Chrome · TabStrip
CVE-2026-14139
Logic Error in TabStrip
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
chrome/browser/ui/tabs/public/tab_dialog_manager.hchrome/browser/ui/tabs/tab_dialog_manager.cc
Patch
From 4581e656cbd9ebd9c2d8aa09aede6dfb2a6da1c8 Mon Sep 17 00:00:00 2001 From: Steven Luong <[email protected]> Date: Tue, 26 May 2026 13:21:53 -0700 Subject: [PATCH] Update TabDialogManager web contents observation on discard The TabDialogManager was originally inheriting from WebContentsObserver to observe the web contents for its corresponding tab. However, the web contents can change upon discard and the manager didn't account for observing the new contents. This CL updates the TabDialogManger so that it will observe the correct web contents after it's tab has discarded. Fixed: 514072495 Change-Id: I324afd9b792b4d5d665841e35dd972a1a0179c0d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7872106 Reviewed-by: Alison Gale <[email protected]> Commit-Queue: Steven Luong <[email protected]> Cr-Commit-Position: refs/heads/main@{#1636446} --- diff --git a/chrome/browser/ui/tabs/public/tab_dialog_manager.h b/chrome/browser/ui/tabs/public/tab_dialog_manager.h index 271fc1b..c3f679d9 100644 --- a/chrome/browser/ui/tabs/public/tab_dialog_manager.h +++ b/chrome/browser/ui/tabs/public/tab_dialog_manager.h @@ -167,6 +167,9 @@ void TabWillEnterBackground(TabInterface* tab_interface); void TabWillDetach(TabInterface* tab_interface, TabInterface::DetachReason reason); + void OnDiscardContents(TabInterface* tab, + content::WebContents* old_contents, + content::WebContents* new_contents); bool GetDialogWidgetVisibility(); diff --git a/chrome/browser/ui/tabs/tab_dialog_manager.cc b/chrome/browser/ui/tabs/tab_dialog_manager.cc index 1a68051..7f2c85a 100644 --- a/chrome/browser/ui/tabs/tab_dialog_manager.cc +++ b/chrome/browser/ui/tabs/tab_dialog_manager.cc @@ -294,6 +294,9 @@ tab_subscriptions_.push_back( tab_interface_->RegisterWillDetach(base::BindRepeating( &TabDialogManager::TabWillDetach, base::Unretained(this)))); + tab_subscriptions_.push_back( + tab_interface->RegisterWillDiscardContents(base::BindRepeating( + &TabDialogManager::OnDiscardContents, base::Unretained(this)))); } TabDialogManager::~TabDialogManager() = default; @@ -562,6 +565,13 @@ } } +void TabDialogManager::OnDiscardContents(TabInterface* tab, + content::WebContents* old_contents, + content::WebContents* new_contents) { + CHECK_EQ(tab, tab_interface_); + Observe(new_contents); +} + bool TabDialogManager::GetDialogWidgetVisibility() { // The dialog widget should be visible if and only if the tab is in the // foreground and the host window is not minimized. The inactive tab in a
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page