PatchGap
Chrome · Mobile

CVE-2026-106353

Input Validation in Mobile
Low chrome Input Validation 🔧 Commit mapped

Overview

Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactImproper input validation in Mobile
DescriptionImproper input validation in Mobile
ComponentMobile
Bug ClassInput Validation
Tracker502078791
Fix commitde9e5f13bd69 (chromium/src) +48/-1
CISA KEVNot listed
CreditedGoogle
Disclosed2026-10-06

Changed Functions

FunctionChangeNotes
for
ios/chrome/browser/bookmarks/ui_bundled/bookmark_mediator.mm
 modified
TEST_F
ios/chrome/browser/bookmarks/ui_bundled/bookmark_mediator_unittest.mm
 modified

Files Changed

  • ios/chrome/browser/bookmarks/ui_bundled/bookmark_mediator.mm
  • ios/chrome/browser/bookmarks/ui_bundled/bookmark_mediator_unittest.mm

Patch

view commit
From de9e5f13bd69a0096c2bd76a6b30d19eda90d26e Mon Sep 17 00:00:00 2001
From: Louis Romero <[email protected]>
Date: Wed, 09 Sep 2026 16:13:50 -0700
Subject: [PATCH] Reject unsupported schemes in bulk bookmark add

Bulk adding bookmarks via Siri shortcut intents allowed persisting
arbitrary schemes such as javascript:, which synced across devices and
posed a UXSS risk.

Validate that URLs have HTTP or HTTPS schemes before persisting them to
the bookmark model, aligning with the reading list intent behavior.

Bug: 502078791
Change-Id: I9dafc9d651d3282b7f7f2ccec1b1cabfb31eabb7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8377112
Commit-Queue: Louis Romero <[email protected]>
Commit-Queue: Eric Noyau <[email protected]>
Auto-Submit: Louis Romero <[email protected]>
Reviewed-by: Eric Noyau <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1694976}
---
diff --git a/ios/chrome/browser/bookmarks/ui_bundled/bookmark_mediator.mm b/ios/chrome/browser/bookmarks/ui_bundled/bookmark_mediator.mm
index e8dce42..c0ff2c0 100644
--- a/ios/chrome/browser/bookmarks/ui_bundled/bookmark_mediator.mm
+++ b/ios/chrome/browser/bookmarks/ui_bundled/bookmark_mediator.mm
@@ -117,7 +117,7 @@
   for (NSURL* NSURL in URLs) {
     GURL URL = net::GURLWithNSURL(NSURL);
 
-    if (!URL.is_valid()) {
+    if (!URL.is_valid() || !URL.SchemeIsHTTPOrHTTPS()) {
       continue;
     }
 
diff --git a/ios/chrome/browser/bookmarks/ui_bundled/bookmark_mediator_unittest.mm b/ios/chrome/browser/bookmarks/ui_bundled/bookmark_mediator_unittest.mm
index a13dd31..f9244c1 100644
--- a/ios/chrome/browser/bookmarks/ui_bundled/bookmark_mediator_unittest.mm
+++ b/ios/chrome/browser/bookmarks/ui_bundled/bookmark_mediator_unittest.mm
@@ -34,6 +34,7 @@
 #import "ios/chrome/grit/ios_strings.h"
 #import "testing/gtest_mac.h"
 #import "ui/base/l10n/l10n_util.h"
+#import "url/gurl.h"
 
 namespace {
 
@@ -361,4 +362,50 @@
   histogram_tester_.ExpectBucketCount("IOS.Bookmarks.BulkAddURLsCount", 0, 1);
 }
 
