From ea05b4d61a852ced4b267c7e7207a4148a0ceb9a Mon Sep 17 00:00:00 2001
From: Christian Dullweber <[email protected]>
Date: Thu, 21 May 2026 05:05:22 -0700
Subject: [PATCH] PageInfo: Restrict side panel to google-associated domains

Restrict pageinfo side panel navigations to Google associated domains.
Avoid navigating through an open redirect to a non-Google domain.

Bug: 513866949
Change-Id: Iab2ada6a8d392c8d3ec729dbd1fd433deaf599d7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7865408
Commit-Queue: Christian Dullweber <[email protected]>
Reviewed-by: Nicola Tommasi <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1634189}
---

diff --git a/chrome/browser/page_info/web_view_side_panel_throttle.cc b/chrome/browser/page_info/web_view_side_panel_throttle.cc
index ffda410..49eef07c 100644
--- a/chrome/browser/page_info/web_view_side_panel_throttle.cc
+++ b/chrome/browser/page_info/web_view_side_panel_throttle.cc
@@ -4,6 +4,7 @@
 
 #include "chrome/browser/page_info/web_view_side_panel_throttle.h"
 
+#include "components/google/core/common/google_util.h"
 #include "components/navigation_interception/intercept_navigation_throttle.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/navigation_handle.h"
@@ -25,7 +26,8 @@
   // Server redirects of the observed_url URL are allowed to stay in the
   // SidePanel.
   const GURL& original_url = handle->GetRedirectChain().front();
-  if (handle->WasServerRedirect() && original_url == observed_url) {
+  if (handle->WasServerRedirect() && original_url == observed_url &&
+      google_util::IsGoogleAssociatedDomainUrl(next_url)) {
     return true;
   }
   // Same URL navigations are allowed to stay in the SidePanel.