Chrome · DarkMode
CVE-2026-14110
Logic Error in DarkMode
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
switchthird_party/blink/renderer/core/origin_trials/origin_trial_context.cc |
modified | |
TEST_Fthird_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc |
modified |
Files Changed
third_party/blink/renderer/core/origin_trials/origin_trial_context.ccthird_party/blink/renderer/core/origin_trials/origin_trial_context.hthird_party/blink/renderer/core/origin_trials/origin_trial_context_test.ccthird_party/blink/renderer/platform/runtime_enabled_features.json5third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-header.phpthird_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-meta.html
Patch
From 270816537725f6e59b03bb4ff2e1af30de5d2d3b Mon Sep 17 00:00:00 2001 From: Rune Lillesveen <[email protected]> Date: Thu, 21 May 2026 12:52:02 -0700 Subject: [PATCH] Remove AutoDarkMode origin trial Origin trial ended in 2022. Vulnerability issue dubiously claims this could leak an auto-dark setting to other origins, but regardless this origin trial is not running. Bug: 513698452 Change-Id: I840b5ac7e4b2e685f878d7e346e145473da4df21 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7865166 Reviewed-by: Philip Rogers <[email protected]> Commit-Queue: Rune Lillesveen <[email protected]> Cr-Commit-Position: refs/heads/main@{#1634475} --- diff --git a/third_party/blink/renderer/core/origin_trials/origin_trial_context.cc b/third_party/blink/renderer/core/origin_trials/origin_trial_context.cc index 09d6051..b1c94975 100644 --- a/third_party/blink/renderer/core/origin_trials/origin_trial_context.cc +++ b/third_party/blink/renderer/core/origin_trials/origin_trial_context.cc @@ -444,9 +444,6 @@ } } - if (InstallSettingFeature(document, enabled_feature)) - continue; - InstallPropertiesPerFeature(script_state, enabled_feature); added_binding_features = true; } @@ -454,19 +451,6 @@ return added_binding_features; } -bool OriginTrialContext::InstallSettingFeature( - Document& document, - mojom::blink::OriginTrialFeature enabled_feature) { - switch (enabled_feature) { - case mojom::blink::OriginTrialFeature::kAutoDarkMode: - if (document.GetSettings()) - document.GetSettings()->SetForceDarkModeEnabled(true); - return true; - default: - return false; - } -} - void OriginTrialContext::AddFeature(mojom::blink::OriginTrialFeature feature) { enabled_features_.insert(feature); InitializePendingFeatures(); diff --git a/third_party/blink/renderer/core/origin_trials/origin_trial_context.h b/third_party/blink/renderer/core/origin_trials/origin_trial_context.h index 1d849b67..25c107e4 100644 --- a/third_party/blink/renderer/core/origin_trials/origin_trial_context.h +++ b/third_party/blink/renderer/core/origin_trials/origin_trial_context.h @@ -237,10 +237,6 @@ Document&, ScriptState*); - // Installs a settings feature for the relevant Document instance. Returns - // whether the given OriginTrialFeature describes a setting feature. - bool InstallSettingFeature(Document&, mojom::blink::OriginTrialFeature); - // Caches raw origin trial token along with the parse result to // `trial_results_`. void CacheToken(const String& raw_token, diff --git a/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc b/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc index 3f87eaf..17f4292 100644 --- a/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc +++ b/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc @@ -545,29 +545,6 @@ mojom::blink::OriginTrialFeature::kOriginTrialsSampleAPIImplied)); } -TEST_F(OriginTrialContextTest, SettingFeatureUpdatesDocumentSettings) { - // Create a page holder window/document with an OriginTrialContext. - auto page_holder = std::make_unique<DummyPageHolder>(); - LocalDOMWindow* window = page_holder->GetFrame().DomWindow(); - OriginTrialContext* context = window->GetOriginTrialContext(); - - // Force-disabled the AutoDarkMode feature in the page holder's settings. - ASSERT_TRUE(page_holder->GetDocument().GetSettings()); - page_holder->GetDocument().GetSettings()->SetForceDarkModeEnabled(false); - - // Enable a settings-based origin trial API ("AutoDarkMode"). - context->AddFeature(mojom::blink::OriginTrialFeature::kAutoDarkMode); - EXPECT_TRUE(context->IsFeatureEnabled( - mojom::blink::OriginTrialFeature::kAutoDarkMode)); - - // Expect the AutoDarkMode setting to have been enabled. - EXPECT_TRUE( - page_holder->GetDocument().GetSettings()->GetForceDarkModeEnabled()); - - // TODO(crbug.com/1260410): Switch