From 12f1c9e50f4a786349339a531891740f78faadae Mon Sep 17 00:00:00 2001
From: Kevin McNee <[email protected]>
Date: Wed, 23 Sep 2026 12:15:42 -0700
Subject: [PATCH] Restrict the use of the find webview tag API in chrome-untrusted

See
https://chromium-review.googlesource.com/c/chromium/src/+/8266642
We now cover the find method as well.

Fixed: 553267541
Change-Id: I16485ad2911f497e72500dcefcaa74a1b6176ed8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8427054
Auto-Submit: Kevin McNee <[email protected]>
Commit-Queue: Rebekah Potter <[email protected]>
Reviewed-by: Alex Moshchuk <[email protected]>
Reviewed-by: Rebekah Potter <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1703656}
---
diff --git a/extensions/browser/api/guest_view/web_view/web_view_internal_api.cc b/extensions/browser/api/guest_view/web_view/web_view_internal_api.cc
index 7e9cbc3f..847de71 100644
--- a/extensions/browser/api/guest_view/web_view/web_view_internal_api.cc
+++ b/extensions/browser/api/guest_view/web_view/web_view_internal_api.cc
@@ -866,6 +866,9 @@
 }
 
 ExtensionFunction::ResponseAction WebViewInternalFindFunction::Run() {
+  EXTENSION_FUNCTION_VALIDATE(
+      !source_url().SchemeIs(content::kChromeUIUntrustedScheme));
+
   std::optional<web_view_internal::Find::Params> params =
       web_view_internal::Find::Params::Create(args());
   EXTENSION_FUNCTION_VALIDATE(params);
diff --git a/extensions/renderer/resources/guest_view/web_view/web_view.js b/extensions/renderer/resources/guest_view/web_view/web_view.js
index 3d19f039..31262ad 100644
--- a/extensions/renderer/resources/guest_view/web_view/web_view.js
+++ b/extensions/renderer/resources/guest_view/web_view/web_view.js
@@ -228,6 +228,18 @@
   return true;
 };
 
+WebViewImpl.prototype.find = function(searchText, options, callback) {
+  if (location.protocol === 'chrome-untrusted:') {
+    throw new Error(
+        WebViewConstants.ERROR_MSG_UNSUPPORTED_API_IN_CHROME_UNTRUSTED);
+  }
+  if (!this.guest.getId()) {
+    return false;
+  }
+  WebViewInternal.find(this.guest.getId(), searchText, options, callback);
+  return true;
+};
+
 WebViewImpl.prototype.setUserAgentOverride = function(userAgentOverride) {
   this.userAgentOverride = userAgentOverride;
   if (!this.guest.getId()) {
diff --git a/tools/typescript/definitions/webview_tag.d.ts b/tools/typescript/definitions/webview_tag.d.ts
index 9cfcf06..0bca928 100644
--- a/tools/typescript/definitions/webview_tag.d.ts
+++ b/tools/typescript/definitions/webview_tag.d.ts
@@ -359,6 +359,9 @@
         captureVisibleRegion(
             options: extensionTypes.ImageDetails|undefined|null,
             callback: (dataUrl: string) => void): void;
+        find(
+            searchText: string, options?: FindOptions,
+            callback?: (results?: FindCallbackResults) => void): void;
       }
 
       export function setAudioMuted(mute: boolean): void;
diff --git a/chrome/test/data/webui/webview/webview_untrusted_test.ts b/chrome/test/data/webui/webview/webview_untrusted_test.ts
index 2ce33ef..94d892f 100644
--- a/chrome/test/data/webui/webview/webview_untrusted_test.ts
+++ b/chrome/test/data/webui/webview/webview_untrusted_test.ts
@@ -40,6 +40,9 @@
     assertThrows(() => {
       webview.loadDataWithBaseUrl('data:text/html,test', 'https://example.com');
     });
+    assertThrows(() => {
+      webview.find('test', {}, () => {});
+    });
   });
 
   test('PermissionRequestAutoDenyInUntrusted', async () => {

diff --git a/chrome/test/data/webui/webview/webview_untrusted_test.ts b/chrome/test/data/webui/webview/webview_untrusted_test.ts
index 2ce33ef..94d892f 100644
--- a/chrome/test/data/webui/webview/webview_untrusted_test.ts
+++ b/chrome/test/data/webui/webview/webview_untrusted_test.ts
@@ -40,6 +40,9 @@
     assertThrows(() => {
       webview.loadDataWithBaseUrl('data:text/html,test', 'https://example.com');
     });
+    assertThrows(() => {
+      webview.find('test', {}, () => {});
+    });
   });
 
   test('PermissionRequestAutoDenyInUntrusted', async () => {