Chrome · PopupBlocker
CVE-2026-14089
Logic Error in PopupBlocker
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
switchcomponents/blocked_content/popup_blocker.cc |
modified |
Files Changed
components/blocked_content/popup_blocker.cc
Patch
From 7e16017eb02859b2c0273571c1369868501e9eca Mon Sep 17 00:00:00 2001 From: Charles Harrison <[email protected]> Date: Wed, 20 May 2026 17:22:05 -0700 Subject: [PATCH] Enforce popup blocking for split view. For browser-initiated split views this should be a no-op. Renderer initiated split views are not launched yet, but this seems reasonable if/when they do. This change also refactors ConsiderForPopupBlocking to use a switch statement, so anyone adding a new WindowOpenDisposition will be forced to make a decision. Bug: 513188254 Change-Id: Ia702e698fc4d83695e443fc3f13e5a297648fbe3 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7855263 Reviewed-by: Chris Thompson <[email protected]> Commit-Queue: Charles Harrison <[email protected]> Reviewed-by: Alison Gale <[email protected]> Cr-Commit-Position: refs/heads/main@{#1633913} --- diff --git a/components/blocked_content/popup_blocker.cc b/components/blocked_content/popup_blocker.cc index 8b12c7dd..9e227da71 100644 --- a/components/blocked_content/popup_blocker.cc +++ b/components/blocked_content/popup_blocker.cc @@ -94,10 +94,26 @@ } // namespace bool ConsiderForPopupBlocking(WindowOpenDisposition disposition) { - return disposition == WindowOpenDisposition::NEW_POPUP || - disposition == WindowOpenDisposition::NEW_FOREGROUND_TAB || - disposition == WindowOpenDisposition::NEW_BACKGROUND_TAB || - disposition == WindowOpenDisposition::NEW_WINDOW; + switch (disposition) { + case WindowOpenDisposition::UNKNOWN: + case WindowOpenDisposition::CURRENT_TAB: + case WindowOpenDisposition::SINGLETON_TAB: + // OTR popups would be considered, but they cannot be triggered by any + // renderer message so we can ignore them. + case WindowOpenDisposition::OFF_THE_RECORD: + case WindowOpenDisposition::SAVE_TO_DISK: + case WindowOpenDisposition::IGNORE_ACTION: + case WindowOpenDisposition::SWITCH_TO_TAB: + // TODO(crbug.com/513188254): Support blocking PIP windows. + case WindowOpenDisposition::NEW_PICTURE_IN_PICTURE: + return false; + case WindowOpenDisposition::NEW_POPUP: + case WindowOpenDisposition::NEW_FOREGROUND_TAB: + case WindowOpenDisposition::NEW_BACKGROUND_TAB: + case WindowOpenDisposition::NEW_WINDOW: + case WindowOpenDisposition::NEW_SPLIT_VIEW: + return true; + } } std::unique_ptr<PopupNavigationDelegate> MaybeBlockPopup(
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page