Chrome · Printing
CVE-2026-14127
Logic Error in Printing
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifchrome/browser/printing/print_view_manager.cc |
modified |
Files Changed
android_webview/browser/aw_print_manager.ccchrome/browser/printing/print_view_manager.ccchrome/browser/printing/print_view_manager_base.cc
Patch
From e863db912b0f3377879fb2c40b18b5713d7cc65b Mon Sep 17 00:00:00 2001 From: Lei Zhang <[email protected]> Date: Mon, 01 Jun 2026 10:58:34 -0700 Subject: [PATCH] Printing: Check for inactive RFHs when handling more printing requests Since only active RFHs should show UI elements, reject printing requests from inactive RFHs in PrintViewManagerBase::ScriptedPrint(). Update AwPrintManager::ScriptedPrint() for consistency. In PrintViewManager::OnScriptedPrintPreviewCallback(), add the same check as well. Bug: 514009654, 516508002 Change-Id: I765c4d67d7e08e677dc742720df4e23d4a4c6877 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7884711 Reviewed-by: Bo Liu <[email protected]> Commit-Queue: Lei Zhang <[email protected]> Cr-Commit-Position: refs/heads/main@{#1639521} --- diff --git a/android_webview/browser/aw_print_manager.cc b/android_webview/browser/aw_print_manager.cc index 2abbd97..873f779 100644 --- a/android_webview/browser/aw_print_manager.cc +++ b/android_webview/browser/aw_print_manager.cc @@ -113,8 +113,15 @@ ScriptedPrintCallback callback) { DCHECK_CURRENTLY_ON(content::BrowserThread::UI); + content::RenderFrameHost* render_frame_host = GetCurrentTargetFrame(); + if (!render_frame_host->IsActive()) { + // Only active RFHs should try to print. + std::move(callback).Run(nullptr); + return; + } + if (scripted_params->is_scripted && - GetCurrentTargetFrame()->IsNestedWithinFencedFrame()) { + render_frame_host->IsNestedWithinFencedFrame()) { DLOG(ERROR) << "Unexpected message received. Script Print is not allowed" " in a fenced frame."; std::move(callback).Run(nullptr); diff --git a/chrome/browser/printing/print_view_manager.cc b/chrome/browser/printing/print_view_manager.cc index e650cb2..36d4122 100644 --- a/chrome/browser/printing/print_view_manager.cc +++ b/chrome/browser/printing/print_view_manager.cc @@ -561,7 +561,7 @@ DCHECK(print_preview_rfh_); auto* rfh = content::RenderFrameHost::FromID(rfh_id); - if (!rfh || rfh != print_preview_rfh_) { + if (!rfh || rfh != print_preview_rfh_ || !print_preview_rfh_->IsActive()) { return; } diff --git a/chrome/browser/printing/print_view_manager_base.cc b/chrome/browser/printing/print_view_manager_base.cc index af02a63..02e10bb 100644 --- a/chrome/browser/printing/print_view_manager_base.cc +++ b/chrome/browser/printing/print_view_manager_base.cc @@ -620,6 +620,12 @@ DCHECK_CURRENTLY_ON(content::BrowserThread::UI); content::RenderFrameHost* render_frame_host = GetCurrentTargetFrame(); + if (!render_frame_host->IsActive()) { + // Only active RFHs should show UI elements. + std::move(callback).Run(nullptr); + return; + } + content::RenderProcessHost* render_process_host = render_frame_host->GetProcess(); if (params->is_scripted && render_frame_host->IsNestedWithinFencedFrame()) {
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page