From e4a9d76ade3f47b267e8c418ef6c8d7faa4e430c Mon Sep 17 00:00:00 2001
From: Mason Freed <[email protected]>
Date: Thu, 03 Sep 2026 22:16:10 -0700
Subject: [PATCH] Exclude chrome-untrusted:// from access to the unbounded API

Per docs/webui/chrome_untrusted.md, pages in chrome-untrusted://
shouldn't get any privileges beyond a normal renderer. This removes
them from the set of schemes that get privileged access to the
unbounded element API.

Fixed: 553138969
Change-Id: Ia3cd5fae5e0c01fe2c8afd8e12b9c180ef4320bc
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8310636
Commit-Queue: Rakina Zata Amni <[email protected]>
Auto-Submit: Mason Freed <[email protected]>
Reviewed-by: Rakina Zata Amni <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1692195}
---
diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
index aa62e01..a3320b1 100644
--- a/content/browser/renderer_host/render_frame_host_impl.cc
+++ b/content/browser/renderer_host/render_frame_host_impl.cc
@@ -11514,7 +11514,8 @@
   if (!base::FeatureList::IsEnabled(blink::features::kUnboundedElement)) {
     return UnboundedElementAuth::kDenied;
   }
-  if (web_ui() != nullptr || HasWebUIOrigin(GetLastCommittedOrigin())) {
+  if (GetLastCommittedOrigin().scheme() != kChromeUIUntrustedScheme &&
+      (web_ui() != nullptr || HasWebUIOrigin(GetLastCommittedOrigin()))) {
     return UnboundedElementAuth::kAllowedPrivileged;
   }
   if (base::FeatureList::IsEnabled(
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 14d7791e..41e0154 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -4971,7 +4971,9 @@
             blink::features::kUnboundedElementOnTheOpenWeb) ||
         enabled_bindings_.Has(BindingsPolicyValue::kWebUi) ||
         (GetWebFrame() && !GetWebFrame()->GetSecurityOrigin().IsNull() &&
-         GetWebFrame()->GetSecurityOrigin().IsWebUI());
+         GetWebFrame()->GetSecurityOrigin().IsWebUI() &&
+         GetWebFrame()->GetSecurityOrigin().Protocol() !=
+             kChromeUIUntrustedScheme);
     if (is_unbounded_allowed) {
       blink::WebV8Features::EnableUnboundedElement(context, true);
     }
diff --git a/third_party/blink/renderer/core/context_features/context_feature_settings.cc b/third_party/blink/renderer/core/context_features/context_feature_settings.cc
index e9be17c..2c346c344 100644
--- a/third_party/blink/renderer/core/context_features/context_feature_settings.cc
+++ b/third_party/blink/renderer/core/context_features/context_feature_settings.cc
@@ -81,7 +81,7 @@
 // 1) UnboundedElementOnTheOpenWeb is enabled,
 // 2) The context was marked privileged (enable_unbounded_element_), or
 // 3) The context origin is a privileged WebUI scheme
-// (SecurityOrigin::IsWebUI()).
+//    (SecurityOrigin::IsWebUI(), excluding chrome-untrusted).
 //
 // Note that enable_unbounded_element_ is set for WebUI contexts in
 // RenderFrameImpl, but can also be set when UnboundedElementOnTheOpenWeb is
@@ -95,7 +95,8 @@
     return UnboundedElementAuth::kDenied;
   }
   const SecurityOrigin* security_origin = context->GetSecurityOrigin();
-  bool is_privileged = security_origin && security_origin->IsWebUI();
+  bool is_privileged = security_origin && security_origin->IsWebUI() &&
+                       security_origin->Protocol() != "chrome-untrusted";
   if (is_privileged) {
     return UnboundedElementAuth::kAllowedPrivileged;
   }