From f08d71c609e5760843865d126b8fd420808da31a Mon Sep 17 00:00:00 2001
From: Joel Hockey <[email protected]>
Date: Tue, 08 Sep 2026 15:07:39 -0700
Subject: [PATCH] Reject EyeDropper Choose() on inactive documents

Similar to crbug.com/553913506 which disallows creating a new
EyeDropper, we must reject calls to Choose() on any existing EyeDropper
from an inactive document.

Bug: 556235282
Change-Id: I167ae60a9697cab82ebc92d2464e531f0f7df96b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8364964
Reviewed-by: Alex Moshchuk <[email protected]>
Commit-Queue: Alex Moshchuk <[email protected]>
Auto-Submit: Joel Hockey <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1694101}
---
diff --git a/content/browser/eye_dropper_chooser_impl.cc b/content/browser/eye_dropper_chooser_impl.cc
index da8a85c1..4f020d5 100644
--- a/content/browser/eye_dropper_chooser_impl.cc
+++ b/content/browser/eye_dropper_chooser_impl.cc
@@ -84,6 +84,12 @@
 }
 
 void EyeDropperChooserImpl::Choose(ChooseCallback callback) {
+  // Frame must be active to use EyeDropperChooser.
+  if (!render_frame_host().IsActive()) {
+    std::move(callback).Run(/*success=*/false, /*color=*/0);
+    return;
+  }
+
   if (callback_ || eye_dropper_) {
     ReportBadMessageAndDeleteThis(
         "EyeDropperChooser::Choose() called while a selection was already in "
diff --git a/content/browser/eye_dropper_chooser_impl_unittest.cc b/content/browser/eye_dropper_chooser_impl_unittest.cc
index bb660129..923e38a1 100644
--- a/content/browser/eye_dropper_chooser_impl_unittest.cc
+++ b/content/browser/eye_dropper_chooser_impl_unittest.cc
@@ -203,4 +203,23 @@
   EXPECT_TRUE(new_rfh->HasTransientUserActivation());
 }
 
+// Inactive documents should be rejected for Choose()
+TEST_F(EyeDropperChooserImplTest, InactiveDocumentChooseFails) {
+  // 1. Start with the initial active document.
+  RenderFrameHostWrapper rfh(main_rfh());
+  // 2. Create a valid EyeDropper.
+  mojo::Remote<blink::mojom::EyeDropperChooser> chooser = CreateChooser();
+  // 3. Navigate away. The old document goes into the Back/Forward Cache
+  //    (or becomes pending-deletion), becoming inactive.
+  NavigationSimulator::NavigateAndCommitFromDocument(
+      GURL("https://example2.test"), main_rfh());
+  EXPECT_FALSE(rfh->IsActive());
+
+  // 4. Choose() should fail.
+  ChooseFuture choose_future;
+  chooser->Choose(choose_future.GetCallback());
+  EXPECT_TRUE(choose_future.Wait());
+  EXPECT_FALSE(choose_future.Get<0>());
+}
+
 }  // namespace content

diff --git a/content/browser/eye_dropper_chooser_impl_unittest.cc b/content/browser/eye_dropper_chooser_impl_unittest.cc
index bb660129..923e38a1 100644
--- a/content/browser/eye_dropper_chooser_impl_unittest.cc
+++ b/content/browser/eye_dropper_chooser_impl_unittest.cc
@@ -203,4 +203,23 @@
   EXPECT_TRUE(new_rfh->HasTransientUserActivation());
 }
 
+// Inactive documents should be rejected for Choose()
+TEST_F(EyeDropperChooserImplTest, InactiveDocumentChooseFails) {
+  // 1. Start with the initial active document.
+  RenderFrameHostWrapper rfh(main_rfh());
+  // 2. Create a valid EyeDropper.
+  mojo::Remote<blink::mojom::EyeDropperChooser> chooser = CreateChooser();
+  // 3. Navigate away. The old document goes into the Back/Forward Cache
+  //    (or becomes pending-deletion), becoming inactive.
+  NavigationSimulator::NavigateAndCommitFromDocument(
+      GURL("https://example2.test"), main_rfh());
+  EXPECT_FALSE(rfh->IsActive());
+
+  // 4. Choose() should fail.
+  ChooseFuture choose_future;
+  chooser->Choose(choose_future.GetCallback());
+  EXPECT_TRUE(choose_future.Wait());
+  EXPECT_FALSE(choose_future.Get<0>());
+}
+
 }  // namespace content