PatchGap
Chrome · Extensions

CVE-2026-11190

Logic Error in Extensions
Medium chrome Logic Error 🔧 Commit mapped

Overview

Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInsufficient policy enforcement in Extensions
DescriptionInsufficient policy enforcement in Extensions
ComponentExtensions
Bug ClassLogic Error
Tracker503375371
Fix commit627b34d0b40c (chromium/src) +50/-0
CISA KEVNot listed
CreditedGoogle
Disclosed2026-06-02

Changed Functions

FunctionChangeNotes
for
extensions/browser/api/content_settings/content_settings_store.cc
 modified
if
extensions/browser/api/content_settings/content_settings_store.cc
 modified
TEST_F
extensions/browser/api/content_settings/content_settings_store_unittest.cc
 modified

Files Changed

  • extensions/browser/api/content_settings/content_settings_store.cc
  • extensions/browser/api/content_settings/content_settings_store_unittest.cc

Patch

view commit
From 627b34d0b40c5a432069c641f86cc01a1b1b2418 Mon Sep 17 00:00:00 2001
From: Christian Dullweber <[email protected]>
Date: Mon, 20 Apr 2026 05:31:32 -0700
Subject: [PATCH] Fix ContentSettingsStore::GetRule for disabled extensions

We need to skip rules from disabled extensions like in GetRuleIterator.

Bug: 503375371
Change-Id: Ic8606274ffbc4538567d566cbe4b56d87aac8848
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7770411
Commit-Queue: Balazs Engedy <[email protected]>
Commit-Queue: Christian Dullweber <[email protected]>
Reviewed-by: Balazs Engedy <[email protected]>
Auto-Submit: Christian Dullweber <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1617427}
---

diff --git a/extensions/browser/api/content_settings/content_settings_store.cc b/extensions/browser/api/content_settings/content_settings_store.cc
index a9142c85..2f77ec7 100644
--- a/extensions/browser/api/content_settings/content_settings_store.cc
+++ b/extensions/browser/api/content_settings/content_settings_store.cc
@@ -113,6 +113,10 @@
   std::unique_ptr<content_settings::Rule> result;
 
   for (const auto& entry : entries_) {
+    if (!entry->enabled) {
+      continue;
+    }
+
     if (off_the_record) {
       {
         base::AutoLock lock(entry->incognito_session_only_settings.GetLock());
diff --git a/extensions/browser/api/content_settings/content_settings_store_unittest.cc b/extensions/browser/api/content_settings/content_settings_store_unittest.cc
index 7beb2c8..d2c50ba 100644
--- a/extensions/browser/api/content_settings/content_settings_store_unittest.cc
+++ b/extensions/browser/api/content_settings/content_settings_store_unittest.cc
@@ -232,6 +232,52 @@
   ASSERT_EQ(0u, rules.size());
 }
 
