From e71492a8c1fd59a890167abb56cd6d8ed2b49485 Mon Sep 17 00:00:00 2001
From: Alex Rudenko <[email protected]>
Date: Thu, 21 May 2026 01:57:03 -0700
Subject: [PATCH] Make sure hidden target processed are not marked as unused

Fixed: 513777411
Change-Id: I9d68229a18bdbd51dbf1fb72c9b0d5091e5a573a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7863860
Commit-Queue: Danil Somsikov <[email protected]>
Commit-Queue: Alex Rudenko <[email protected]>
Reviewed-by: Danil Somsikov <[email protected]>
Auto-Submit: Alex Rudenko <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1634121}
---

diff --git a/content/browser/devtools/protocol/hidden_target_manager.cc b/content/browser/devtools/protocol/hidden_target_manager.cc
index c4d80d5..06f3a00 100644
--- a/content/browser/devtools/protocol/hidden_target_manager.cc
+++ b/content/browser/devtools/protocol/hidden_target_manager.cc
@@ -5,6 +5,7 @@
 #include "content/browser/devtools/protocol/hidden_target_manager.h"
 
 #include "content/browser/devtools/web_contents_devtools_agent_host.h"
+#include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_contents.h"
 
 namespace content::protocol {
@@ -25,12 +26,22 @@
       WebContents::Create(create_params);
   // Required for the hidden WebContents to be properly disposed.
   web_contents->SetDelegate(this);
+  // The hidden target hosts a `window.cdp` binding wired to a trusted
+  // browser-level DevTools session (BrowserToPageConnector). Its siteless
+  // about:blank navigation never reaches SetIsUsed(), so the process would
+  // otherwise be treated as a freely-reusable allows-any-site host and
+  // unrelated web content could be co-scheduled with it at the process limit.
+  // Mark the process used so IsSuitableHost() rejects it for sites that
+  // require a dedicated process.
+  web_contents->GetPrimaryMainFrame()->GetProcess()->SetIsUsed();
 
   NavigationController::LoadURLParams load_params(url);
   web_contents->GetController().LoadURLWithParams(load_params);
 
   std::string target_id =
       content::DevToolsAgentHost::GetOrCreateFor(web_contents.get())->GetId();
+  CHECK(!web_contents->GetPrimaryMainFrame()->GetProcess()->IsUnused())
+      << "Hidden target process is unexpectedly unused";
   hidden_web_contents_.insert(std::move(web_contents));
   return target_id;
 }