CVE-2026-11190

Overview

Medium

Severity

6.5

CVSS

No

Exploited ITW

Fixed

Fix Status

ImpactInsufficient policy enforcement in Extensions

DescriptionInsufficient policy enforcement in Extensions

ComponentExtensions

Bug ClassPolicy Bypass

Tracker503375371

Fix commit627b34d0b40c (chromium/src) +50/-0

CWECWE-284

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CISA KEVNot listed

CreditedGoogle

Reported2026-04-16 (per vendor advisory)

Fix landed2026-04-20 (public git)

Disclosed2026-06-02

Patch gap43 days — fix public in source before the advisory

Changed Functions

Function	Change	Notes
`for` extensions/browser/api/content_settings/content_settings_store.cc	modified
`if` extensions/browser/api/content_settings/content_settings_store.cc	modified
`TEST_F` extensions/browser/api/content_settings/content_settings_store_unittest.cc	modified

Files Changed

extensions/browser/api/content_settings/content_settings_store.cc
extensions/browser/api/content_settings/content_settings_store_unittest.cc

Patch

view commit

From 627b34d0b40c5a432069c641f86cc01a1b1b2418 Mon Sep 17 00:00:00 2001
From: Christian Dullweber <[email protected]>
Date: Mon, 20 Apr 2026 05:31:32 -0700
Subject: [PATCH] Fix ContentSettingsStore::GetRule for disabled extensions

We need to skip rules from disabled extensions like in GetRuleIterator.

Bug: 503375371
Change-Id: Ic8606274ffbc4538567d566cbe4b56d87aac8848
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7770411
Commit-Queue: Balazs Engedy <[email protected]>
Commit-Queue: Christian Dullweber <[email protected]>
Reviewed-by: Balazs Engedy <[email protected]>
Auto-Submit: Christian Dullweber <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1617427}
---

diff --git a/extensions/browser/api/content_settings/content_settings_store.cc b/extensions/browser/api/content_settings/content_settings_store.cc
index a9142c85..2f77ec7 100644
--- a/extensions/browser/api/content_settings/content_settings_store.cc
+++ b/extensions/browser/api/content_settings/content_settings_store.cc
@@ -113,6 +113,10 @@
   std::unique_ptr<content_settings::Rule> result;
 
   for (const auto& entry : entries_) {
+    if (!entry->enabled) {
+      continue;
+    }
+
     if (off_the_record) {
       {
         base::AutoLock lock(entry->incognito_session_only_settings.GetLock());
diff --git a/extensions/browser/api/content_settings/content_settings_store_unittest.cc b/extensions/browser/api/content_settings/content_settings_store_unittest.cc
index 7beb2c8..d2c50ba 100644
--- a/extensions/browser/api/content_settings/content_settings_store_unittest.cc
+++ b/extensions/browser/api/content_settings/content_settings_store_unittest.cc
@@ -232,6 +232,52 @@
   ASSERT_EQ(0u, rules.size());
 }
 
+TEST_F(ContentSettingsStoreTest, GetRuleDisabledExtension) {
+  GURL url("http://www.youtube.com");
+  ContentSettingsPattern pattern = ContentSettingsPattern::FromURL(url);
+  std::string ext_id("my_extension");
+  RegisterExtension(ext_id);
+  store()->SetExtensionContentSetting(
+      ext_id, pattern, pattern, ContentSettingsType::COOKIES,
+      CONTENT_SETTING_ALLOW, ChromeSettingScope::kRegular);
+
+  EXPECT_EQ(CONTENT_SETTING_ALLOW,
+            GetContentSettingFromStore(store(), url, url,
+                                       ContentSettingsType::COOKIES, false));
+
+  // Disable the extension.
+  store()->SetExtensionState(ext_id, false);
+
+  // GetRule should now return CONTENT_SETTING_DEFAULT.
+  EXPECT_EQ(CONTENT_SETTING_DEFAULT,
+            GetContentSettingFromStore(store(), url, url,
+                                       ContentSettingsType::COOKIES, false));
+}
+
+TEST_F(ContentSettingsStoreTest, GetRuleDisabledExtensionIncognito) {
+  GURL url("http://www.youtube.com");
+  ContentSettingsPattern pattern = ContentSettingsPattern::FromURL(url);
+  std::string ext_id("my_extension");
+  RegisterExtension(ext_id);
+
+  // Set incognito setting.
+  store()->SetExtensionContentSetting(
+      ext_id, pattern, pattern, ContentSettingsType::COOKIES,
+      CONTENT_SETTING_ALLOW, ChromeSettingScope::kIncognitoPersistent);
+
+  EXPECT_EQ(CONTENT_SETTING_ALLOW,
+            GetContentSettingFromStore(store(), url, url,
+                                       ContentSettingsType::COOKIES, true));
+
+  // Disable the extension.
+  store()->SetExtensionState(ext_id, false);
+
+  // GetRule should now return CONTENT_SETTING_DEFAULT even for incognito.
+  EXPECT_EQ(CONTENT_SETTING_DEFAULT,
+            GetContentSettingFromStore(store(), url, url,
+                                       ContentSettingsType::COOKIES, true));
+}
+
 TEST_F(ContentSettingsStoreTest, SetFromList) {
   // Force creation of ContentSettingsRegistry, so that the string to content
   // setting type lookup can succeed.

