Chrome · PageInfo
CVE-2026-14065
Logic Error in PageInfo
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifchrome/browser/ui/views/page_info/web_view_side_panel_view.cc |
modified |
Files Changed
chrome/browser/ui/views/page_info/web_view_side_panel_view.cc
Patch
From e19bd0f4858ab20feeaee2cb393d1226cbef90a3 Mon Sep 17 00:00:00 2001 From: Christian Dullweber <[email protected]> Date: Wed, 20 May 2026 07:32:14 -0700 Subject: [PATCH] PageInfo: Properly set initiator origin Ensure that we set the correct initiator for navigations from the ATP webview. Bug: 503617508 Change-Id: Id6d15a10ba4b306e13857cf05a30f02b867f5cf4 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7863753 Reviewed-by: Nicola Tommasi <[email protected]> Commit-Queue: Christian Dullweber <[email protected]> Cr-Commit-Position: refs/heads/main@{#1633586} --- diff --git a/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc b/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc index 278d569..dd708da 100644 --- a/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc +++ b/chrome/browser/ui/views/page_info/web_view_side_panel_view.cc @@ -17,6 +17,8 @@ #include "content/public/browser/browser_thread.h" #include "content/public/browser/navigation_handle.h" #include "content/public/browser/page_navigator.h" +#include "content/public/browser/render_frame_host.h" +#include "content/public/browser/render_process_host.h" #include "content/public/browser/web_contents.h" #include "content/public/common/referrer.h" #include "net/base/url_util.h" @@ -127,8 +129,12 @@ renderer_initiated); // If the navigation is initiated by the renderer process, we must set an // initiator origin. - if (renderer_initiated) { - params.initiator_origin = url::Origin::Create(url); + if (renderer_initiated && source_render_frame_host) { + params.initiator_origin = + source_render_frame_host->GetLastCommittedOrigin(); + params.initiator_frame_token = source_render_frame_host->GetFrameToken(); + params.initiator_process_id = + source_render_frame_host->GetProcess()->GetID().GetUnsafeValue(); } // We can't open a new tab while the observer is running because it might
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page