PatchGap
Chrome · Browser

CVE-2026-17984

Logic Error in Browser
Low chrome Logic Error 🔧 Commit mapped

Overview

Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInappropriate implementation in Browser
DescriptionInappropriate implementation in Browser
ComponentBrowser
Bug ClassLogic Error
Tracker519978460
Fix commitb3668a394ae0 (chromium/src) +2/-1
CISA KEVNot listed
CreditedGoogle
Disclosed2026-07-29

Changed Functions

FunctionChangeNotes
for
chrome/browser/visited_url_ranking/android_tab_model_url_visit_data_fetcher.cc
 modified

Files Changed

  • chrome/browser/visited_url_ranking/android_tab_model_url_visit_data_fetcher.cc

Patch

view commit
From b3668a394ae07f71a8a083fab10e60f6041a036f Mon Sep 17 00:00:00 2001
From: Xi Han <[email protected]>
Date: Fri, 12 Jun 2026 13:15:27 -0700
Subject: [PATCH] [TabDonation] Add URL scheme checks.

Bug: 519978460
Change-Id: Ia49e9d37eeb0cf188525ce854f8959b804ffd48a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7930446
Reviewed-by: Siddhartha S <[email protected]>
Commit-Queue: Siddhartha S <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1646204}
---

diff --git a/chrome/browser/visited_url_ranking/android_tab_model_url_visit_data_fetcher.cc b/chrome/browser/visited_url_ranking/android_tab_model_url_visit_data_fetcher.cc
index b1225a8..1d682d7 100644
--- a/chrome/browser/visited_url_ranking/android_tab_model_url_visit_data_fetcher.cc
+++ b/chrome/browser/visited_url_ranking/android_tab_model_url_visit_data_fetcher.cc
@@ -149,7 +149,8 @@
     for (int i = 0; i < count; ++i) {
       auto* tab_android = model->GetTabAt(i);
       GURL url = tab_android->GetURL();
-      if (!url.is_valid() || url.spec() == chrome::kChromeUINativeNewTabURL) {
+      if (!url.is_valid() || url.spec() == chrome::kChromeUINativeNewTabURL ||
+          !url.SchemeIsHTTPOrHTTPS()) {
         continue;
       }
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
On This Page