Chrome · Payments › AF
CVE-2026-106334
Info Disclosure in Payments (AF)
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
components/autofill/core/browser/data_model/payments/iban.cc
Patch
From a98723fe3673400ec3e6d23e3a9ab7b2b3130533 Mon Sep 17 00:00:00 2001 From: Olivia Saul <[email protected]> Date: Wed, 09 Sep 2026 10:56:02 -0700 Subject: [PATCH] [AF] Swap to base::ToUpperASCII for uppercasing IBAN values/countries Locales 'az' and 'tr' convert 'i' into 'İ' otherwise, which break validation checks and country mapping checks. Fixed: 556229780 Change-Id: I5677a52b144f1aef83c33a77306517b111e9f699 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8348703 Reviewed-by: Qihui Zhao <[email protected]> Commit-Queue: Qihui Zhao <[email protected]> Cr-Commit-Position: refs/heads/main@{#1694725} --- diff --git a/components/autofill/core/browser/data_model/payments/iban.cc b/components/autofill/core/browser/data_model/payments/iban.cc index 762ca76..ace1306f 100644 --- a/components/autofill/core/browser/data_model/payments/iban.cc +++ b/components/autofill/core/browser/data_model/payments/iban.cc @@ -17,7 +17,6 @@ #include "base/check_op.h" #include "base/containers/fixed_flat_map.h" #include "base/containers/map_util.h" -#include "base/i18n/case_conversion.h" #include "base/notreached.h" #include "base/strings/strcat.h" #include "base/strings/string_number_conversions.h" @@ -132,7 +131,7 @@ // static bool Iban::IsValid(std::u16string_view value) { std::u16string iban_value = RemoveIbanSeparators(value); - iban_value = base::i18n::ToUpper(iban_value); + iban_value = base::ToUpperASCII(iban_value); // IBANs must be at least 15 digits and at most 33 digits long. if (iban_value.length() < 15 || iban_value.length() > 33) { return false; @@ -159,7 +158,7 @@ // static std::string Iban::GetCountryCode(const std::u16string& iban_value) { CHECK(iban_value.length() >= 2); - return base::UTF16ToUTF8(base::i18n::ToUpper(iban_value.substr(0, 2))); + return base::UTF16ToUTF8(base::ToUpperASCII(iban_value.substr(0, 2))); } // static
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page