Low chrome Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInappropriate implementation in FullScreen
DescriptionInappropriate implementation in FullScreen
ComponentFullScreen
Bug ClassLogic Error
Tracker513989304
Fix commitf24902ec479e (chromium/src) +89/-3
CISA KEVNot listed
CreditedGoogle
Disclosed2026-07-29

Changed Functions

FunctionChangeNotes
if
chrome/android/java/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java
modified

Files Changed

  • chrome/android/java/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java
  • chrome/android/java/src/org/chromium/chrome/browser/tab/TabWebContentsDelegateAndroidImpl.java
  • chrome/android/java/src/org/chromium/chrome/browser/ui/ExclusiveAccessManager.java
  • chrome/android/junit/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroidUnitTest.java
  • chrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.cc
  • chrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.h
From f24902ec479eaab7f0235e214248372e211022c8 Mon Sep 17 00:00:00 2001
From: Abdelrahman Eed <[email protected]>
Date: Wed, 03 Jun 2026 00:50:56 -0700
Subject: [PATCH] Add canEnterFullscreenModeForTab to WebContentsDelegateAndroid.

This change introduces a new method `canEnterFullscreenModeForTab` in WebContentsDelegateAndroid and its implementations. This allows embedders to control whether a RenderFrameHost is permitted to enter fullscreen mode. In Chrome, this check is routed through the ExclusiveAccessManager when the feature is enabled.

Bug: 513989304
Change-Id: Ibf7ae4dfc48bf9a76c77d11887aad5240139904b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7895236
Reviewed-by: Bo Liu <[email protected]>
Reviewed-by: Peter Conn <[email protected]>
Commit-Queue: Abdelrahman Eed <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1640757}
---

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java b/chrome/android/java/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java
index a354709..86345ab6 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java
@@ -578,6 +578,16 @@
     }
 
     @Override
+    public boolean canEnterFullscreenModeForTab(RenderFrameHost renderFrameHost) {
+        if (ChromeFeatureList.sEnableExclusiveAccessManager.isEnabled()) {
+            if (mExclusiveAccessManager != null) {
+                return mExclusiveAccessManager.canEnterFullscreenModeForTab(renderFrameHost);
+            }
+        }
+        return super.canEnterFullscreenModeForTab(renderFrameHost);
+    }
+
+    @Override
     public void enterFullscreenModeForTab(
             RenderFrameHost renderFrameHost,
             boolean prefersNavigationBar,
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabWebContentsDelegateAndroidImpl.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabWebContentsDelegateAndroidImpl.java
index 2cb8287..dd27b7d4 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabWebContentsDelegateAndroidImpl.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabWebContentsDelegateAndroidImpl.java
@@ -243,6 +243,11 @@
     }
 
     @Override
+    public boolean canEnterFullscreenModeForTab(RenderFrameHost renderFrameHost) {
+        return mDelegate.canEnterFullscreenModeForTab(renderFrameHost);
+    }
+
+    @Override
     public void enterFullscreenModeForTab(
             RenderFrameHost renderFrameHost,
             boolean prefersNavigationBar,
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ui/ExclusiveAccessManager.java b/chrome/android/java/src/org/chromium/chrome/browser/ui/ExclusiveAccessManager.java
index dfb6cbca..b22a550 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ui/ExclusiveAccessManager.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ui/ExclusiveAccessManager.java
@@ -168,6 +168,19 @@
     }
 
     /**
+     * EAM frontend to check if a frame can enter fullscreen.
+     *
+     * @param renderFrameHost the render frame host asking for fullscreen
+     * @return true if the frame can enter fullscreen
+     */
+    public boolean canEnterFullscreenModeForTab(RenderFrameHost renderFrameHost) {
+        if (mExclusiveAccessManagerAndroidNativePointer == 0) return false;
+        return ExclusiveAccessManagerJni.get()
+                .canEnterFullscreenModeForTab(
+                        mExclusiveAccessManagerAndroidNativePointer, renderFrameHost);
+    }
+
+    /**
      * EAM frontend for WebContentsDelegate to enter fullscreen
      *
      * @param renderFrameHost the render frame host requesting fullscreen
@@ -388,6 +401,9 @@
                 FullscreenManager fullscreenManager,
                 ActivityTabProvider activityTabProvider);
 
