Chrome · Chrome for iOS
CVE-2026-14137
Logic Error in Chrome for iOS
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
components/ui_metrics/canonical_url_share_metrics_types.hios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever.mmios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mmtools/metrics/histograms/metadata/mobile/enums.xml
Patch
From 293f9e2fb3a7e2955f6ca0f554e3112e3d0c749d Mon Sep 17 00:00:00 2001 From: Elmehdi Rahmaoui <[email protected]> Date: Thu, 21 May 2026 02:05:13 -0700 Subject: [PATCH] [iOS] Introduce FAILED_CANONICAL_URL_NOT_HTTP_NOR_HTTPS share metric The aim of this CL is to update the CanonicalURLResult enum and corresponding unit tests to introduce a dedicated failure metric for non-HTTP/HTTPS canonical URLs. Bug: 514070067 Change-Id: I2a8a848648149c8d85f211d920c87d73c20c2458 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7859830 Reviewed-by: Mark Cogan <[email protected]> Reviewed-by: Michael Thiessen <[email protected]> Commit-Queue: Elmehdi Rahmaoui <[email protected]> Reviewed-by: Colin Blundell <[email protected]> Cr-Commit-Position: refs/heads/main@{#1634123} --- diff --git a/components/ui_metrics/canonical_url_share_metrics_types.h b/components/ui_metrics/canonical_url_share_metrics_types.h index 0310e06..6fd8b31 100644 --- a/components/ui_metrics/canonical_url_share_metrics_types.h +++ b/components/ui_metrics/canonical_url_share_metrics_types.h @@ -37,6 +37,10 @@ // (but the visible URL is). SUCCESS_CANONICAL_URL_NOT_HTTPS, + // The canonical URL retrieval failed because the retrieved canonical URL is + // not HTTP nor HTTPS. + FAILED_CANONICAL_URL_NOT_HTTP_NOR_HTTPS, + // The count of canonical URL results. This must be the last item in the enum. CANONICAL_URL_RESULT_COUNT }; diff --git a/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever.mm b/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever.mm index 59627810..aab817c8 100644 --- a/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever.mm +++ b/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever.mm @@ -46,9 +46,13 @@ } else if (!canonical_url.is_valid()) { // Log result if an invalid canonical URL is found. LogCanonicalUrlResultHistogram(ui_metrics::FAILED_CANONICAL_URL_INVALID); + } else if (!canonical_url.SchemeIsHTTPOrHTTPS()) { + // Log result if a canonical URL is not HTTP nor HTTPS. + LogCanonicalUrlResultHistogram( + ui_metrics::FAILED_CANONICAL_URL_NOT_HTTP_NOR_HTTPS); } else { - // If the canonical URL is valid, then the retrieval was successful, - // and the success can be logged. + // If the canonical URL is valid, and HTTP or HTTPS then the retrieval was + // successful, and the success can be logged. LogCanonicalUrlResultHistogram( !canonical_url.SchemeIsCryptographic() ? ui_metrics::SUCCESS_CANONICAL_URL_NOT_HTTPS @@ -57,8 +61,6 @@ : ui_metrics::SUCCESS_CANONICAL_URL_DIFFERENT_FROM_VISIBLE); } - // TODO(crbug.com/514070067): Update the metric, to consider an non HTTP/HTTPS - // canonical_url as failure. return canonical_url.is_valid() && canonical_url.SchemeIsHTTPOrHTTPS() ? canonical_url : GURL(); diff --git a/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mm b/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mm index 88a0d9b8..77893e61 100644 --- a/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mm +++ b/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mm @@ -188,5 +188,5 @@ EXPECT_TRUE(url.is_empty()); histogram_tester_.ExpectUniqueSample( ui_metrics::kCanonicalURLResultHistogram, - ui_metrics::SUCCESS_CANONICAL_URL_NOT_HTTPS, 1); + ui_metrics::FAILED_CANONICAL_URL_NOT_HTTP_NOR_HTTPS, 1); } diff --git a/tools/metrics/histograms/metadata/mobile/enums.xml b/tools/metrics/histograms/metadata/mobile/enums.xml index 9162281..66ad86c 100644 --- a/tools/metrics/histograms/metadata/mobile/enums.xml +++ b/tools/metrics/histograms/metadata/mobile/enums.xml @@ -46,6 +46,9 @@ <int value="6" label="Canonical URL retrieved: Canonical URL not HTTPS (but visible URL is)"/> + <int value="7" + label="Canonical URL not retrieved: Canonical URL not HTTP nor HTTPS + (but visible URL is)"/> </enum> <enum name="ContextMenuIOSCopyImage">
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mm b/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mm
index 88a0d9b8..77893e61 100644
--- a/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mm
+++ b/ios/chrome/browser/sharing/ui_bundled/activity_services/canonical_url_retriever_unittest.mm
@@ -188,5 +188,5 @@
EXPECT_TRUE(url.is_empty());
histogram_tester_.ExpectUniqueSample(
ui_metrics::kCanonicalURLResultHistogram,
- ui_metrics::SUCCESS_CANONICAL_URL_NOT_HTTPS, 1);
+ ui_metrics::FAILED_CANONICAL_URL_NOT_HTTP_NOR_HTTPS, 1);
}
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page