this test away from using the AutoDarkMode - // feature towards an OriginTrialsSampleAPI* feature. -} - // This test ensures that the feature and token data are correctly mapped. The // assertions mirror the code that is used to send origin trial overrides to the // browser process via RuntimeFeatureStateOverrideContext's IPC. diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5 index aa5e1c67..c9804c1 100644 --- a/third_party/blink/renderer/platform/runtime_enabled_features.json5 +++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5 @@ -759,7 +759,6 @@ { name: "AutoDarkMode", base_feature: "none", - origin_trial_feature_name: "AutoDarkMode", }, { // When enabled, the dark mode filter (Auto Dark / force-dark) skips diff --git a/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-header.php b/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-header.php deleted file mode 100644 index 0a1487e..0000000 --- a/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-header.php +++ /dev/null @@ -1,22 +0,0 @@ -<?php -// Generate token with the command: -// generate_token.py http://127.0.0.1:8000 AutoDarkMode --expire-timestamp=2000000000 - -header("Origin-Trial: AyWCm6J71a4pwPzRIUOrEfpDSlIjoONkqThP5D2UOXaZUutVQAD3RfGQ6VCfkIiwrRSafaB2Pa64M+6g0HHnUg0AAABUeyJvcmlnaW4iOiAiaHR0cDovLzEyNy4wLjAuMTo4MDAwIiwgImZlYXR1cmUiOiAiQXV0b0RhcmtNb2RlIiwgImV4cGlyeSI6IDIwMDAwMDAwMDB9"); -?> -<!doctype html> -<meta charset="utf-8"> -<title>Auto Dark Mode - behavior imposed by the origin trial (HTTP header)</title> -<script src="../../resources/testharness.js"></script> -<script src="../../resources/testharnessreport.js"></script> -<div id="detection" style="background-color: canvas; color-scheme: light"></div> -<script> - test(test => { - // Auto Dark Mode can be detected by adjusted values for system color names, - // such as the "canvas" value used in this example, which defaults to white: - // https://www.w3.org/TR/css-color-4/#valdef-system-color-canvas - assert_not_equals( - getComputedStyle(detection).backgroundColor, 'rgb(255, 255, 255)'); - - }, "The Auto Dark Mode Origin Trial alters coloring of the Web content"); -</script> diff --git a/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-meta.html b/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-meta.html deleted file mode 100644 index 63929cd..0000000 --- a/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-meta.html +++ /dev/null @@ -1,21 +0,0 @@ -<!doctype html> -<meta charset="utf-8"> -<!-- Generate token with the command: -generate_token.py http://127.0.0.1:8000 AutoDarkMode --expire-timestamp=2000000000 --- --> -<meta http-equiv="origin-trial" - content="AyWCm6J71a4pwPzRIUOrEfpDSlIjoONkqThP5D2UOXaZUutVQAD3RfGQ6VCfkIiwrRSafaB2Pa64M+6g0HHnUg0AAABUeyJvcmlnaW4iOiAiaHR0cDovLzEyNy4wLjAuMTo4MDAwIiwgImZlYXR1cmUiOiAiQXV0b0RhcmtNb2RlIiwgImV4cGlyeSI6IDIwMDAwMDAwMDB9" /> -<title>Auto Dark Mode - behavior imposed by the origin trial (meta tag)</title> -<script src="../../resources/testharness.js"></script> -<script src="../../resources/testharnessreport.js"></script> -<div id="detection" style="background-color: canvas; color-scheme: light"></div> -<script> - test(test => { - // Auto Dark Mode can be detected by adjusted values for system color names, - // such as the "canvas" value used in this example, which defaults to white: - // https://www.w3.org/TR/css-color-4/#valdef-system-color-canvas - assert_not_equals( - getComputedStyle(detection).backgroundColor, 'rgb(255, 255, 255)'); - - }, "The Auto Dark Mode Origin Trial alters coloring of the Web content"); -</script>
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc b/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc
index 3f87eaf..17f4292 100644
--- a/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc
+++ b/third_party/blink/renderer/core/origin_trials/origin_trial_context_test.cc
@@ -545,29 +545,6 @@
mojom::blink::OriginTrialFeature::kOriginTrialsSampleAPIImplied));
}
-TEST_F(OriginTrialContextTest, SettingFeatureUpdatesDocumentSettings) {
- // Create a page holder window/document with an OriginTrialContext.
- auto page_holder = std::make_unique<DummyPageHolder>();
- LocalDOMWindow* window = page_holder->GetFrame().DomWindow();
- OriginTrialContext* context = window->GetOriginTrialContext();
-
- // Force-disabled the AutoDarkMode feature in the page holder's settings.