+        boolean canEnterFullscreenModeForTab(
+                long nativeExclusiveAccessManagerAndroid, RenderFrameHost renderFrameHost);
+
         void enterFullscreenModeForTab(
                 long nativeExclusiveAccessManagerAndroid,
                 RenderFrameHost renderFrameHost,
diff --git a/chrome/android/junit/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroidUnitTest.java b/chrome/android/junit/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroidUnitTest.java
index af3b26b..5222aeb 100644
--- a/chrome/android/junit/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroidUnitTest.java
+++ b/chrome/android/junit/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroidUnitTest.java
@@ -51,9 +51,11 @@
 import org.chromium.chrome.browser.tabmodel.TabCreatorManager;
 import org.chromium.chrome.browser.tabmodel.TabGroupMergeNotificationType;
 import org.chromium.chrome.browser.tabmodel.TabModel;
+import org.chromium.chrome.browser.ui.ExclusiveAccessManager;
 import org.chromium.chrome.browser.util.AndroidTaskUtils;
 import org.chromium.chrome.browser.util.PictureInPictureWindowOptions;
 import org.chromium.chrome.browser.util.WindowFeatures;
+import org.chromium.content_public.browser.RenderFrameHost;
 import org.chromium.content_public.browser.WebContents;
 import org.chromium.ui.display.DisplayAndroid;
 import org.chromium.ui.display.DisplayAndroidManager;
@@ -86,7 +88,8 @@
                 Tab tab,
                 Activity activity,
                 TabCreatorManager tabCreatorManager,
-                TabModel tabModel) {
+                TabModel tabModel,
+                ExclusiveAccessManager exclusiveAccessManager) {
             super(
                     tab,
                     activity,
@@ -99,7 +102,7 @@
                     mock(Supplier.class),
                     mock(Supplier.class),
                     mock(Supplier.class),
-                    null);
+                    exclusiveAccessManager);
             mTabModel = tabModel;
             mTabMap = new HashMap<>();
         }
@@ -154,6 +157,8 @@
     @Mock AppTask mAppTask;
     @Mock PopupCreator mPopupCreator;
     @Mock MultiWindowUtils mMultiWindowUtils;
+    @Mock ExclusiveAccessManager mExclusiveAccessManager;
+    @Mock RenderFrameHost mRenderFrameHost;
 
     @Captor private ArgumentCaptor<CompletableFuture<Boolean>> mFutureCaptor;
 
@@ -173,7 +178,7 @@
         PopupCreatorFactory.setInstanceForTesting(mPopupCreator);
         mTabWebContentsDelegateAndroid =
                 new TestActivityTabWebContentsDelegateAndroid(
-                        mTab, mActivity, mTabCreatorManager, mTabModel);
+                        mTab, mActivity, mTabCreatorManager, mTabModel, mExclusiveAccessManager);
         DisplayAndroidManager.setInstanceForTesting(mDisplayAndroidManager);
         AconfigFlaggedApiDelegate.setInstanceForTesting(mFlaggedApiDelegate);
         AndroidTaskUtils.setAppTaskForTesting(mAppTask);
@@ -464,4 +469,23 @@
         verify(mFlaggedApiDelegate, never()).moveTaskTo(any(), anyInt(), any());
     }
 
+    @Test
+    @DisableFeatures({ChromeFeatureList.ENABLE_EXCLUSIVE_ACCESS_MANAGER})
+    public void testCanEnterFullscreenModeForTab_exclusiveAccessManagerDisabled() {
+        assertTrue(mTabWebContentsDelegateAndroid.canEnterFullscreenModeForTab(mRenderFrameHost));
+        verify(mExclusiveAccessManager, never()).canEnterFullscreenModeForTab(any());
+    }
+
+    @Test
+    @EnableFeatures({ChromeFeatureList.ENABLE_EXCLUSIVE_ACCESS_MANAGER})
+    public void testCanEnterFullscreenModeForTab_exclusiveAccessManagerEnabled() {
+        when(mExclusiveAccessManager.canEnterFullscreenModeForTab(mRenderFrameHost))
+                .thenReturn(true);
+        assertTrue(mTabWebContentsDelegateAndroid.canEnterFullscreenModeForTab(mRenderFrameHost));
+        verify(mExclusiveAccessManager, times(1)).canEnterFullscreenModeForTab(mRenderFrameHost);
+
+        when(mExclusiveAccessManager.canEnterFullscreenModeForTab(mRenderFrameHost))
+                .thenReturn(false);
+        assertFalse(mTabWebContentsDelegateAndroid.canEnterFullscreenModeForTab(mRenderFrameHost));
+    }
 }
diff --git a/chrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.cc b/chrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.cc
index a3daf42c..c4ac856 100644
--- a/chrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.cc
+++ b/chrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.cc
@@ -30,6 +30,15 @@
 
 ExclusiveAccessManagerAndroid::~ExclusiveAccessManagerAndroid() = default;
 
+bool ExclusiveAccessManagerAndroid::CanEnterFullscreenModeForTab(
+    JNIEnv* env,
+    const jni_zero::JavaRef<jobject>& jrender_frame_host_android) {
+  content::RenderFrameHost* rfh =
+      content::RenderFrameHost::FromJavaRenderFrameHost(
+          jrender_frame_host_android);
+  return eam_.fullscreen_controller()->CanEnterFullscreenModeForTab(rfh);
+}
+
 void ExclusiveAccessManagerAndroid::EnterFullscreenModeForTab(
     JNIEnv* env,
     const jni_zero::JavaRef<jobject>& jrender_frame_host_android,
diff --git a/chrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.h b/chrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.h
index 9f7491c..293c635 100644
--- a/chrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.h
+++ b/chrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.h
@@ -30,6 +30,10 @@
 
   void Destroy(JNIEnv* env);
 
+  bool CanEnterFullscreenModeForTab(
+      JNIEnv* env,
+      const jni_zero::JavaRef<jobject>& jrender_frame_host_android);
+
   void EnterFullscreenModeForTab(
       JNIEnv* env,
       const jni_zero::JavaRef<jobject>& jrender_frame_host_android,
diff --git a/components/embedder_support/android/delegate/web_contents_delegate_android.cc b/components/embedder_support/android/delegate/web_contents_delegate_android.cc
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.