Low chrome Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInsufficient policy enforcement in HID
DescriptionInsufficient policy enforcement in HID
ComponentHID
Bug ClassLogic Error
Tracker513169718
Fix commitada330bc2b00 (chromium/src) +1/-0
CISA KEVNot listed
CreditedGoogle
Disclosed2026-06-30

Files Changed

  • services/device/public/cpp/hid/hid_blocklist.cc
From ada330bc2b0043c793c055732581c8ebdc1badd7 Mon Sep 17 00:00:00 2001
From: Andrew Paseltiner <[email protected]>
Date: Tue, 26 May 2026 05:28:11 -0700
Subject: [PATCH] Call PopulateWithServerProvidedValues in HidBlocklist constructor

PopulateWithServerProvidedValues was only called in
ResetToDefaultValuesForTest, which seems to have been an oversight in
crrev.com/c/2587797. This meant that server-side additions to the WebHID
blocklist were never loaded in production builds.

Bug: 40135068
Change-Id: Ida332d9cbe2c5221198b6e2f3afebf838c37c64b
Fixed: 513169718
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7850315
Reviewed-by: Matt Reynolds <[email protected]>
Commit-Queue: Andrew Paseltiner <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1636097}
---

diff --git a/services/device/public/cpp/hid/hid_blocklist.cc b/services/device/public/cpp/hid/hid_blocklist.cc
index 9943cdc12..74b6ea69 100644
--- a/services/device/public/cpp/hid/hid_blocklist.cc
+++ b/services/device/public/cpp/hid/hid_blocklist.cc
@@ -397,6 +397,7 @@
   for (const auto& entry : kStaticEntries)
     DCHECK(IsValidBlocklistEntry(entry));
 #endif
+  PopulateWithServerProvidedValues();
 }
 
 }  // namespace device
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.