Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactIncorrect security UI in Tab Strip
DescriptionIncorrect security UI in Tab Strip
ComponentTab Strip
Bug ClassLogic Error
Tracker458442542
Fix commit4565bd201d41 (chromium/src) +7/-0
CISA KEVNot listed
CreditedHafiizh
Disclosed2026-06-02

Changed Functions

FunctionChangeNotes
if
chrome/browser/ui/views/tabs/hovercard/hover_card_anchor_target.cc
modified

Files Changed

  • AUTHORS
  • chrome/browser/ui/views/frame/multi_contents_view_mini_toolbar.cc
  • chrome/browser/ui/views/tabs/hovercard/hover_card_anchor_target.cc
From 4565bd201d41b752c3a5df16298d8d0470e75dbd Mon Sep 17 00:00:00 2001
From: Hafiizh <[email protected]>
Date: Mon, 04 May 2026 09:20:30 -0700
Subject: [PATCH] hovercard: Fix hover card domain label for about:blank tabs

Previously, the hover card domain label for about:blank tabs was not
handled explicitly, which could cause incorrect domain text to be
displayed. This patch adds an explicit check for about:blank URLs and
sets the domain label to url::kAboutBlankURL16 accordingly.

Bug: 458442542
Change-Id: Ib34c977395919b5c6e7b89cc424867922452aa0f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7761368
Commit-Queue: Alison Gale <[email protected]>
Auto-Submit: Bug Bounty Channel <[email protected]>
Reviewed-by: Foromo Daniel Soromou <[email protected]>
Reviewed-by: Alison Gale <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1624740}
---

diff --git a/AUTHORS b/AUTHORS
index ef9340c..3649262 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -541,6 +541,7 @@
 Habib Virji <[email protected]>
 Haeun Kim <[email protected]>
 Haeun Kim <[email protected]>
+Hafiizh <[email protected]>
 Haitao Feng <[email protected]>
 Halley Zhao <[email protected]>
 Halton Huo <[email protected]>
diff --git a/chrome/browser/ui/views/frame/multi_contents_view_mini_toolbar.cc b/chrome/browser/ui/views/frame/multi_contents_view_mini_toolbar.cc
index c2fc4be7..7c4f533d 100644
--- a/chrome/browser/ui/views/frame/multi_contents_view_mini_toolbar.cc
+++ b/chrome/browser/ui/views/frame/multi_contents_view_mini_toolbar.cc
@@ -49,6 +49,7 @@
 #include "ui/views/layout/flex_layout.h"
 #include "ui/views/view.h"
 #include "ui/views/view_utils.h"
+#include "url/url_constants.h"
 
 namespace {
 constexpr int kMiniToolbarContentPadding = 4;
@@ -190,6 +191,8 @@
     domain = l10n_util::GetStringUTF16(IDS_HOVER_CARD_BLOB_URL_SOURCE);
   } else if (domain_url.SchemeIs(url::kViewSourceScheme)) {
     domain = l10n_util::GetStringUTF16(IDS_HOVER_CARD_VIEW_SOURCE_URL_SOURCE);
+  } else if (domain_url.IsAboutBlank()) {
+    domain = url::kAboutBlankURL16;
   } else if (tab_ui_helper->ShouldDisplayURL()) {
     domain = url_formatter::FormatUrl(
         domain_url,
diff --git a/chrome/browser/ui/views/tabs/hovercard/hover_card_anchor_target.cc b/chrome/browser/ui/views/tabs/hovercard/hover_card_anchor_target.cc
index 334cd58..70f7cd00 100644
--- a/chrome/browser/ui/views/tabs/hovercard/hover_card_anchor_target.cc
+++ b/chrome/browser/ui/views/tabs/hovercard/hover_card_anchor_target.cc
@@ -21,6 +21,7 @@
 #include "ui/base/interaction/element_tracker.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/views/view.h"
+#include "url/url_constants.h"
 
 namespace {
 
@@ -103,6 +104,8 @@
     domain = l10n_util::GetStringUTF16(IDS_HOVER_CARD_BLOB_URL_SOURCE);
   } else if (domain_url.SchemeIs(url::kViewSourceScheme)) {
     domain = l10n_util::GetStringUTF16(IDS_HOVER_CARD_VIEW_SOURCE_URL_SOURCE);
+  } else if (domain_url.IsAboutBlank()) {
+    domain = url::kAboutBlankURL16;
   } else {
     if (tab_data.should_display_url) {
       is_domain_url = true;
Loading diff…

Original Bug Report

reported by [email protected]

Popup window tab doesn't show the origin correctly

VULNERABILITY DETAILS

This vulnerability is similar to this: https://issues.chromium.org/issues/40075024, https://issues.chromium.org/issues/448421954

but in this bug Popup window tab doesn’t show correctly. in the popup window it shows subdomain.paypal.auth.docs.google.com which should be about:blank

VERSION Chrome Version 144.0.7513.0 (Official Build) canary (64-bit) Operating System: Windows 11

REPRODUCTION CASE

  1. Open tabdomain.html
  2. Click on button in tabdomain.html
  3. Hover over the tab
View on issue tracker