Low chrome Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInsufficient validation of untrusted input in PopupBlocker
DescriptionInsufficient validation of untrusted input in PopupBlocker
ComponentPopupBlocker
Bug ClassLogic Error
Tracker513188254
Fix commit7e16017eb028 (chromium/src) +20/-4
CISA KEVNot listed
CreditedGoogle
Disclosed2026-06-30

Changed Functions

FunctionChangeNotes
switch
components/blocked_content/popup_blocker.cc
modified

Files Changed

  • components/blocked_content/popup_blocker.cc
From 7e16017eb02859b2c0273571c1369868501e9eca Mon Sep 17 00:00:00 2001
From: Charles Harrison <[email protected]>
Date: Wed, 20 May 2026 17:22:05 -0700
Subject: [PATCH] Enforce popup blocking for split view.

For browser-initiated split views this should be a no-op. Renderer
initiated split views are not launched yet, but this seems reasonable
if/when they do.

This change also refactors ConsiderForPopupBlocking to use a switch
statement, so anyone adding a new WindowOpenDisposition will be forced
to make a decision.

Bug: 513188254

Change-Id: Ia702e698fc4d83695e443fc3f13e5a297648fbe3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7855263
Reviewed-by: Chris Thompson <[email protected]>
Commit-Queue: Charles Harrison <[email protected]>
Reviewed-by: Alison Gale <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1633913}
---

diff --git a/components/blocked_content/popup_blocker.cc b/components/blocked_content/popup_blocker.cc
index 8b12c7dd..9e227da71 100644
--- a/components/blocked_content/popup_blocker.cc
+++ b/components/blocked_content/popup_blocker.cc
@@ -94,10 +94,26 @@
 }  // namespace
 
 bool ConsiderForPopupBlocking(WindowOpenDisposition disposition) {
-  return disposition == WindowOpenDisposition::NEW_POPUP ||
-         disposition == WindowOpenDisposition::NEW_FOREGROUND_TAB ||
-         disposition == WindowOpenDisposition::NEW_BACKGROUND_TAB ||
-         disposition == WindowOpenDisposition::NEW_WINDOW;
+  switch (disposition) {
+    case WindowOpenDisposition::UNKNOWN:
+    case WindowOpenDisposition::CURRENT_TAB:
+    case WindowOpenDisposition::SINGLETON_TAB:
+    // OTR popups would be considered, but they cannot be triggered by any
+    // renderer message so we can ignore them.
+    case WindowOpenDisposition::OFF_THE_RECORD:
+    case WindowOpenDisposition::SAVE_TO_DISK:
+    case WindowOpenDisposition::IGNORE_ACTION:
+    case WindowOpenDisposition::SWITCH_TO_TAB:
+    // TODO(crbug.com/513188254): Support blocking PIP windows.
+    case WindowOpenDisposition::NEW_PICTURE_IN_PICTURE:
+      return false;
+    case WindowOpenDisposition::NEW_POPUP:
+    case WindowOpenDisposition::NEW_FOREGROUND_TAB:
+    case WindowOpenDisposition::NEW_BACKGROUND_TAB:
+    case WindowOpenDisposition::NEW_WINDOW:
+    case WindowOpenDisposition::NEW_SPLIT_VIEW:
+      return true;
+  }
 }
 
 std::unique_ptr<PopupNavigationDelegate> MaybeBlockPopup(
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.