- ASSERT_TRUE(page_holder->GetDocument().GetSettings());
- page_holder->GetDocument().GetSettings()->SetForceDarkModeEnabled(false);
-
- // Enable a settings-based origin trial API ("AutoDarkMode").
- context->AddFeature(mojom::blink::OriginTrialFeature::kAutoDarkMode);
- EXPECT_TRUE(context->IsFeatureEnabled(
- mojom::blink::OriginTrialFeature::kAutoDarkMode));
-
- // Expect the AutoDarkMode setting to have been enabled.
- EXPECT_TRUE(
- page_holder->GetDocument().GetSettings()->GetForceDarkModeEnabled());
-
- // TODO(crbug.com/1260410): Switch this test away from using the AutoDarkMode
- // feature towards an OriginTrialsSampleAPI* feature.
-}
-
// This test ensures that the feature and token data are correctly mapped. The
// assertions mirror the code that is used to send origin trial overrides to the
// browser process via RuntimeFeatureStateOverrideContext's IPC.
diff --git a/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-header.php b/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-header.php
deleted file mode 100644
index 0a1487e..0000000
--- a/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-header.php
+++ /dev/null
@@ -1,22 +0,0 @@
-<?php
-// Generate token with the command:
-// generate_token.py http://127.0.0.1:8000 AutoDarkMode --expire-timestamp=2000000000
-
-header("Origin-Trial: AyWCm6J71a4pwPzRIUOrEfpDSlIjoONkqThP5D2UOXaZUutVQAD3RfGQ6VCfkIiwrRSafaB2Pa64M+6g0HHnUg0AAABUeyJvcmlnaW4iOiAiaHR0cDovLzEyNy4wLjAuMTo4MDAwIiwgImZlYXR1cmUiOiAiQXV0b0RhcmtNb2RlIiwgImV4cGlyeSI6IDIwMDAwMDAwMDB9");
-?>
-<!doctype html>
-<meta charset="utf-8">
-<title>Auto Dark Mode - behavior imposed by the origin trial (HTTP header)</title>
-<script src="../../resources/testharness.js"></script>
-<script src="../../resources/testharnessreport.js"></script>
-<div id="detection" style="background-color: canvas; color-scheme: light"></div>
-<script>
- test(test => {
- // Auto Dark Mode can be detected by adjusted values for system color names,
- // such as the "canvas" value used in this example, which defaults to white:
- // https://www.w3.org/TR/css-color-4/#valdef-system-color-canvas
- assert_not_equals(
- getComputedStyle(detection).backgroundColor, 'rgb(255, 255, 255)');
-
- }, "The Auto Dark Mode Origin Trial alters coloring of the Web content");
-</script>
diff --git a/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-meta.html b/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-meta.html
deleted file mode 100644
index 63929cd..0000000
--- a/third_party/blink/web_tests/http/tests/origin_trials/webexposed/auto-dark-mode-origin-trial-behavior-meta.html
+++ /dev/null
@@ -1,21 +0,0 @@
-<!doctype html>
-<meta charset="utf-8">
-<!-- Generate token with the command:
-generate_token.py http://127.0.0.1:8000 AutoDarkMode --expire-timestamp=2000000000
--- -->
-<meta http-equiv="origin-trial"
- content="AyWCm6J71a4pwPzRIUOrEfpDSlIjoONkqThP5D2UOXaZUutVQAD3RfGQ6VCfkIiwrRSafaB2Pa64M+6g0HHnUg0AAABUeyJvcmlnaW4iOiAiaHR0cDovLzEyNy4wLjAuMTo4MDAwIiwgImZlYXR1cmUiOiAiQXV0b0RhcmtNb2RlIiwgImV4cGlyeSI6IDIwMDAwMDAwMDB9" />
-<title>Auto Dark Mode - behavior imposed by the origin trial (meta tag)</title>
-<script src="../../resources/testharness.js"></script>
-<script src="../../resources/testharnessreport.js"></script>
-<div id="detection" style="background-color: canvas; color-scheme: light"></div>
-<script>
- test(test => {
- // Auto Dark Mode can be detected by adjusted values for system color names,
- // such as the "canvas" value used in this example, which defaults to white:
- // https://www.w3.org/TR/css-color-4/#valdef-system-color-canvas
- assert_not_equals(
- getComputedStyle(detection).backgroundColor, 'rgb(255, 255, 255)');
-
- }, "The Auto Dark Mode Origin Trial alters coloring of the Web content");
-</script>
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page