Chrome · FullScreen
CVE-2026-17938
Logic Error in FullScreen
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifchrome/android/java/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java |
modified |
Files Changed
chrome/android/java/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.javachrome/android/java/src/org/chromium/chrome/browser/tab/TabWebContentsDelegateAndroidImpl.javachrome/android/java/src/org/chromium/chrome/browser/ui/ExclusiveAccessManager.javachrome/android/junit/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroidUnitTest.javachrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.ccchrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.h
Patch
From f24902ec479eaab7f0235e214248372e211022c8 Mon Sep 17 00:00:00 2001 From: Abdelrahman Eed <[email protected]> Date: Wed, 03 Jun 2026 00:50:56 -0700 Subject: [PATCH] Add canEnterFullscreenModeForTab to WebContentsDelegateAndroid. This change introduces a new method `canEnterFullscreenModeForTab` in WebContentsDelegateAndroid and its implementations. This allows embedders to control whether a RenderFrameHost is permitted to enter fullscreen mode. In Chrome, this check is routed through the ExclusiveAccessManager when the feature is enabled. Bug: 513989304 Change-Id: Ibf7ae4dfc48bf9a76c77d11887aad5240139904b Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7895236 Reviewed-by: Bo Liu <[email protected]> Reviewed-by: Peter Conn <[email protected]> Commit-Queue: Abdelrahman Eed <[email protected]> Cr-Commit-Position: refs/heads/main@{#1640757} --- diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java b/chrome/android/java/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java index a354709..86345ab6 100644 --- a/chrome/android/java/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java +++ b/chrome/android/java/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java @@ -578,6 +578,16 @@ } @Override + public boolean canEnterFullscreenModeForTab(RenderFrameHost renderFrameHost) { + if (ChromeFeatureList.sEnableExclusiveAccessManager.isEnabled()) { + if (mExclusiveAccessManager != null) { + return mExclusiveAccessManager.canEnterFullscreenModeForTab(renderFrameHost); + } + } + return super.canEnterFullscreenModeForTab(renderFrameHost); + } + + @Override public void enterFullscreenModeForTab( RenderFrameHost renderFrameHost, boolean prefersNavigationBar, diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabWebContentsDelegateAndroidImpl.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabWebContentsDelegateAndroidImpl.java index 2cb8287..dd27b7d4 100644 --- a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabWebContentsDelegateAndroidImpl.java +++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabWebContentsDelegateAndroidImpl.java @@ -243,6 +243,11 @@ } @Override + public boolean canEnterFullscreenModeForTab(RenderFrameHost renderFrameHost) { + return mDelegate.canEnterFullscreenModeForTab(renderFrameHost); + } + + @Override public void enterFullscreenModeForTab( RenderFrameHost renderFrameHost, boolean prefersNavigationBar, diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ui/ExclusiveAccessManager.java b/chrome/android/java/src/org/chromium/chrome/browser/ui/ExclusiveAccessManager.java index dfb6cbca..b22a550 100644 --- a/chrome/android/java/src/org/chromium/chrome/browser/ui/ExclusiveAccessManager.java +++ b/chrome/android/java/src/org/chromium/chrome/browser/ui/ExclusiveAccessManager.java @@ -168,6 +168,19 @@ } /** + * EAM frontend to check if a frame can enter fullscreen. + * + * @param renderFrameHost the render frame host asking for fullscreen + * @return true if the frame can enter fullscreen + */ + public boolean canEnterFullscreenModeForTab(RenderFrameHost renderFrameHost) { + if (mExclusiveAccessManagerAndroidNativePointer == 0) return false; + return ExclusiveAccessManagerJni.get() + .canEnterFullscreenModeForTab( + mExclusiveAccessManagerAndroidNativePointer, renderFrameHost); + } + + /** * EAM frontend for WebContentsDelegate to enter fullscreen * * @param renderFrameHost the render frame host requesting fullscreen @@ -388,6 +401,9 @@ FullscreenManager fullscreenManager, ActivityTabProvider activityTabProvider); + boolean canEnterFullscreenModeForTab( + long nativeExclusiveAccessManagerAndroid, RenderFrameHost renderFrameHost); + void enterFullscreenModeForTab( long nativeExclusiveAccessManagerAndroid, RenderFrameHost renderFrameHost, diff --git a/chrome/android/junit/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroidUnitTest.java b/chrome/android/junit/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroidUnitTest.java index af3b26b..5222aeb 100644 --- a/chrome/android/junit/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroidUnitTest.java +++ b/chrome/android/junit/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroidUnitTest.java @@ -51,9 +51,11 @@ import org.chromium.chrome.browser.tabmodel.TabCreatorManager; import org.chromium.chrome.browser.tabmodel.TabGroupMergeNotificationType; import org.chromium.chrome.browser.tabmodel.TabModel; +import org.chromium.chrome.browser.ui.ExclusiveAccessManager; import org.chromium.chrome.browser.util.AndroidTaskUtils; import org.chromium.chrome.browser.util.PictureInPictureWindowOptions; import org.chromium.chrome.browser.util.WindowFeatures; +import org.chromium.content_public.browser.RenderFrameHost; import org.chromium.content_public.browser.WebContents; import org.chromium.ui.display.DisplayAndroid; import org.chromium.ui.display.DisplayAndroidManager; @@ -86,7 +88,8 @@ Tab tab, Activity activity, TabCreatorManager tabCreatorManager, - TabModel tabModel) { + TabModel tabModel, + ExclusiveAccessManager exclusiveAccessManager) { super( tab, activity, @@ -99,7 +102,7 @@ mock(Supplier.class), mock(Supplier.class), mock(Supplier.class), - null); + exclusiveAccessManager); mTabModel = tabModel; mTabMap = new HashMap<>(); } @@ -154,6 +157,8 @@ @Mock AppTask mAppTask; @Mock PopupCreator mPopupCreator; @Mock MultiWindowUtils mMultiWindowUtils; + @Mock ExclusiveAccessManager mExclusiveAccessManager; + @Mock RenderFrameHost mRenderFrameHost; @Captor private ArgumentCaptor<CompletableFuture<Boolean>> mFutureCaptor; @@ -173,7 +178,7 @@ PopupCreatorFactory.setInstanceForTesting(mPopupCreator); mTabWebContentsDelegateAndroid = new TestActivityTabWebContentsDelegateAndroid( - mTab, mActivity, mTabCreatorManager, mTabModel); + mTab, mActivity, mTabCreatorManager, mTabModel, mExclusiveAccessManager); DisplayAndroidManager.setInstanceForTesting(mDisplayAndroidManager); AconfigFlaggedApiDelegate.setInstanceForTesting(mFlaggedApiDelegate); AndroidTaskUtils.setAppTaskForTesting(mAppTask); @@ -464,4 +469,23 @@ verify(mFlaggedApiDelegate, never()).moveTaskTo(any(), anyInt(), any()); } + @Test + @DisableFeatures({ChromeFeatureList.ENABLE_EXCLUSIVE_ACCESS_MANAGER}) + public void testCanEnterFullscreenModeForTab_exclusiveAccessManagerDisabled() { + assertTrue(mTabWebContentsDelegateAndroid.canEnterFullscreenModeForTab(mRenderFrameHost)); + verify(mExclusiveAccessManager, never()).canEnterFullscreenModeForTab(any()); + } + + @Test + @EnableFeatures({ChromeFeatureList.ENABLE_EXCLUSIVE_ACCESS_MANAGER}) + public void testCanEnterFullscreenModeForTab_exclusiveAccessManagerEnabled() { + when(mExclusiveAccessManager.canEnterFullscreenModeForTab(mRenderFrameHost)) + .thenReturn(true); + assertTrue(mTabWebContentsDelegateAndroid.canEnterFullscreenModeForTab(mRenderFrameHost)); + verify(mExclusiveAccessManager, times(1)).canEnterFullscreenModeForTab(mRenderFrameHost); + + when(mExclusiveAccessManager.canEnterFullscreenModeForTab(mRenderFrameHost)) + .thenReturn(false); + assertFalse(mTabWebContentsDelegateAndroid.canEnterFullscreenModeForTab(mRenderFrameHost)); + } } diff --git a/chrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.cc b/chrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.cc index a3daf42c..c4ac856 100644 --- a/chrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.cc +++ b/chrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.cc @@ -30,6 +30,15 @@ ExclusiveAccessManagerAndroid::~ExclusiveAccessManagerAndroid() = default; +bool ExclusiveAccessManagerAndroid::CanEnterFullscreenModeForTab( + JNIEnv* env, + const jni_zero::JavaRef<jobject>& jrender_frame_host_android) { + content::RenderFrameHost* rfh = + content::RenderFrameHost::FromJavaRenderFrameHost( + jrender_frame_host_android); + return eam_.fullscreen_controller()->CanEnterFullscreenModeForTab(rfh); +} + void ExclusiveAccessManagerAndroid::EnterFullscreenModeForTab( JNIEnv* env, const jni_zero::JavaRef<jobject>& jrender_frame_host_android, diff --git a/chrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.h b/chrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.h index 9f7491c..293c635 100644 --- a/chrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.h +++ b/chrome/browser/ui/android/exclusive_access/exclusive_access_manager_android.h @@ -30,6 +30,10 @@ void Destroy(JNIEnv* env); + bool CanEnterFullscreenModeForTab( + JNIEnv* env, + const jni_zero::JavaRef<jobject>& jrender_frame_host_android); + void EnterFullscreenModeForTab( JNIEnv* env, const jni_zero::JavaRef<jobject>& jrender_frame_host_android, diff --git a/components/embedder_support/android/delegate/web_contents_delegate_android.cc b/components/embedder_support/android/delegate/web_contents_delegate_android.cc
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page