Chrome · PageInfo
CVE-2026-13989
Logic Error in PageInfo
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
chrome/browser/ui/views/page_info/web_view_side_panel_view.cc
Patch
From ead7c82b381fb546cb01feb6691c1f304989a796 Mon Sep 17 00:00:00 2001 From: Christian Dullweber <[email protected]> Date: Wed, 20 May 2026 01:31:00 -0700 Subject: [PATCH] PageInfo: Attach delegate and user data to loading indicator Ensure that the loading indicator webview can not be navigated to different URLs. Bug: 514056221 Change-Id: I16d4b9bde16ee1be669bc224011041eec858bb5a Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7859418 Commit-Queue: Christian Dullweber <[email protected]> Reviewed-by: Elias Klim <[email protected]> Cr-Commit-Position: refs/heads/main@{#1633417} --- diff --git a/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc b/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc index 4358c93..278d569 100644 --- a/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc +++ b/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc @@ -68,7 +68,12 @@ loading_indicator_web_view_ = AddChildView(CreateWebView(this, browser_context)); - loading_indicator_web_view_->GetWebContents()->GetController().LoadURL( + auto* loading_contents = loading_indicator_web_view_->GetWebContents(); + loading_contents->SetDelegate(this); + loading_contents->SetUserData( + kWebViewSidePanelWebContentsUserDataKey, + std::make_unique<WebViewSidePanelWebContentsUserData>(AsWeakPtr())); + loading_contents->GetController().LoadURL( GURL(loading_screen_url), content::Referrer(), ui::PAGE_TRANSITION_FROM_API, std::string()); web_view_ = AddChildView(CreateWebView(this, browser_context));
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page