From 05bf5a2b510c9ba1e4463d5a240dd08fbfe3baa9 Mon Sep 17 00:00:00 2001
From: Fabio Muratori <[email protected]>
Date: Fri, 17 Apr 2026 12:11:03 -0700
Subject: [PATCH] Removed unused methods TabWebContentsDelegateAndroid#openInAppOrChromeFromCct

Method was only used by previous CL to force open a new tab from CCT
when middle click navigation is processed.

Handling this logic here is very problematic because we are skipping all
the policies enforced by ExternalNavigationHandler.

This is the root cause of security vulnerability "Potential silent
external app launch from CCT via OpenURL with NEW_BACKGROUND_TAB".

To prevent further mis-use we should directly remove the method in
TabWebContentsDelegateAndroid.

Bug: 502173136

Remove stale handling of middle click navigations

This is an old attempt at modifyling the middle click navigation flow
and outcome.

Flag was never progressed and this slice is basically deadcode.

On top of this, it has been reported by AI tools that the flag could
enable a vulnerability "Potential silent external app launch from CCT
via OpenURL with NEW_BACKGROUND_TAB"

Bug: 502173136
Change-Id: Ibc931608281e768d93b1654e26d7314a6d0357d4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7770415
Commit-Queue: Fabio Muratori <[email protected]>
Reviewed-by: Calder Kitagawa <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1616749}
---

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabWebContentsDelegateAndroidImpl.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabWebContentsDelegateAndroidImpl.java
index f330da6..27c14cf2 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabWebContentsDelegateAndroidImpl.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabWebContentsDelegateAndroidImpl.java
@@ -4,18 +4,12 @@
 
 package org.chromium.chrome.browser.tab;
 
-import android.app.Activity;
-import android.content.Context;
-import android.content.Intent;
-import android.content.pm.PackageManager;
-import android.content.pm.ResolveInfo;
 import android.graphics.Bitmap;
 import android.graphics.Canvas;
 import android.graphics.PorterDuff;
 import android.graphics.Rect;
 import android.graphics.RectF;
 import android.graphics.drawable.Drawable;
-import android.net.Uri;
 import android.os.Handler;
 import android.view.KeyEvent;
 
@@ -28,7 +22,6 @@
 import org.chromium.base.Callback;
 import org.chromium.base.ContextUtils;
 import org.chromium.base.ObserverList.RewindableIterator;
-import org.chromium.base.PackageManagerUtils;
 import org.chromium.base.lifetime.Destroyable;
 import org.chromium.build.annotations.NullMarked;
 import org.chromium.build.annotations.Nullable;
@@ -38,10 +31,8 @@
 import org.chromium.chrome.browser.app.serial.SerialNotificationService;
 import org.chromium.chrome.browser.app.usb.UsbNotificationService;
 import org.chromium.chrome.browser.bluetooth.BluetoothNotificationManager;
-import org.chromium.chrome.browser.document.ChromeLauncherActivity;
 import org.chromium.chrome.browser.gesturenav.NativePageBitmapCapturer;
 import org.chromium.chrome.browser.media.MediaCaptureNotificationServiceImpl;
-import org.chromium.chrome.browser.multiwindow.MultiWindowUtils;
 import org.chromium.chrome.browser.policy.PolicyAuditor;
 import org.chromium.chrome.browser.policy.PolicyAuditorJni;
 import org.chromium.chrome.browser.serial.SerialNotificationManager;
@@ -188,55 +179,6 @@
         mDelegate.setContentsBounds(source, bounds);
     }
 
-    @CalledByNative
-    @Override
-    protected boolean openInAppOrChromeFromCct(GURL gurl) {
-        Intent intent =
-                new Intent(Intent.ACTION_VIEW, Uri.parse(gurl.getSpec()))
-                        .addCategory(Intent.CATEGORY_BROWSABLE);
-
-        ResolveInfo defaultActivity =
-                PackageManagerUtils.resolveActivity(intent, PackageManager.MATCH_DEFAULT_ONLY);
-
-        if (defaultActivity != null) {
-            // Check if the default activity is a chooser
-            List<ResolveInfo> handlers =
-                    PackageManagerUtils.queryIntentActivities(
-                            intent, PackageManager.GET_RESOLVED_FILTER);
-            for (ResolveInfo handler : handlers) {
-                String packageName = handler.activityInfo.packageName;
-                String activityName = handler.activityInfo.name;
-                if (packageName.equals(defaultActivity.activityInfo.packageName)
-                        && activityName.equals(defaultActivity.activityInfo.name)) {
-                    intent.setClassName(packageName, activityName);
-                    break;
-                }
-            }
-        }
-
-        // Fallback to Chrome if no supporting app was found
-        if (intent.getComponent() == null) {
-            intent.setClass(ContextUtils.getApplicationContext(), ChromeLauncherActivity.class);
-        }
-
-        Context context = mTab.getContext();
-
-        int flags = Intent.FLAG_ACTIVITY_NEW_TASK;
-        // If we're in in multi window it's fine to open multiple instances
-        if (context instanceof Activity
-                && MultiWindowUtils.getInstance().isInMultiWindowMode((Activity) context)) {
-            flags |= Intent.FLAG_ACTIVITY_MULTIPLE_TASK;
-        }
-
-        intent.setFlags(flags);
-        try {
-            context.startActivity(intent);
-            return true;
-        } catch (RuntimeException e) {
-            return false;
-        }
-    }
-
     // WebContentsDelegateAndroid
 
     @Override
diff --git a/chrome/browser/android/tab_web_contents_delegate_android.h b/chrome/browser/android/tab_web_contents_delegate_android.h
index 3b66b56..5c4658e 100644
--- a/chrome/browser/android/tab_web_contents_delegate_android.h
+++ b/chrome/browser/android/tab_web_contents_delegate_android.h
@@ -146,7 +146,6 @@
   bool IsInstalledWebappDelegateGeolocation() const;
   bool IsModalContextMenu() const;
   bool IsDynamicSafeAreaInsetsEnabled() const;
-  bool OpenInAppOrChromeFromCct(GURL url);
 
   void DraggableRegionsChanged(
       const std::vector<blink::mojom::DraggableRegionPtr>& regions,
diff --git a/chrome/browser/tab/java/src/org/chromium/chrome/browser/tab/TabWebContentsDelegateAndroid.java b/chrome/browser/tab/java/src/org/chromium/chrome/browser/tab/TabWebContentsDelegateAndroid.java
index 5593e452c..d26b473 100644
--- a/chrome/browser/tab/java/src/org/chromium/chrome/browser/tab/TabWebContentsDelegateAndroid.java
+++ b/chrome/browser/tab/java/src/org/chromium/chrome/browser/tab/TabWebContentsDelegateAndroid.java
@@ -134,10 +134,6 @@
         return false;
     }
 
-    protected boolean openInAppOrChromeFromCct(GURL gurl) {
-        return false;
-    }
-
     /** Called when WebContents reports a change to the non-draggable regions in header content. */
     protected void nonDraggableRegionsChanged(List<Rect> regions) {}