Chrome · Tab Strip
CVE-2026-11222
Logic Error in Tab Strip
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifchrome/browser/ui/views/tabs/hovercard/hover_card_anchor_target.cc |
modified |
Files Changed
AUTHORSchrome/browser/ui/views/frame/multi_contents_view_mini_toolbar.ccchrome/browser/ui/views/tabs/hovercard/hover_card_anchor_target.cc
Patch
From 4565bd201d41b752c3a5df16298d8d0470e75dbd Mon Sep 17 00:00:00 2001 From: Hafiizh <[email protected]> Date: Mon, 04 May 2026 09:20:30 -0700 Subject: [PATCH] hovercard: Fix hover card domain label for about:blank tabs Previously, the hover card domain label for about:blank tabs was not handled explicitly, which could cause incorrect domain text to be displayed. This patch adds an explicit check for about:blank URLs and sets the domain label to url::kAboutBlankURL16 accordingly. Bug: 458442542 Change-Id: Ib34c977395919b5c6e7b89cc424867922452aa0f Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7761368 Commit-Queue: Alison Gale <[email protected]> Auto-Submit: Bug Bounty Channel <[email protected]> Reviewed-by: Foromo Daniel Soromou <[email protected]> Reviewed-by: Alison Gale <[email protected]> Cr-Commit-Position: refs/heads/main@{#1624740} --- diff --git a/AUTHORS b/AUTHORS index ef9340c..3649262 100644 --- a/AUTHORS +++ b/AUTHORS @@ -541,6 +541,7 @@ Habib Virji <[email protected]> Haeun Kim <[email protected]> Haeun Kim <[email protected]> +Hafiizh <[email protected]> Haitao Feng <[email protected]> Halley Zhao <[email protected]> Halton Huo <[email protected]> diff --git a/chrome/browser/ui/views/frame/multi_contents_view_mini_toolbar.cc b/chrome/browser/ui/views/frame/multi_contents_view_mini_toolbar.cc index c2fc4be7..7c4f533d 100644 --- a/chrome/browser/ui/views/frame/multi_contents_view_mini_toolbar.cc +++ b/chrome/browser/ui/views/frame/multi_contents_view_mini_toolbar.cc @@ -49,6 +49,7 @@ #include "ui/views/layout/flex_layout.h" #include "ui/views/view.h" #include "ui/views/view_utils.h" +#include "url/url_constants.h" namespace { constexpr int kMiniToolbarContentPadding = 4; @@ -190,6 +191,8 @@ domain = l10n_util::GetStringUTF16(IDS_HOVER_CARD_BLOB_URL_SOURCE); } else if (domain_url.SchemeIs(url::kViewSourceScheme)) { domain = l10n_util::GetStringUTF16(IDS_HOVER_CARD_VIEW_SOURCE_URL_SOURCE); + } else if (domain_url.IsAboutBlank()) { + domain = url::kAboutBlankURL16; } else if (tab_ui_helper->ShouldDisplayURL()) { domain = url_formatter::FormatUrl( domain_url, diff --git a/chrome/browser/ui/views/tabs/hovercard/hover_card_anchor_target.cc b/chrome/browser/ui/views/tabs/hovercard/hover_card_anchor_target.cc index 334cd58..70f7cd00 100644 --- a/chrome/browser/ui/views/tabs/hovercard/hover_card_anchor_target.cc +++ b/chrome/browser/ui/views/tabs/hovercard/hover_card_anchor_target.cc @@ -21,6 +21,7 @@ #include "ui/base/interaction/element_tracker.h" #include "ui/base/l10n/l10n_util.h" #include "ui/views/view.h" +#include "url/url_constants.h" namespace { @@ -103,6 +104,8 @@ domain = l10n_util::GetStringUTF16(IDS_HOVER_CARD_BLOB_URL_SOURCE); } else if (domain_url.SchemeIs(url::kViewSourceScheme)) { domain = l10n_util::GetStringUTF16(IDS_HOVER_CARD_VIEW_SOURCE_URL_SOURCE); + } else if (domain_url.IsAboutBlank()) { + domain = url::kAboutBlankURL16; } else { if (tab_data.should_display_url) { is_domain_url = true;
Loading diff…
Original Bug Report
reported by [email protected]
Popup window tab doesn't show the origin correctly
VULNERABILITY DETAILS
This vulnerability is similar to this: https://issues.chromium.org/issues/40075024, https://issues.chromium.org/issues/448421954
but in this bug Popup window tab doesn’t show correctly. in the popup window it shows subdomain.paypal.auth.docs.google.com which should be about:blank
VERSION Chrome Version 144.0.7513.0 (Official Build) canary (64-bit) Operating System: Windows 11
REPRODUCTION CASE
- Open tabdomain.html
- Click on button in tabdomain.html
- Hover over the tab
References
On This Page