+TEST_F(ContentSettingsStoreTest, GetRuleDisabledExtension) {
+  GURL url("http://www.youtube.com");
+  ContentSettingsPattern pattern = ContentSettingsPattern::FromURL(url);
+  std::string ext_id("my_extension");
+  RegisterExtension(ext_id);
+  store()->SetExtensionContentSetting(
+      ext_id, pattern, pattern, ContentSettingsType::COOKIES,
+      CONTENT_SETTING_ALLOW, ChromeSettingScope::kRegular);
+
+  EXPECT_EQ(CONTENT_SETTING_ALLOW,
+            GetContentSettingFromStore(store(), url, url,
+                                       ContentSettingsType::COOKIES, false));
+
+  // Disable the extension.
+  store()->SetExtensionState(ext_id, false);
+
+  // GetRule should now return CONTENT_SETTING_DEFAULT.
+  EXPECT_EQ(CONTENT_SETTING_DEFAULT,
+            GetContentSettingFromStore(store(), url, url,
+                                       ContentSettingsType::COOKIES, false));
+}
+
+TEST_F(ContentSettingsStoreTest, GetRuleDisabledExtensionIncognito) {
+  GURL url("http://www.youtube.com");
+  ContentSettingsPattern pattern = ContentSettingsPattern::FromURL(url);
+  std::string ext_id("my_extension");
+  RegisterExtension(ext_id);
+
+  // Set incognito setting.
+  store()->SetExtensionContentSetting(
+      ext_id, pattern, pattern, ContentSettingsType::COOKIES,
+      CONTENT_SETTING_ALLOW, ChromeSettingScope::kIncognitoPersistent);
+
+  EXPECT_EQ(CONTENT_SETTING_ALLOW,
+            GetContentSettingFromStore(store(), url, url,
+                                       ContentSettingsType::COOKIES, true));
+
+  // Disable the extension.
+  store()->SetExtensionState(ext_id, false);
+
+  // GetRule should now return CONTENT_SETTING_DEFAULT even for incognito.
+  EXPECT_EQ(CONTENT_SETTING_DEFAULT,
+            GetContentSettingFromStore(store(), url, url,
+                                       ContentSettingsType::COOKIES, true));
+}
+
 TEST_F(ContentSettingsStoreTest, SetFromList) {
   // Force creation of ContentSettingsRegistry, so that the string to content
   // setting type lookup can succeed.
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/extensions/browser/api/content_settings/content_settings_store_unittest.cc b/extensions/browser/api/content_settings/content_settings_store_unittest.cc
index 7beb2c8..d2c50ba 100644
--- a/extensions/browser/api/content_settings/content_settings_store_unittest.cc
+++ b/extensions/browser/api/content_settings/content_settings_store_unittest.cc
@@ -232,6 +232,52 @@
   ASSERT_EQ(0u, rules.size());
 }
 
+TEST_F(ContentSettingsStoreTest, GetRuleDisabledExtension) {
+  GURL url("http://www.youtube.com");
+  ContentSettingsPattern pattern = ContentSettingsPattern::FromURL(url);
+  std::string ext_id("my_extension");
+  RegisterExtension(ext_id);
+  store()->SetExtensionContentSetting(
+      ext_id, pattern, pattern, ContentSettingsType::COOKIES,
+      CONTENT_SETTING_ALLOW, ChromeSettingScope::kRegular);
+
+  EXPECT_EQ(CONTENT_SETTING_ALLOW,
+            GetContentSettingFromStore(store(), url, url,
+                                       ContentSettingsType::COOKIES, false));
+
+  // Disable the extension.
+  store()->SetExtensionState(ext_id, false);
+
+  // GetRule should now return CONTENT_SETTING_DEFAULT.
+  EXPECT_EQ(CONTENT_SETTING_DEFAULT,
+            GetContentSettingFromStore(store(), url, url,
+                                       ContentSettingsType::COOKIES, false));
+}
+
+TEST_F(ContentSettingsStoreTest, GetRuleDisabledExtensionIncognito) {
+  GURL url("http://www.youtube.com");
+  ContentSettingsPattern pattern = ContentSettingsPattern::FromURL(url);
+  std::string ext_id("my_extension");
+  RegisterExtension(ext_id);
+
+  // Set incognito setting.
+  store()->SetExtensionContentSetting(
+      ext_id, pattern, pattern, ContentSettingsType::COOKIES,
+      CONTENT_SETTING_ALLOW, ChromeSettingScope::kIncognitoPersistent);
+
+  EXPECT_EQ(CONTENT_SETTING_ALLOW,
+            GetContentSettingFromStore(store(), url, url,
+                                       ContentSettingsType::COOKIES, true));
+
+  // Disable the extension.
+  store()->SetExtensionState(ext_id, false);
+
+  // GetRule should now return CONTENT_SETTING_DEFAULT even for incognito.
+  EXPECT_EQ(CONTENT_SETTING_DEFAULT,
+            GetContentSettingFromStore(store(), url, url,
+                                       ContentSettingsType::COOKIES, true));
+}
+
 TEST_F(ContentSettingsStoreTest, SetFromList) {
   // Force creation of ContentSettingsRegistry, so that the string to content
   // setting type lookup can succeed.
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
On This Page