From 5bbd1a775ac36bb486ec183482213bebf2b70aff Mon Sep 17 00:00:00 2001
From: Mohamed Amir Yosef <[email protected]>
Date: Thu, 03 Sep 2026 13:24:54 -0700
Subject: [PATCH] [EVP] Remove initial button focus from EmailVerificationPopupView

EmailVerificationPopupView is an activatable, non-blocking popup
anchored to an email input field. Previously, its constructor
explicitly designated the affirmative 'Verify' (Allow) button as the
initially focused view via SetInitiallyFocusedView(allow_button).

Per UX and accessibility best practices, non-blocking popups should
not shift keyboard focus away from the active input field upon
appearance, as unexpected context changes disrupt typing and screen
readers. Furthermore, granting initial focus to an affirmative control
in a focus-stealing popup enabled UI keyjacking (CWE-1021).

This CL removes the initial button focus in EmailVerificationPopupView
so that neither button receives initial focus upon display. Keystrokes
like Enter or Space will not trigger either button on appearance,
closing the keyjacking vector. A regression unit test is added to
verify this behavior.

TAG=agy
CONV=e467eea6-1efa-46a0-add6-5c97acc5f225

Fixed: 517090646
Change-Id: Icb030d82d6faf6921f29ae2dc0bb91250be4eb36
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8351348
Reviewed-by: Yi Gu <[email protected]>
Commit-Queue: Mohamed Amir Yosef <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1691885}
---
diff --git a/chrome/browser/ui/views/autofill/popup/email_verifier/email_verification_popup_view.cc b/chrome/browser/ui/views/autofill/popup/email_verifier/email_verification_popup_view.cc
index 9becfbb8..ec8b53d 100644
--- a/chrome/browser/ui/views/autofill/popup/email_verifier/email_verification_popup_view.cc
+++ b/chrome/browser/ui/views/autofill/popup/email_verifier/email_verification_popup_view.cc
@@ -157,7 +157,7 @@
           .SetID(static_cast<int>(PopupViewId::kCancelButton))
           .Build());
 
-  auto* allow_button = controls->AddChildView(
+  controls->AddChildView(
       views::Builder<views::MdTextButton>()
           .SetText(l10n_util::GetStringUTF16(
               IDS_AUTOFILL_EMAIL_VERIFIER_PROMPT_VERIFY))
@@ -166,8 +166,6 @@
               &EmailVerificationPopupView::OnConfirm, base::Unretained(this)))
           .SetID(static_cast<int>(PopupViewId::kConfirmButton))
           .Build());
-
-  SetInitiallyFocusedView(allow_button);
 }
 
 EmailVerificationPopupView::~EmailVerificationPopupView() = default;
diff --git a/chrome/browser/ui/views/autofill/popup/email_verifier/email_verification_popup_view_unittest.cc b/chrome/browser/ui/views/autofill/popup/email_verifier/email_verification_popup_view_unittest.cc
index fad4d54..3bd36b2 100644
--- a/chrome/browser/ui/views/autofill/popup/email_verifier/email_verification_popup_view_unittest.cc
+++ b/chrome/browser/ui/views/autofill/popup/email_verifier/email_verification_popup_view_unittest.cc
@@ -26,7 +26,9 @@
 #include "content/public/test/web_contents_tester.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "ui/views/controls/button/md_text_button.h"
 #include "ui/views/controls/webview/webview.h"
+#include "ui/views/view_utils.h"
 #include "ui/views/widget/widget.h"
 
 namespace autofill {
@@ -487,5 +489,29 @@
             0);
 }
 
+// Verifies that neither button receives initial focus upon appearance.
+// For non-blocking popups, no button receives initial focus to prevent
+// unexpected focus shifts and eliminate UI keyjacking vectors.
+TEST_F(EmailVerificationPopupViewTest, NoInitialButtonFocus) {
+  auto controller =
+      std::make_unique<EmailVerificationPopupController>(web_contents());
+  auto view = std::make_unique<EmailVerificationPopupView>(
+      controller->GetWeakPtr(), widget_.get(),
+      net::SchemefulSite(GURL("https://issuer.com")), u"[email protected]",
+      base::DoNothing());
+
+  views::MdTextButton* cancel_button = views::AsViewClass<views::MdTextButton>(
+      view->GetViewByID(static_cast<int>(
+          EmailVerificationPopupView::PopupViewId::kCancelButton)));
+  ASSERT_THAT(cancel_button, testing::NotNull());
+
+  views::MdTextButton* confirm_button = views::AsViewClass<views::MdTextButton>(
+      view->GetViewByID(static_cast<int>(
+          EmailVerificationPopupView::PopupViewId::kConfirmButton)));
+  ASSERT_THAT(confirm_button, testing::NotNull());
+
+  EXPECT_EQ(view->GetInitiallyFocusedView(), nullptr);
+}
+
 }  // namespace
 }  // namespace autofill

diff --git a/chrome/browser/ui/views/autofill/popup/email_verifier/email_verification_popup_view_unittest.cc b/chrome/browser/ui/views/autofill/popup/email_verifier/email_verification_popup_view_unittest.cc
index fad4d54..3bd36b2 100644
--- a/chrome/browser/ui/views/autofill/popup/email_verifier/email_verification_popup_view_unittest.cc
+++ b/chrome/browser/ui/views/autofill/popup/email_verifier/email_verification_popup_view_unittest.cc
@@ -26,7 +26,9 @@
 #include "content/public/test/web_contents_tester.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "ui/views/controls/button/md_text_button.h"
 #include "ui/views/controls/webview/webview.h"
+#include "ui/views/view_utils.h"
 #include "ui/views/widget/widget.h"
 
 namespace autofill {
@@ -487,5 +489,29 @@
             0);
 }
 
+// Verifies that neither button receives initial focus upon appearance.
+// For non-blocking popups, no button receives initial focus to prevent
+// unexpected focus shifts and eliminate UI keyjacking vectors.
+TEST_F(EmailVerificationPopupViewTest, NoInitialButtonFocus) {
+  auto controller =
+      std::make_unique<EmailVerificationPopupController>(web_contents());
+  auto view = std::make_unique<EmailVerificationPopupView>(
+      controller->GetWeakPtr(), widget_.get(),
+      net::SchemefulSite(GURL("https://issuer.com")), u"[email protected]",
+      base::DoNothing());
+
+  views::MdTextButton* cancel_button = views::AsViewClass<views::MdTextButton>(
+      view->GetViewByID(static_cast<int>(
+          EmailVerificationPopupView::PopupViewId::kCancelButton)));
+  ASSERT_THAT(cancel_button, testing::NotNull());
+
+  views::MdTextButton* confirm_button = views::AsViewClass<views::MdTextButton>(
+      view->GetViewByID(static_cast<int>(
+          EmailVerificationPopupView::PopupViewId::kConfirmButton)));
+  ASSERT_THAT(confirm_button, testing::NotNull());
+
+  EXPECT_EQ(view->GetInitiallyFocusedView(), nullptr);
+}
+
 }  // namespace
 }  // namespace autofill