Chrome · Views
CVE-2026-17958
Logic Error in Views
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ShouldAllowKeyEventsDuringInputProtectionchrome/browser/ui/views/digital_credentials/digital_identity_multi_step_dialog.cc |
modified |
Files Changed
chrome/browser/ui/views/digital_credentials/digital_identity_multi_step_dialog.cc
Patch
From 40956eeb5c3b00ad5cd1c222944dc4acd189cd23 Mon Sep 17 00:00:00 2001 From: Mohamed Amir Yosef <[email protected]> Date: Mon, 15 Jun 2026 01:38:28 -0700 Subject: [PATCH] Fix Input Activation Protection Bypass in Digital Credentials This overrides ShouldAllowKeyEventsDuringInputProtection in DigitalIdentityMultiStepDialogDelegate to return false, restricting key events during the input protection period. TAG=agy CONV=eb2ccdcd-cb8c-4b94-b6fc-4e615bb1b30f Fixed: 517538206 Change-Id: I8962253e5dbb2ac1164c5a40459458854c6138c7 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7927972 Auto-Submit: Mohamed Amir Yosef <[email protected]> Commit-Queue: Mohamed Amir Yosef <[email protected]> Reviewed-by: Adem Derinel <[email protected]> Commit-Queue: Adem Derinel <[email protected]> Cr-Commit-Position: refs/heads/main@{#1646625} --- diff --git a/chrome/browser/ui/views/digital_credentials/digital_identity_multi_step_dialog.cc b/chrome/browser/ui/views/digital_credentials/digital_identity_multi_step_dialog.cc index 52418e4..db6ef17 100644 --- a/chrome/browser/ui/views/digital_credentials/digital_identity_multi_step_dialog.cc +++ b/chrome/browser/ui/views/digital_credentials/digital_identity_multi_step_dialog.cc @@ -69,6 +69,8 @@ views::Widget::ClosedReason get_closed_reason() { return closed_reason_; } + bool ShouldAllowKeyEventsDuringInputProtection() const override; + private: bool OnDialogAccepted(); bool OnDialogCanceled(); @@ -217,6 +219,11 @@ SetCloseCallback(base::OnceClosure()); } +bool DigitalIdentityMultiStepDialogDelegate:: + ShouldAllowKeyEventsDuringInputProtection() const { + return false; +} + // static std::unique_ptr<views::BoxLayoutView> DigitalIdentityMultiStepDialog::CreateHeaderView(
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page