Low chrome Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInsufficient validation of untrusted input in PageInfo
DescriptionInsufficient validation of untrusted input in PageInfo
ComponentPageInfo
Bug ClassLogic Error
Tracker503617508
Fix commite19bd0f4858a (chromium/src) +8/-2
CISA KEVNot listed
CreditedGoogle
Disclosed2026-06-30

Changed Functions

FunctionChangeNotes
if
chrome/browser/ui/views/page_info/web_view_side_panel_view.cc
modified

Files Changed

  • chrome/browser/ui/views/page_info/web_view_side_panel_view.cc
From e19bd0f4858ab20feeaee2cb393d1226cbef90a3 Mon Sep 17 00:00:00 2001
From: Christian Dullweber <[email protected]>
Date: Wed, 20 May 2026 07:32:14 -0700
Subject: [PATCH] PageInfo: Properly set initiator origin

Ensure that we set the correct initiator for navigations from the ATP
webview.

Bug: 503617508
Change-Id: Id6d15a10ba4b306e13857cf05a30f02b867f5cf4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7863753
Reviewed-by: Nicola Tommasi <[email protected]>
Commit-Queue: Christian Dullweber <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1633586}
---

diff --git a/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc b/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc
index 278d569..dd708da 100644
--- a/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc
+++ b/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc
@@ -17,6 +17,8 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/navigation_handle.h"
 #include "content/public/browser/page_navigator.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/referrer.h"
 #include "net/base/url_util.h"
@@ -127,8 +129,12 @@
                                 renderer_initiated);
   // If the navigation is initiated by the renderer process, we must set an
   // initiator origin.
-  if (renderer_initiated) {
-    params.initiator_origin = url::Origin::Create(url);
+  if (renderer_initiated && source_render_frame_host) {
+    params.initiator_origin =
+        source_render_frame_host->GetLastCommittedOrigin();
+    params.initiator_frame_token = source_render_frame_host->GetFrameToken();
+    params.initiator_process_id =
+        source_render_frame_host->GetProcess()->GetID().GetUnsafeValue();
   }
 
   // We can't open a new tab while the observer is running because it might
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.