Chrome · DevTools
CVE-2026-17899
Logic Error in DevTools
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
iffront_end/panels/common/ExtensionServer.ts |
modified |
Files Changed
front_end/core/host/InspectorFrontendHostAPI.tsfront_end/core/host/UserMetrics.tsfront_end/devtools_compatibility.jsfront_end/panels/common/ExtensionServer.ts
Patch
From 48f965098f72daf2d89b5ded468d3264299fb095 Mon Sep 17 00:00:00 2001 From: Danil Somsikov <[email protected]> Date: Wed, 11 Mar 2026 08:56:17 -0700 Subject: [PATCH] Record metrics for extension evaluation targets. This change introduces a new enumerated histogram to log the type of target an extension is evaluating code against: a standard web page, the same extension, or a different extension. The target type is determined by inspecting the URL of the frame being evaluated. Bug: 375959766 Change-Id: I5bf7538adb78b6e3d749395f2449b3f6599a6fbc Reviewed-on: https://chromium-review.googlesource.com/c/devtools/devtools-frontend/+/7657603 Auto-Submit: Danil Somsikov <[email protected]> Reviewed-by: Philip Pfaffe <[email protected]> Commit-Queue: Danil Somsikov <[email protected]> --- diff --git a/front_end/core/host/InspectorFrontendHostAPI.ts b/front_end/core/host/InspectorFrontendHostAPI.ts index 03a0a11..627f62d 100644 --- a/front_end/core/host/InspectorFrontendHostAPI.ts +++ b/front_end/core/host/InspectorFrontendHostAPI.ts @@ -556,5 +556,6 @@ LighthouseCategoryUsed = 'DevTools.LighthouseCategoryUsed', SwatchActivated = 'DevTools.SwatchActivated', BuiltInAiAvailability = 'DevTools.BuiltInAiAvailability', + ExtensionEvalTarget = 'DevTools.ExtensionEvalTarget', // LINT.ThenChange(/front_end/devtools_compatibility.js:EnumeratedHistogram) } diff --git a/front_end/core/host/UserMetrics.ts b/front_end/core/host/UserMetrics.ts index 49a8235..15697cf 100644 --- a/front_end/core/host/UserMetrics.ts +++ b/front_end/core/host/UserMetrics.ts @@ -322,6 +322,11 @@ InspectorFrontendHostInstance.recordPerformanceHistogram( 'DevTools.Insights.ShortTeaserGenerationTime', timeInMilliseconds); } + + extensionEvalTarget(target: ExtensionEvalTarget): void { + InspectorFrontendHostInstance.recordEnumeratedHistogram( + EnumeratedHistogram.ExtensionEvalTarget, target, ExtensionEvalTarget.MAX_VALUE); + } } /** @@ -1264,3 +1269,10 @@ DISABLED_NO_GPU = 9, MAX_VALUE = 10, } + +export const enum ExtensionEvalTarget { + WEB_PAGE = 0, + SAME_EXTENSION = 1, + OTHER_EXTENSION = 2, + MAX_VALUE = 3, +} diff --git a/front_end/devtools_compatibility.js b/front_end/devtools_compatibility.js index 894969c..68e99f9 100644 --- a/front_end/devtools_compatibility.js +++ b/front_end/devtools_compatibility.js @@ -444,7 +444,8 @@ TimelineNavigationSettingState: 'DevTools.TimelineNavigationSettingState', SyncSetting: 'DevTools.SyncSetting', SwatchActivated: 'DevTools.SwatchActivated', - BuiltInAiAvailability: 'DevTools.BuiltInAiAvailability' + BuiltInAiAvailability: 'DevTools.BuiltInAiAvailability', + ExtensionEvalTarget: 'DevTools.ExtensionEvalTarget' // LINT.ThenChange(/front_end/core/host/InspectorFrontendHostAPI.ts:EnumeratedHistogram) }; diff --git a/front_end/panels/common/ExtensionServer.ts b/front_end/panels/common/ExtensionServer.ts index 0a5ec62..b336860 100644 --- a/front_end/panels/common/ExtensionServer.ts +++ b/front_end/panels/common/ExtensionServer.ts @@ -1574,6 +1574,21 @@ return this.status.E_FAILED('Permission denied'); } + try { + const parsedUrl = new URL(frame.url); + let targetType = Host.UserMetrics.ExtensionEvalTarget.WEB_PAGE; + if (parsedUrl.protocol === 'chrome-extension:') { + if (parsedUrl.origin === securityOrigin) { + targetType = Host.UserMetrics.ExtensionEvalTarget.SAME_EXTENSION; + } else { + targetType = Host.UserMetrics.ExtensionEvalTarget.OTHER_EXTENSION; + } + } + Host.userMetrics.extensionEvalTarget(targetType); + } catch { + // Ignore invalid URLs. + } + void context .evaluate( {
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page