Chrome · Chrome for iOS
CVE-2026-14128
Logic Error in Chrome for iOS
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
ios/web/navigation/navigation_manager_impl.hios/web/navigation/navigation_manager_impl.mm
Patch
From b5bc8ec2d0145e1e59504fbd3ebdcba82df1b296 Mon Sep 17 00:00:00 2001 From: Federica Germinario <[email protected]> Date: Thu, 21 May 2026 10:00:51 -0700 Subject: [PATCH] [ios] Account for port changes in GetVisibleWebViewOriginURL cache This change updates the caching mechanism for the visible URL's origin in GetVisibleWebViewOriginURL to consider the port number. Previously, the cache only checked the scheme and host. This could lead to incorrect origin values being returned if the port number changed while the scheme and host remained the same. Fixed: 514015836 Change-Id: Ib6aa0da5469ba8a630b81a18055a6645629aeed6 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7867751 Auto-Submit: Federica Germinario <[email protected]> Commit-Queue: Mike Dougherty <[email protected]> Reviewed-by: Mike Dougherty <[email protected]> Cr-Commit-Position: refs/heads/main@{#1634372} --- diff --git a/ios/web/navigation/navigation_manager_impl.h b/ios/web/navigation/navigation_manager_impl.h index d238e50..ae874b1 100644 --- a/ios/web/navigation/navigation_manager_impl.h +++ b/ios/web/navigation/navigation_manager_impl.h @@ -321,6 +321,7 @@ mutable GURL cached_visible_origin_url_; mutable NSString* cached_visible_host_nsstring_; mutable NSString* cached_visible_scheme_nsstring_; + mutable NSNumber* cached_visible_port_nsnumber_; std::vector<std::unique_ptr<NavigationItemImpl>> cached_items_; int cached_current_item_index_; diff --git a/ios/web/navigation/navigation_manager_impl.mm b/ios/web/navigation/navigation_manager_impl.mm index 6323f60d..a4a985b2 100644 --- a/ios/web/navigation/navigation_manager_impl.mm +++ b/ios/web/navigation/navigation_manager_impl.mm @@ -1494,12 +1494,14 @@ // Retain the url to reduce the number of calls to `proxy.URL` which may be // very expensive after being called hundreds of time for one navigation. NSURL* url = proxy.URL; - if (![cached_visible_host_nsstring_ isEqualToString:url.host] || + if (![cached_visible_port_nsnumber_ isEqual:url.port] || + ![cached_visible_host_nsstring_ isEqualToString:url.host] || ![cached_visible_scheme_nsstring_ isEqualToString:url.scheme]) { cached_visible_origin_url_ = net::GURLWithNSURL(url).DeprecatedGetOriginAsURL(); cached_visible_host_nsstring_ = url.host; cached_visible_scheme_nsstring_ = url.scheme; + cached_visible_port_nsnumber_ = url.port; } return cached_visible_origin_url_; }
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page