Loading diff…

Regression Test / PoC

shipped with the fix

diff --git a/extensions/browser/api/content_settings/content_settings_store_unittest.cc b/extensions/browser/api/content_settings/content_settings_store_unittest.cc
index 7beb2c8..d2c50ba 100644
--- a/extensions/browser/api/content_settings/content_settings_store_unittest.cc
+++ b/extensions/browser/api/content_settings/content_settings_store_unittest.cc
@@ -232,6 +232,52 @@
   ASSERT_EQ(0u, rules.size());
 }
 
+TEST_F(ContentSettingsStoreTest, GetRuleDisabledExtension) {
+  GURL url("http://www.youtube.com");
+  ContentSettingsPattern pattern = ContentSettingsPattern::FromURL(url);
+  std::string ext_id("my_extension");
+  RegisterExtension(ext_id);
+  store()->SetExtensionContentSetting(
+      ext_id, pattern, pattern, ContentSettingsType::COOKIES,
+      CONTENT_SETTING_ALLOW, ChromeSettingScope::kRegular);
+
+  EXPECT_EQ(CONTENT_SETTING_ALLOW,
+            GetContentSettingFromStore(store(), url, url,
+                                       ContentSettingsType::COOKIES, false));
+
+  // Disable the extension.
+  store()->SetExtensionState(ext_id, false);
+
+  // GetRule should now return CONTENT_SETTING_DEFAULT.
+  EXPECT_EQ(CONTENT_SETTING_DEFAULT,
+            GetContentSettingFromStore(store(), url, url,
+                                       ContentSettingsType::COOKIES, false));
+}
+
+TEST_F(ContentSettingsStoreTest, GetRuleDisabledExtensionIncognito) {
+  GURL url("http://www.youtube.com");
+  ContentSettingsPattern pattern = ContentSettingsPattern::FromURL(url);
+  std::string ext_id("my_extension");
+  RegisterExtension(ext_id);
+
+  // Set incognito setting.
+  store()->SetExtensionContentSetting(
+      ext_id, pattern, pattern, ContentSettingsType::COOKIES,
+      CONTENT_SETTING_ALLOW, ChromeSettingScope::kIncognitoPersistent);
+
+  EXPECT_EQ(CONTENT_SETTING_ALLOW,
+            GetContentSettingFromStore(store(), url, url,
+                                       ContentSettingsType::COOKIES, true));
+
+  // Disable the extension.
+  store()->SetExtensionState(ext_id, false);
+
+  // GetRule should now return CONTENT_SETTING_DEFAULT even for incognito.
+  EXPECT_EQ(CONTENT_SETTING_DEFAULT,
+            GetContentSettingFromStore(store(), url, url,
+                                       ContentSettingsType::COOKIES, true));
+}
+
 TEST_F(ContentSettingsStoreTest, SetFromList) {
   // Force creation of ContentSettingsRegistry, so that the string to content
   // setting type lookup can succeed.

Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.

References

Vendor advisory Fix commit Bug tracker NVD