Chrome · CustomTabs
CVE-2026-14046
Logic Error in CustomTabs
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifchrome/android/java/src/org/chromium/chrome/browser/browserservices/PostMessageHandler.java |
modified |
Files Changed
chrome/android/java/src/org/chromium/chrome/browser/browserservices/PostMessageHandler.java
Patch
From b6d22ab493d099081b5c48bdedd9331b264ea815 Mon Sep 17 00:00:00 2001 From: Sinan Sahin <[email protected]> Date: Mon, 18 May 2026 22:46:46 -0700 Subject: [PATCH] [CCT] Fix PostMessage channel init and navigation tracking This CL ensures WebContents is always set and WebContentsObserver is always created during reset. Also, it updates the WebContentsObserver to tear down the channel and resets the verified origin on main-frame navigations. Bug: 497959724 Change-Id: I23ec764237e6e81b2589aa34302a8e53d12f0fbc Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7858190 Commit-Queue: Sinan Sahin <[email protected]> Reviewed-by: Peter Conn <[email protected]> Cr-Commit-Position: refs/heads/main@{#1632631} --- diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browserservices/PostMessageHandler.java b/chrome/android/java/src/org/chromium/chrome/browser/browserservices/PostMessageHandler.java index c9100059..be5a29a 100644 --- a/chrome/android/java/src/org/chromium/chrome/browser/browserservices/PostMessageHandler.java +++ b/chrome/android/java/src/org/chromium/chrome/browser/browserservices/PostMessageHandler.java @@ -109,17 +109,14 @@ // Can't reset with the same web contents twice. if (webContents.equals(mWebContents)) return; mWebContents = webContents; - if (mPostMessageSourceUri == null) return; new WebContentsObserver(webContents) { private boolean mNavigatedOnce; @Override public void didFinishNavigationInPrimaryMainFrame(NavigationHandle navigation) { - if (mNavigatedOnce - && navigation.hasCommitted() - && !navigation.isSameDocument() - && mChannel != null) { + if (mNavigatedOnce && navigation.hasCommitted() && !navigation.isSameDocument()) { observe(null); + mPostMessageSourceUri = null; disconnectChannel(); return; } @@ -137,7 +134,7 @@ Page page, GlobalRenderFrameHostId rfhId, @LifecycleState int rfhLifecycleState) { - if (mChannel != null) { + if (mChannel != null || mPostMessageSourceUri == null) { return; } initializeWithWebContents(webContents);
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page