From 85fede76fe078d4ea9622a0c37b81c6852b0cf93 Mon Sep 17 00:00:00 2001
From: Alex Moshchuk <[email protected]>
Date: Tue, 23 Jun 2026 14:10:35 -0700
Subject: [PATCH] Restore CHECK for CanAccessOrigin().

The CanAccessOrigin() check in
NavigationRequest::GetOriginForURLLoaderFactoryAfterResponse() was
always a CHECK to begin with and was incorrectly downgraded to a DCHECK
in https://chromium-review.googlesource.com/c/chromium/src/+/7748832.

Note: there was always an ongoing trickle of known crashes resulting
from this check (going back to at least 2020), and this is tracked is
issues such as https://crbug.com/469092870 and
https://crbug.com/463029421. These reports will probably reappear once
this CL lands and might be seen as a new spike; please avoid reverting
this CL due to that, as this check turns potential security problems
into stability ones, so it's important to keep.

Bug: 526541544
Change-Id: Ib077b83303fb8633d60b773a30529900008b62a7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7986809
Commit-Queue: Alex Moshchuk <[email protected]>
Reviewed-by: Charlie Reis <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1651274}
---

diff --git a/content/browser/renderer_host/navigation_request.cc b/content/browser/renderer_host/navigation_request.cc
index f638782..5bd7686 100644
--- a/content/browser/renderer_host/navigation_request.cc
+++ b/content/browser/renderer_host/navigation_request.cc
@@ -9722,14 +9722,16 @@
   //   policy of the process being used. This is because the content is loaded
   //   from the MHTML archive within the process. There are no data loaded from
   //   the network.
+  //
+  // Note: This is a security-critical check that needs to be a CHECK rather
+  // than a DCHECK, and it should never be reverted, even if there are crashes
+  // in the wild.
   if (HasRenderFrameHost() &&
       !GetRenderFrameHost()->ShouldBypassSecurityChecksForErrorPage(this) &&
       !IsForMhtmlSubframe()) {
     int process_id = GetRenderFrameHost()->GetProcess()->GetDeprecatedID();
     auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
-    // TODO(https://crbug.com/526541544): CHECK-exclusion: Convert to CHECK once
-    // we are sure this isn't hit.
-    DCHECK(policy->CanAccessOrigin(
+    CHECK(policy->CanAccessOrigin(
         process_id, origin,
         ChildProcessSecurityPolicyImpl::AccessType::kCanCommitNewOrigin));
   }