Chrome · DevTools
CVE-2026-17974
Logic Error in DevTools
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifchrome/browser/renderer_context_menu/render_view_context_menu.cc |
modified |
Files Changed
chrome/browser/renderer_context_menu/render_view_context_menu.cc
Patch
From a70db992f53bb8bb2b8923c124624e4c876031b8 Mon Sep 17 00:00:00 2001 From: Avi Drissman <[email protected]> Date: Mon, 08 Jun 2026 08:17:45 -0700 Subject: [PATCH] Enforce DevTools policy for View Frame Source Fixed: 519232592 Change-Id: I541bb241419205f165569f9b90d6abd56a6a6964 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7895540 Reviewed-by: Dmitry Gozman <[email protected]> Auto-Submit: Avi Drissman <[email protected]> Commit-Queue: Avi Drissman <[email protected]> Cr-Commit-Position: refs/heads/main@{#1643214} --- diff --git a/chrome/browser/renderer_context_menu/render_view_context_menu.cc b/chrome/browser/renderer_context_menu/render_view_context_menu.cc index fe6d599b..2f47249cb 100644 --- a/chrome/browser/renderer_context_menu/render_view_context_menu.cc +++ b/chrome/browser/renderer_context_menu/render_view_context_menu.cc @@ -3911,14 +3911,22 @@ break; case IDC_VIEW_SOURCE: + case IDC_CONTENT_CONTEXT_VIEWFRAMESOURCE: + // The policy on the source_web_contents_ applies; when performing the + // action, do it on the appropriate target (the embedder_web_contents_ or + // the RenderFrameHost, respectively). if (base::FeatureList::IsEnabled(features::kDevToolsShowPolicyDialog) && !DevToolsWindow::AllowDevToolsFor(GetProfile(), - embedder_web_contents_)) { + source_web_contents_)) { #if !BUILDFLAG(IS_ANDROID) - DevToolsPolicyDialog::Show(embedder_web_contents_); + DevToolsPolicyDialog::Show(source_web_contents_); #endif } else { - embedder_web_contents_->GetPrimaryMainFrame()->ViewSource(); + if (id == IDC_VIEW_SOURCE) { + embedder_web_contents_->GetPrimaryMainFrame()->ViewSource(); + } else if (GetRenderFrameHost()) { + GetRenderFrameHost()->ViewSource(); + } } break; @@ -3950,12 +3958,6 @@ source_web_contents_->ReloadFocusedFrame(); break; - case IDC_CONTENT_CONTEXT_VIEWFRAMESOURCE: - if (GetRenderFrameHost()) { - GetRenderFrameHost()->ViewSource(); - } - break; - case IDC_CONTENT_CONTEXT_UNDO: source_web_contents_->Undo(); break;
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page