Chrome · Enterprise
CVE-2026-17919
Logic Error in Enterprise
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
chrome/browser/ui/browser_command_controller.cc
Patch
From feccea5c2cbb0f00ca2e925f903a6504ad57bdf6 Mon Sep 17 00:00:00 2001 From: Avi Drissman <[email protected]> Date: Tue, 02 Jun 2026 07:23:26 -0700 Subject: [PATCH] Make enabling AppleScripting follow DevTools policy Add handling for the kDevToolsShowPolicyDialog feature to the "Allow JavaScript from Apple Events" menu item. Fixed: 513291747 Change-Id: Id1735ce08bf75770d53f78d3eae7a1d56a6a6964 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7891094 Reviewed-by: Dmitry Gozman <[email protected]> Commit-Queue: Avi Drissman <[email protected]> Cr-Commit-Position: refs/heads/main@{#1640146} --- diff --git a/chrome/browser/ui/browser_command_controller.cc b/chrome/browser/ui/browser_command_controller.cc index 9dcaf8c..102c6cd3 100644 --- a/chrome/browser/ui/browser_command_controller.cc +++ b/chrome/browser/ui/browser_command_controller.cc @@ -834,7 +834,14 @@ chrome::ToggleAlwaysShowToolbarInFullscreen(browser_); break; case IDC_TOGGLE_JAVASCRIPT_APPLE_EVENTS: { - chrome::ToggleJavaScriptFromAppleEventsAllowed(browser_); + content::WebContents* web_contents = + browser_->tab_strip_model()->GetActiveWebContents(); + if (base::FeatureList::IsEnabled(features::kDevToolsShowPolicyDialog) && + !DevToolsWindow::AllowDevToolsFor(profile(), web_contents)) { + DevToolsPolicyDialog::Show(web_contents); + } else { + chrome::ToggleJavaScriptFromAppleEventsAllowed(browser_); + } break; } #endif
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page