Medium chrome Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInsufficient policy enforcement in PageInfo
DescriptionInsufficient policy enforcement in PageInfo
ComponentPageInfo
Bug ClassLogic Error
Tracker514056221
Fix commitead7c82b381f (chromium/src) +6/-1
CISA KEVNot listed
CreditedGoogle
Disclosed2026-06-30

Files Changed

  • chrome/browser/ui/views/page_info/web_view_side_panel_view.cc
From ead7c82b381fb546cb01feb6691c1f304989a796 Mon Sep 17 00:00:00 2001
From: Christian Dullweber <[email protected]>
Date: Wed, 20 May 2026 01:31:00 -0700
Subject: [PATCH] PageInfo: Attach delegate and user data to loading indicator

Ensure that the loading indicator webview can not be navigated to
different URLs.

Bug: 514056221
Change-Id: I16d4b9bde16ee1be669bc224011041eec858bb5a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7859418
Commit-Queue: Christian Dullweber <[email protected]>
Reviewed-by: Elias Klim <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1633417}
---

diff --git a/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc b/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc
index 4358c93..278d569 100644
--- a/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc
+++ b/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc
@@ -68,7 +68,12 @@
 
   loading_indicator_web_view_ =
       AddChildView(CreateWebView(this, browser_context));
-  loading_indicator_web_view_->GetWebContents()->GetController().LoadURL(
+  auto* loading_contents = loading_indicator_web_view_->GetWebContents();
+  loading_contents->SetDelegate(this);
+  loading_contents->SetUserData(
+      kWebViewSidePanelWebContentsUserDataKey,
+      std::make_unique<WebViewSidePanelWebContentsUserData>(AsWeakPtr()));
+  loading_contents->GetController().LoadURL(
       GURL(loading_screen_url), content::Referrer(),
       ui::PAGE_TRANSITION_FROM_API, std::string());
   web_view_ = AddChildView(CreateWebView(this, browser_context));
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.