+// Tests bulkAddBookmarksWithURLs rejects unsupported URL schemes
+// (e.g. javascript:, chrome:, file:, data:).
+TEST_F(BookmarkMediatorUnitTest, TestBulkSnackbarMessageUnsupportedSchemes) {
+  NSArray* URLs = @[
+    [[NSURL alloc] initWithString:@"javascript:alert(1)"],
+    [[NSURL alloc] initWithString:@"chrome://version"],
+    [[NSURL alloc] initWithString:@"data:text/html,<html></html>"],
+    [[NSURL alloc] initWithString:@"file:///path/to/file"],
+    [[NSURL alloc] initWithString:@"https://google.com"]
+  ];
+
+  SnackbarMessage* const snackbarMessage =
+      [mediator_ bulkAddBookmarksWithURLs:URLs
+                               viewAction:^{
+                               }];
+
+  std::vector<bookmarks::UrlAndTitle> bookmarks =
+      bookmark_model_->GetUniqueUrls();
+
+  ASSERT_EQ(1U, bookmarks.size());
+  EXPECT_EQ(GURL("https://google.com"), bookmarks[0].url);
+  ASSERT_NSEQ(snackbarMessage.title, @"Bookmark saved");
+  histogram_tester_.ExpectBucketCount("IOS.Bookmarks.BulkAddURLsCount", 1, 1);
+}
+
+// Tests bulkAddBookmarksWithURLs with only unsupported URL schemes.
+TEST_F(BookmarkMediatorUnitTest,
+       TestBulkSnackbarMessageOnlyUnsupportedSchemes) {
+  NSArray* URLs = @[
+    [[NSURL alloc] initWithString:@"javascript:alert(1)"],
+    [[NSURL alloc] initWithString:@"chrome://version"]
+  ];
+
+  SnackbarMessage* const snackbarMessage =
+      [mediator_ bulkAddBookmarksWithURLs:URLs
+                               viewAction:^{
+                               }];
+
+  std::vector<bookmarks::UrlAndTitle> bookmarks =
+      bookmark_model_->GetUniqueUrls();
+
+  ASSERT_EQ(0U, bookmarks.size());
+  ASSERT_NSEQ(snackbarMessage.title, @"0 bookmarks saved");
+  histogram_tester_.ExpectBucketCount("IOS.Bookmarks.BulkAddURLsCount", 0, 1);
+}
+
 }  // namespace
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/ios/chrome/browser/bookmarks/ui_bundled/bookmark_mediator_unittest.mm b/ios/chrome/browser/bookmarks/ui_bundled/bookmark_mediator_unittest.mm
index a13dd31..f9244c1 100644
--- a/ios/chrome/browser/bookmarks/ui_bundled/bookmark_mediator_unittest.mm
+++ b/ios/chrome/browser/bookmarks/ui_bundled/bookmark_mediator_unittest.mm
@@ -34,6 +34,7 @@
 #import "ios/chrome/grit/ios_strings.h"
 #import "testing/gtest_mac.h"
 #import "ui/base/l10n/l10n_util.h"
+#import "url/gurl.h"
 
 namespace {
 
@@ -361,4 +362,50 @@
   histogram_tester_.ExpectBucketCount("IOS.Bookmarks.BulkAddURLsCount", 0, 1);
 }
 
+// Tests bulkAddBookmarksWithURLs rejects unsupported URL schemes
+// (e.g. javascript:, chrome:, file:, data:).
+TEST_F(BookmarkMediatorUnitTest, TestBulkSnackbarMessageUnsupportedSchemes) {
+  NSArray* URLs = @[
+    [[NSURL alloc] initWithString:@"javascript:alert(1)"],
+    [[NSURL alloc] initWithString:@"chrome://version"],
+    [[NSURL alloc] initWithString:@"data:text/html,<html></html>"],
+    [[NSURL alloc] initWithString:@"file:///path/to/file"],
+    [[NSURL alloc] initWithString:@"https://google.com"]
+  ];
+
+  SnackbarMessage* const snackbarMessage =
+      [mediator_ bulkAddBookmarksWithURLs:URLs
+                               viewAction:^{
+                               }];
+
+  std::vector<bookmarks::UrlAndTitle> bookmarks =
+      bookmark_model_->GetUniqueUrls();
+
+  ASSERT_EQ(1U, bookmarks.size());
+  EXPECT_EQ(GURL("https://google.com"), bookmarks[0].url);
+  ASSERT_NSEQ(snackbarMessage.title, @"Bookmark saved");
+  histogram_tester_.ExpectBucketCount("IOS.Bookmarks.BulkAddURLsCount", 1, 1);
+}
+
+// Tests bulkAddBookmarksWithURLs with only unsupported URL schemes.
+TEST_F(BookmarkMediatorUnitTest,
+       TestBulkSnackbarMessageOnlyUnsupportedSchemes) {
+  NSArray* URLs = @[
+    [[NSURL alloc] initWithString:@"javascript:alert(1)"],
+    [[NSURL alloc] initWithString:@"chrome://version"]
+  ];
+
+  SnackbarMessage* const snackbarMessage =
+      [mediator_ bulkAddBookmarksWithURLs:URLs
+                               viewAction:^{
+                               }];
+
+  std::vector<bookmarks::UrlAndTitle> bookmarks =
+      bookmark_model_->GetUniqueUrls();
+
+  ASSERT_EQ(0U, bookmarks.size());
+  ASSERT_NSEQ(snackbarMessage.title, @"0 bookmarks saved");
+  histogram_tester_.ExpectBucketCount("IOS.Bookmarks.BulkAddURLsCount", 0, 1);
+}
+
 }  // namespace
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
On This Page