Low chrome Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInsufficient data validation in Chrome for iOS
DescriptionInsufficient data validation in Chrome for iOS
ComponentChrome for iOS
Bug ClassLogic Error
Tracker514015836
Fix commitb5bc8ec2d014 (chromium/src) +4/-1
CISA KEVNot listed
CreditedGoogle
Disclosed2026-06-30

Files Changed

  • ios/web/navigation/navigation_manager_impl.h
  • ios/web/navigation/navigation_manager_impl.mm
From b5bc8ec2d0145e1e59504fbd3ebdcba82df1b296 Mon Sep 17 00:00:00 2001
From: Federica Germinario <[email protected]>
Date: Thu, 21 May 2026 10:00:51 -0700
Subject: [PATCH] [ios] Account for port changes in GetVisibleWebViewOriginURL cache

This change updates the caching mechanism for the visible URL's origin
in GetVisibleWebViewOriginURL to consider the port number.

Previously, the cache only checked the scheme and host. This could lead
to incorrect origin values being returned if the port number changed
while the scheme and host remained the same.

Fixed: 514015836
Change-Id: Ib6aa0da5469ba8a630b81a18055a6645629aeed6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7867751
Auto-Submit: Federica Germinario <[email protected]>
Commit-Queue: Mike Dougherty <[email protected]>
Reviewed-by: Mike Dougherty <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1634372}
---

diff --git a/ios/web/navigation/navigation_manager_impl.h b/ios/web/navigation/navigation_manager_impl.h
index d238e50..ae874b1 100644
--- a/ios/web/navigation/navigation_manager_impl.h
+++ b/ios/web/navigation/navigation_manager_impl.h
@@ -321,6 +321,7 @@
     mutable GURL cached_visible_origin_url_;
     mutable NSString* cached_visible_host_nsstring_;
     mutable NSString* cached_visible_scheme_nsstring_;
+    mutable NSNumber* cached_visible_port_nsnumber_;
 
     std::vector<std::unique_ptr<NavigationItemImpl>> cached_items_;
     int cached_current_item_index_;
diff --git a/ios/web/navigation/navigation_manager_impl.mm b/ios/web/navigation/navigation_manager_impl.mm
index 6323f60d..a4a985b2 100644
--- a/ios/web/navigation/navigation_manager_impl.mm
+++ b/ios/web/navigation/navigation_manager_impl.mm
@@ -1494,12 +1494,14 @@
     // Retain the url to reduce the number of calls to `proxy.URL` which may be
     // very expensive after being called hundreds of time for one navigation.
     NSURL* url = proxy.URL;
-    if (![cached_visible_host_nsstring_ isEqualToString:url.host] ||
+    if (![cached_visible_port_nsnumber_ isEqual:url.port] ||
+        ![cached_visible_host_nsstring_ isEqualToString:url.host] ||
         ![cached_visible_scheme_nsstring_ isEqualToString:url.scheme]) {
       cached_visible_origin_url_ =
           net::GURLWithNSURL(url).DeprecatedGetOriginAsURL();
       cached_visible_host_nsstring_ = url.host;
       cached_visible_scheme_nsstring_ = url.scheme;
+      cached_visible_port_nsnumber_ = url.port;
     }
     return cached_visible_origin_url_;
   }
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.