Low chrome Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInsufficient policy enforcement in Enterprise
DescriptionInsufficient policy enforcement in Enterprise
ComponentEnterprise
Bug ClassLogic Error
Tracker513291747
Fix commitfeccea5c2cbb (chromium/src) +8/-1
CISA KEVNot listed
CreditedGoogle
Disclosed2026-07-29

Files Changed

  • chrome/browser/ui/browser_command_controller.cc
From feccea5c2cbb0f00ca2e925f903a6504ad57bdf6 Mon Sep 17 00:00:00 2001
From: Avi Drissman <[email protected]>
Date: Tue, 02 Jun 2026 07:23:26 -0700
Subject: [PATCH] Make enabling AppleScripting follow DevTools policy

Add handling for the kDevToolsShowPolicyDialog feature to the "Allow
JavaScript from Apple Events" menu item.

Fixed: 513291747
Change-Id: Id1735ce08bf75770d53f78d3eae7a1d56a6a6964
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7891094
Reviewed-by: Dmitry Gozman <[email protected]>
Commit-Queue: Avi Drissman <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1640146}
---

diff --git a/chrome/browser/ui/browser_command_controller.cc b/chrome/browser/ui/browser_command_controller.cc
index 9dcaf8c..102c6cd3 100644
--- a/chrome/browser/ui/browser_command_controller.cc
+++ b/chrome/browser/ui/browser_command_controller.cc
@@ -834,7 +834,14 @@
       chrome::ToggleAlwaysShowToolbarInFullscreen(browser_);
       break;
     case IDC_TOGGLE_JAVASCRIPT_APPLE_EVENTS: {
-      chrome::ToggleJavaScriptFromAppleEventsAllowed(browser_);
+      content::WebContents* web_contents =
+          browser_->tab_strip_model()->GetActiveWebContents();
+      if (base::FeatureList::IsEnabled(features::kDevToolsShowPolicyDialog) &&
+          !DevToolsWindow::AllowDevToolsFor(profile(), web_contents)) {
+        DevToolsPolicyDialog::Show(web_contents);
+      } else {
+        chrome::ToggleJavaScriptFromAppleEventsAllowed(browser_);
+      }
       break;
     }
 #endif
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.