From c00f71e462202e10d4b20c679a1947e1a7871619 Mon Sep 17 00:00:00 2001
From: Ted Choc <[email protected]>
Date: Thu, 21 May 2026 09:43:46 -0700
Subject: [PATCH] Ensure text suggestion requests come from a user action.

Ensure the "add to dictionary" intent targets a system installed
package to avoid malicious spoofing of the intent.

Bug: 513532778
Change-Id: Ic712e905ed8f5d0170f45a437d6a62730dc6bc43
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7866243
Reviewed-by: Bo Liu <[email protected]>
Commit-Queue: Ted Choc <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1634355}
---

diff --git a/content/browser/android/text_suggestion_host_android.cc b/content/browser/android/text_suggestion_host_android.cc
index c477597f..a44fa423 100644
--- a/content/browser/android/text_suggestion_host_android.cc
+++ b/content/browser/android/text_suggestion_host_android.cc
@@ -124,6 +124,10 @@
     return;
   }
 
+  if (!render_frame_host().HasTransientUserActivation()) {
+    return;
+  }
+
   JNIEnv* env = AttachCurrentThread();
   Java_TextSuggestionPopupController_showSpellCheckSuggestionMenu(
       env, web_contents->GetJavaWebContents(), reinterpret_cast<intptr_t>(this),
@@ -142,6 +146,10 @@
     return;
   }
 
+  if (!render_frame_host().HasTransientUserActivation()) {
+    return;
+  }
+
   JNIEnv* env = AttachCurrentThread();
 
   // Enforce kMaxNumberOfSuggestions here in case the renderer is hijacked and
@@ -169,6 +177,9 @@
 
 void TextSuggestionHostAndroid::StartSuggestionMenuTimer() {
   suggestion_menu_timeout_.Stop();
+  if (!render_frame_host().HasTransientUserActivation()) {
+    return;
+  }
   suggestion_menu_timeout_.Start(
       base::Milliseconds(gfx::ViewConfiguration::GetDoubleTapTimeoutInMs()));
 }
diff --git a/content/public/android/java/src/org/chromium/content/browser/input/SuggestionsPopupWindow.java b/content/public/android/java/src/org/chromium/content/browser/input/SuggestionsPopupWindow.java
index 6fc1c75..96e29b1 100644
--- a/content/public/android/java/src/org/chromium/content/browser/input/SuggestionsPopupWindow.java
+++ b/content/public/android/java/src/org/chromium/content/browser/input/SuggestionsPopupWindow.java
@@ -9,6 +9,8 @@
 import android.app.Activity;
 import android.content.Context;
 import android.content.Intent;
+import android.content.pm.ApplicationInfo;
+import android.content.pm.ResolveInfo;
 import android.graphics.Rect;
 import android.text.SpannableString;
 import android.util.DisplayMetrics;
@@ -26,6 +28,7 @@
 import android.widget.TextView;
 
 import org.chromium.base.ApiCompatibilityUtils;
+import org.chromium.base.PackageManagerUtils;
 import org.chromium.build.annotations.NullMarked;
 import org.chromium.build.annotations.Nullable;
 import org.chromium.build.annotations.RequiresNonNull;
@@ -187,7 +190,18 @@
         String wordToAdd = mHighlightedText;
         intent.putExtra(USER_DICTIONARY_EXTRA_WORD, wordToAdd);
         intent.setFlags(intent.getFlags() | Intent.FLAG_ACTIVITY_NEW_TASK);
-        mContext.startActivity(intent);
+
+        ResolveInfo resolveInfo = PackageManagerUtils.resolveActivity(intent, 0);
+        if (resolveInfo != null
+                && resolveInfo.activityInfo != null
+                && resolveInfo.activityInfo.applicationInfo != null) {
+            int flags = resolveInfo.activityInfo.applicationInfo.flags;
+            if ((flags & (ApplicationInfo.FLAG_SYSTEM | ApplicationInfo.FLAG_UPDATED_SYSTEM_APP))
+                    != 0) {
+                intent.setPackage(resolveInfo.activityInfo.packageName);
+                mContext.startActivity(intent);
+            }
+        }
     }
 
     private class SuggestionAdapter extends BaseAdapter {