Chrome · Chromoting › Remoting
CVE-2026-106251
Spoofing in Chromoting (Remoting)
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifremoting/host/disconnect_window_mac.mm |
modified |
Files Changed
remoting/host/disconnect_window_mac.mmremoting/host/disconnect_window_mac.h
Patch
From b0fc1ed64ed654aca12eafe8b960dbc71e3c26b1 Mon Sep 17 00:00:00 2001 From: Joe Downing <[email protected]> Date: Tue, 08 Sep 2026 10:27:47 -0700 Subject: [PATCH] [remoting] Use ElideEmail in macOS host disconnect dialog Applies remoting::ElideEmail in DisconnectWindowMac on macOS so that client emails are bounded in length while preserving the username prefix and authentic domain suffix. Also configures the NSTextField cell for middle truncation in single-line mode so any layout elision explicitly displays an ellipsis, and sanitizes directional formatting after elision. Bug: 556237314 Change-Id: If1dcbb76dc3bfd2bffb8006c87227b48d97fe0e1 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8360556 Reviewed-by: Jamie Walch <[email protected]> Commit-Queue: Jamie Walch <[email protected]> Auto-Submit: Joe Downing <[email protected]> Cr-Commit-Position: refs/heads/main@{#1693889} --- diff --git a/remoting/host/disconnect_window_mac.h b/remoting/host/disconnect_window_mac.h index 137124b3..9379eaa 100644 --- a/remoting/host/disconnect_window_mac.h +++ b/remoting/host/disconnect_window_mac.h @@ -16,7 +16,7 @@ @interface DisconnectWindowController : NSWindowController - (instancetype)initWithCallback:(base::OnceClosure)disconnect_callback - username:(const std::string&)username + email:(const std::string&)email window:(NSWindow*)window; - (void)initializeWindow; - (void)stopSharing:(id)sender; diff --git a/remoting/host/disconnect_window_mac.mm b/remoting/host/disconnect_window_mac.mm index 67c03d4..bea5e09 100644 --- a/remoting/host/disconnect_window_mac.mm +++ b/remoting/host/disconnect_window_mac.mm @@ -18,6 +18,7 @@ #include "base/strings/utf_string_conversions.h" #include "base/time/time.h" #include "base/timer/timer.h" +#include "remoting/base/email_utils.h" #include "remoting/base/string_resources.h" #include "remoting/host/client_session_control.h" #include "remoting/host/host_window.h" @@ -104,7 +105,7 @@ &ClientSessionControl::DisconnectSession, client_session_control, ErrorCode::OK, "Disconnect button was clicked.", FROM_HERE); std::string client_jid = client_session_control->client_jid(); - std::string username = client_jid.substr(0, client_jid.find('/')); + std::string email = client_jid.substr(0, client_jid.find('/')); NSRect frame = NSMakeRect(0, 0, 466, 40); DisconnectWindow* window = @@ -115,7 +116,7 @@ window.releasedWhenClosed = NO; window_controller_ = [[DisconnectWindowController alloc] initWithCallback:std::move(disconnect_callback) - username:username + email:email window:window]; [window_controller_ initializeWindow]; [window_controller_ showWindow:nil]; @@ -130,7 +131,7 @@ @implementation DisconnectWindowController { base::OnceClosure _disconnect_callback; - std::u16string _username; + std::u16string _email; base::OneShotTimer _cooldown_timer; } @@ -139,12 +140,17 @@ @synthesize disconnectButton = _disconnectButton; - (instancetype)initWithCallback:(base::OnceClosure)disconnect_callback - username:(const std::string&)username + email:(const std::string&)email window:(NSWindow*)window { self = [super initWithWindow:window]; if (self) { _disconnect_callback = std::move(disconnect_callback); - _username = base::UTF8ToUTF16(username); + std::u16string email_u16 = base::UTF8ToUTF16(email); + email_u16 = base::CollapseWhitespace( + email_u16, /*trim_sequences_with_line_breaks=*/true); + email_u16 = remoting::ElideEmail(email_u16); + base::i18n::SanitizeUserSuppliedString(&email_u16); + _email = std::move(email_u16); [NSNotificationCenter.defaultCenter addObserver:self selector:@selector(onScreenParametersChanged:) @@ -223,6 +229,8 @@ self.connectedToField.bezeled = NO; self.connectedToField.editable = NO; self.connectedToField.font = [NSFont systemFontOfSize:11]; + self.connectedToField.cell.lineBreakMode = NSLineBreakByTruncatingMiddle; + self.connectedToField.cell.usesSingleLineMode = YES; [self.window.contentView addSubview:self.connectedToField]; self.disconnectButton = @@ -235,7 +243,7 @@ [self.window.contentView addSubview:self.disconnectButton]; self.connectedToField.stringValue = - l10n_util::GetNSStringF(IDS_MESSAGE_SHARED, _username); + l10n_util::GetNSStringF(IDS_MESSAGE_SHARED, _email); self.disconnectButton.title = l10n_util::GetNSString(IDS_STOP_SHARING_BUTTON); // Resize the window dynamically based on the content.
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page