784,7 +1784,7 @@
          const content::WebContentsConsoleObserver::Message& message) {
         return message.source_frame == render_frame_host;
       },
-      fenced_frame_host->GetOutermostMainFrame()));
+      fenced_frame_host));
   console_observer.SetPattern(kExpectedConsolePattern);
 
   EXPECT_EQ(