Low CVSS 6.8 chrome Policy Bypass 🔧 Commit mapped

Overview

Low
Severity
6.8
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInsufficient policy enforcement in Enterprise
DescriptionInsufficient policy enforcement in Enterprise
ComponentEnterprise
Bug ClassPolicy Bypass
Tracker513291747
Fix commitfeccea5c2cbb (chromium/src) +8/-1
CWECWE-693
CVSS vectorCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA KEVNot listed
CreditedGoogle
Reported2026-05-14 (per vendor advisory)
Fix landed2026-06-02 (public git)
Disclosed2026-07-29
Patch gap57 days — fix public in source before the advisory

Files Changed

  • chrome/browser/ui/browser_command_controller.cc
From feccea5c2cbb0f00ca2e925f903a6504ad57bdf6 Mon Sep 17 00:00:00 2001
From: Avi Drissman <[email protected]>
Date: Tue, 02 Jun 2026 07:23:26 -0700
Subject: [PATCH] Make enabling AppleScripting follow DevTools policy

Add handling for the kDevToolsShowPolicyDialog feature to the "Allow
JavaScript from Apple Events" menu item.

Fixed: 513291747
Change-Id: Id1735ce08bf75770d53f78d3eae7a1d56a6a6964
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7891094
Reviewed-by: Dmitry Gozman <[email protected]>
Commit-Queue: Avi Drissman <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1640146}
---

diff --git a/chrome/browser/ui/browser_command_controller.cc b/chrome/browser/ui/browser_command_controller.cc
index 9dcaf8c..102c6cd3 100644
--- a/chrome/browser/ui/browser_command_controller.cc
+++ b/chrome/browser/ui/browser_command_controller.cc
@@ -834,7 +834,14 @@
       chrome::ToggleAlwaysShowToolbarInFullscreen(browser_);
       break;
     case IDC_TOGGLE_JAVASCRIPT_APPLE_EVENTS: {
-      chrome::ToggleJavaScriptFromAppleEventsAllowed(browser_);
+      content::WebContents* web_contents =
+          browser_->tab_strip_model()->GetActiveWebContents();
+      if (base::FeatureList::IsEnabled(features::kDevToolsShowPolicyDialog) &&
+          !DevToolsWindow::AllowDevToolsFor(profile(), web_contents)) {
+        DevToolsPolicyDialog::Show(web_contents);
+      } else {
+        chrome::ToggleJavaScriptFromAppleEventsAllowed(browser_);
+      }
       break;
     }
 #endif
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.