Low chrome Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInappropriate implementation in TabStrip
DescriptionInappropriate implementation in TabStrip
ComponentTabStrip
Bug ClassLogic Error
Tracker514072495
Fix commit4581e656cbd9 (chromium/src) +13/-0
CISA KEVNot listed
CreditedGoogle
Disclosed2026-06-30

Files Changed

  • chrome/browser/ui/tabs/public/tab_dialog_manager.h
  • chrome/browser/ui/tabs/tab_dialog_manager.cc
From 4581e656cbd9ebd9c2d8aa09aede6dfb2a6da1c8 Mon Sep 17 00:00:00 2001
From: Steven Luong <[email protected]>
Date: Tue, 26 May 2026 13:21:53 -0700
Subject: [PATCH] Update TabDialogManager web contents observation on discard

The TabDialogManager was originally inheriting from WebContentsObserver
to observe the web contents for its corresponding tab. However, the
web contents can change upon discard and the manager didn't account for
observing the new contents. This CL updates the
TabDialogManger so that it will observe the correct web contents after
it's tab has discarded.

Fixed: 514072495
Change-Id: I324afd9b792b4d5d665841e35dd972a1a0179c0d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7872106
Reviewed-by: Alison Gale <[email protected]>
Commit-Queue: Steven Luong <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1636446}
---

diff --git a/chrome/browser/ui/tabs/public/tab_dialog_manager.h b/chrome/browser/ui/tabs/public/tab_dialog_manager.h
index 271fc1b..c3f679d9 100644
--- a/chrome/browser/ui/tabs/public/tab_dialog_manager.h
+++ b/chrome/browser/ui/tabs/public/tab_dialog_manager.h
@@ -167,6 +167,9 @@
   void TabWillEnterBackground(TabInterface* tab_interface);
   void TabWillDetach(TabInterface* tab_interface,
                      TabInterface::DetachReason reason);
+  void OnDiscardContents(TabInterface* tab,
+                         content::WebContents* old_contents,
+                         content::WebContents* new_contents);
 
   bool GetDialogWidgetVisibility();
 
diff --git a/chrome/browser/ui/tabs/tab_dialog_manager.cc b/chrome/browser/ui/tabs/tab_dialog_manager.cc
index 1a68051..7f2c85a 100644
--- a/chrome/browser/ui/tabs/tab_dialog_manager.cc
+++ b/chrome/browser/ui/tabs/tab_dialog_manager.cc
@@ -294,6 +294,9 @@
   tab_subscriptions_.push_back(
       tab_interface_->RegisterWillDetach(base::BindRepeating(
           &TabDialogManager::TabWillDetach, base::Unretained(this))));
+  tab_subscriptions_.push_back(
+      tab_interface->RegisterWillDiscardContents(base::BindRepeating(
+          &TabDialogManager::OnDiscardContents, base::Unretained(this))));
 }
 
 TabDialogManager::~TabDialogManager() = default;
@@ -562,6 +565,13 @@
   }
 }
 
+void TabDialogManager::OnDiscardContents(TabInterface* tab,
+                                         content::WebContents* old_contents,
+                                         content::WebContents* new_contents) {
+  CHECK_EQ(tab, tab_interface_);
+  Observe(new_contents);
+}
+
 bool TabDialogManager::GetDialogWidgetVisibility() {
   // The dialog widget should be visible if and only if the tab is in the
   // foreground and the host window is not minimized. The inactive tab in a
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.