Chrome · Page Info
CVE-2026-11275
Logic Error in Page Info
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
chrome/android/java/src/org/chromium/chrome/browser/page_info/PageInfoAboutThisSiteController.javachrome/android/javatests/src/org/chromium/chrome/browser/previewtab/PreviewTabTest.javachrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabMediator.javachrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabObserver.java
Patch
From d3fc0e9f1ba34fb766edbcc9b31b7c046e571f14 Mon Sep 17 00:00:00 2001 From: Christian Dullweber <[email protected]> Date: Mon, 13 Apr 2026 09:48:06 -0700 Subject: [PATCH] PageInfo: Set navigation params for AboutThisSite Set isRendererInitiated and initiatorOrigin when moving navigations from the AboutThisSite bottomsheet to a regular tab. Bug: 501763121 Change-Id: Iac830a0f23a835bb11ee4f397be5735135725e3f Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7748619 Reviewed-by: Jinsuk Kim <[email protected]> Commit-Queue: Christian Dullweber <[email protected]> Cr-Commit-Position: refs/heads/main@{#1613799} --- diff --git a/chrome/android/java/src/org/chromium/chrome/browser/page_info/PageInfoAboutThisSiteController.java b/chrome/android/java/src/org/chromium/chrome/browser/page_info/PageInfoAboutThisSiteController.java index cdb3af3..3535761 100644 --- a/chrome/android/java/src/org/chromium/chrome/browser/page_info/PageInfoAboutThisSiteController.java +++ b/chrome/android/java/src/org/chromium/chrome/browser/page_info/PageInfoAboutThisSiteController.java @@ -34,10 +34,12 @@ import org.chromium.components.security_state.ConnectionSecurityLevel; import org.chromium.content_public.browser.BrowserContextHandle; import org.chromium.content_public.browser.LoadUrlParams; +import org.chromium.content_public.browser.NavigationHandle; import org.chromium.content_public.browser.WebContents; import org.chromium.ui.base.PageTransition; import org.chromium.ui.base.ViewUtils; import org.chromium.url.GURL; +import org.chromium.url.Origin; import java.util.function.Supplier; @@ -135,12 +137,16 @@ } @Override - public void onNavigationStarted(GURL clickedUrl) { + public void onNavigationStarted(NavigationHandle navigation) { + GURL clickedUrl = navigation.getUrl(); if (!clickedUrl.equals(originUrl)) { assumeNonNull(mEphemeralTabCoordinator); mEphemeralTabCoordinator.close(); mEphemeralTabCoordinator.removeObserver(this); - openInNewTab(clickedUrl.getSpec()); + openInNewTab( + clickedUrl.getSpec(), + navigation.isRendererInitiated(), + navigation.getInitiatorOrigin()); } } @@ -152,11 +158,17 @@ } private void openInNewTab(String url) { + openInNewTab(url, false, null); + } + + private void openInNewTab( + String url, boolean isRendererInitiated, @Nullable Origin initiatorOrigin) { if (mTabCreator == null) return; + LoadUrlParams params = new LoadUrlParams(url, PageTransition.LINK); + params.setIsRendererInitiated(isRendererInitiated); + params.setInitiatorOrigin(initiatorOrigin); mTabCreator.createNewTab( - new LoadUrlParams(url, PageTransition.LINK), - TabLaunchType.FROM_LINK, - TabUtils.fromWebContents(mWebContents)); + params, TabLaunchType.FROM_LINK, TabUtils.fromWebContents(mWebContents)); } private void setupRow() { diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/previewtab/PreviewTabTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/previewtab/PreviewTabTest.java index d2afa47f..e11611f 100644 --- a/chrome/android/javatests/src/org/chromium/chrome/browser/previewtab/PreviewTabTest.java +++ b/chrome/android/javatests/src/org/chromium/chrome/browser/previewtab/PreviewTabTest.java @@ -38,6 +38,7 @@ import org.chromium.components.browser_ui.bottomsheet.BottomSheetController; import org.chromium.components.browser_ui.bottomsheet.BottomSheetController.SheetState; import org.chromium.components.browser_ui.bottomsheet.BottomSheetTestSupport; +import org.chromium.content_public.browser.NavigationHandle; import org.chromium.content_public.browser.test.util.DOMUtils; import org.chromium.url.GURL; @@ -80,7 +81,7 @@ } @Override - public void onNavigationStarted(GURL clickedUrl) { + public void onNavigationStarted(NavigationHandle navigation) { onNavigationStartedCallback.notifyCalled(); } diff --git a/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabMediator.java b/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabMediator.java index 4f76ce2..0c9e3b6 100644 --- a/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabMediator.java +++ b/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabMediator.java @@ -103,11 +103,11 @@ } /** Notify observers on navigation start. */ - public void onNavigationStarted(GURL clickedUrl) { + public void onNavigationStarted(NavigationHandle navigation) { RewindableIterator<EphemeralTabObserver> observersIterator = mObservers.rewindableIterator(); while (observersIterator.hasNext()) { - observersIterator.next().onNavigationStarted(clickedUrl); + observersIterator.next().onNavigationStarted(navigation); } } @@ -192,7 +192,7 @@ return; } - onNavigationStarted(url); + onNavigationStarted(navigation); mCurrentUrl = url; assumeNonNull(mProfile); diff --git a/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabObserver.java b/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabObserver.java index 1cd3bcb..48223b0c 100644 --- a/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabObserver.java +++ b/chrome/browser/ui/android/ephemeraltab/java/src/org/chromium/chrome/browser/ephemeraltab/EphemeralTabObserver.java @@ -7,6 +7,7 @@ import android.view.ViewGroup; import org.chromium.build.annotations.NullMarked; +import org.chromium.content_public.browser.NavigationHandle; import org.chromium.content_public.browser.WebContents; import org.chromium.url.GURL; @@ -15,7 +16,7 @@ public interface EphemeralTabObserver { default void onToolbarCreated(ViewGroup toolbarView) {} - default void onNavigationStarted(GURL clickedUrl) {} + default void onNavigationStarted(NavigationHandle navigation) {} default void onNavigationFinished(GURL clickedUrl) {}
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page