Chrome · PDF › PDF
CVE-2026-110147
UAF in PDF (PDF)
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
components/pdf/renderer/pdf_view_web_plugin_client.cc
Patch
From e0c230bb186080c81c9e6b36a08deea184d15c59 Mon Sep 17 00:00:00 2001 From: Lei Zhang <[email protected]> Date: Tue, 06 Oct 2026 14:48:37 -0700 Subject: [PATCH] [PDF] Simplify PdfViewWebPluginClient::TextSelectionChanged() This reverts crrev.com/906945, which added a focus frame call. The motivation in that CL is to make PDFExtensionJSTest.BasicPlugin pass, but the test still passes now without it. In the meanwhile, the focus event is being abused, so just get rid of it. Bug: 40192026, 570050928 Change-Id: Iadfc44ae381b42e9e29f2c83f2291bff3f9704c9 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8524410 Reviewed-by: April Kallmeyer <[email protected]> Commit-Queue: Lei Zhang <[email protected]> Cr-Commit-Position: refs/heads/main@{#1712741} --- diff --git a/components/pdf/renderer/pdf_view_web_plugin_client.cc b/components/pdf/renderer/pdf_view_web_plugin_client.cc index 1939bc0..685bea6 100644 --- a/components/pdf/renderer/pdf_view_web_plugin_client.cc +++ b/components/pdf/renderer/pdf_view_web_plugin_client.cc @@ -32,7 +32,6 @@ #include "third_party/blink/public/web/web_plugin_container.h" #include "third_party/blink/public/web/web_script_forbidden_scope.h" #include "third_party/blink/public/web/web_serialized_script_value.h" -#include "third_party/blink/public/web/web_view.h" #include "third_party/blink/public/web/web_widget.h" #include "ui/accessibility/ax_features.mojom-features.h" #include "ui/display/screen_info.h" @@ -193,14 +192,7 @@ const blink::WebString& selection_text, uint32_t offset, const gfx::Range& range) { - // Focus the plugin's containing frame before changing the text selection. - // TODO(crbug.com/40192026): Would it make more sense not to change the text - // selection at all in this case? Maybe we only have this problem because we - // support a "selectAll" message. - blink::WebLocalFrame* frame = GetFrame(); - frame->View()->SetFocusedFrame(frame); - - frame->TextSelectionChanged(selection_text, offset, range); + GetFrame()->TextSelectionChanged(selection_text, offset, range); } std::unique_ptr<blink::WebAssociatedURLLoader>
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page