Low CVSS 9.6 chrome Input Validation 🔧 Commit mapped

Overview

Low
Severity
9.6
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInsufficient validation of untrusted input in AI
DescriptionInsufficient validation of untrusted input in AI
ComponentAI
Bug ClassInput Validation
Tracker520110535
Fix commit73066abb7038 (chromium/src) +136/-7
Related commits32213553c1ef previously mapped (not the fix) · chromium/src
CWECWE-20 (Improper input validation)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CISA KEVNot listed
CreditedGoogle
Reported2026-06-04 (per vendor advisory)
Fix landed2026-06-16 (public git)
Disclosed2026-07-29
Patch gap43 days — fix public in source before the advisory
Re-mapped on 2026-10-03: our pipeline had picked the earliest commit citing this bug (32213553c1ef), which an audit found was a preparatory/helper change, not the fix. This page now points to the commit whose diff removes the bug. No root-cause analysis is published for this CVE.

Changed Functions

FunctionChangeNotes
AILanguageModelTest
chrome/browser/ai/ai_language_model_unittest.cc
modified
AIManagerTest
chrome/browser/ai/ai_manager_unittest.cc
modified
AIManagerTest
chrome/browser/ai/ai_manager_unittest.cc
modified
TEST_F
chrome/browser/ai/ai_manager_unittest.cc
modified
AIProofreaderTest
chrome/browser/ai/ai_proofreader_unittest.cc
modified
AIProofreaderTest
chrome/browser/ai/ai_proofreader_unittest.cc
modified
TEST_F
chrome/browser/ai/ai_proofreader_unittest.cc
modified
AIRewriterTest
chrome/browser/ai/ai_rewriter_unittest.cc
modified
AIRewriterTest
chrome/browser/ai/ai_rewriter_unittest.cc
modified
TEST_F
chrome/browser/ai/ai_rewriter_unittest.cc
modified
AIRewriterManifestTest
chrome/browser/ai/ai_rewriter_unittest.cc
modified
AISummarizerTest
chrome/browser/ai/ai_summarizer_unittest.cc
modified
AISummarizerTest
chrome/browser/ai/ai_summarizer_unittest.cc
modified
TEST
chrome/browser/ai/ai_summarizer_unittest.cc
modified
AISummarizerManifestTest
chrome/browser/ai/ai_summarizer_unittest.cc
modified
AIWriterTest
chrome/browser/ai/ai_writer_unittest.cc
modified
AIWriterTest
chrome/browser/ai/ai_writer_unittest.cc
modified
TEST_F
chrome/browser/ai/ai_writer_unittest.cc
modified
AIWriterManifestTest
chrome/browser/ai/ai_writer_unittest.cc
modified

Files Changed

  • chrome/browser/ai/ai_language_model_unittest.cc
  • chrome/browser/ai/ai_manager.cc
  • chrome/browser/ai/ai_manager.h
  • chrome/browser/ai/ai_manager_unittest.cc
  • chrome/browser/ai/ai_proofreader_unittest.cc
  • chrome/browser/ai/ai_rewriter_unittest.cc
  • chrome/browser/ai/ai_summarizer_unittest.cc
  • chrome/browser/ai/ai_writer_unittest.cc
diff --git a/chrome/browser/ai/ai_manager.cc b/chrome/browser/ai/ai_manager.cc
index 2aa5ee4..e629c596 100644
--- a/chrome/browser/ai/ai_manager.cc
+++ b/chrome/browser/ai/ai_manager.cc
@@ -687,9 +687,25 @@
   receivers_.Add(this, std::move(receiver));
 }
 
+bool AIManager::IsPromptApiEnabled() const {
+  if (base::FeatureList::IsEnabled(blink::features::kAIPromptAPI)) {
+    return true;
+  }
+  if (base::FeatureList::IsEnabled(
+          blink::features::kAIPromptAPIMultimodalInput)) {
+    return true;
+  }
+  return false;
+}
+
 void AIManager::CanCreateLanguageModel(
     blink::mojom::AILanguageModelCreateOptionsPtr options,
     CanCreateLanguageModelCallback callback) {
+  if (!IsPromptApiEnabled()) {
+    std::move(callback).Run(blink::mojom::ModelAvailabilityCheckResult::
+                                kUnavailableFeatureNotEnabled);
+    return;
+  }
   if (IsPermissionsPolicyBlocked(
           network::mojom::PermissionsPolicyFeature::kLanguageModel)) {
     receivers_.ReportBadMessage("Permissions policy disabled");
@@ -758,6 +774,10 @@
     blink::mojom::AILanguageModelCreateOptionsPtr options,
     mojo::PendingRemote<on_device_model::mojom::DownloadObserver> monitor) {
   CHECK(options);
+  if (!IsPromptApiEnabled()) {
+    receivers_.ReportBadMessage("Feature not enabled");
+    return;
+  }
   if (IsBlocked(network::mojom::PermissionsPolicyFeature::kLanguageModel)) {
     receivers_.ReportBadMessage("Policy or user setting disabled");
     return;
@@ -936,6 +956,11 @@
 void AIManager::CanCreateSummarizer(
     blink::mojom::AISummarizerCreateOptionsPtr options,
     CanCreateSummarizerCallback callback) {
+  if (!base::FeatureList::IsEnabled(blink::features::kAISummarizationAPI)) {
+    std::move(callback).Run(blink::mojom::ModelAvailabilityCheckResult::
+                                kUnavailableFeatureNotEnabled);
+    return;
+  }
   if (IsPermissionsPolicyBlocked(
           network::mojom::PermissionsPolicyFeature::kSummarizer)) {
     receivers_.ReportBadMessage("Permissions policy disabled");
@@ -989,6 +1014,10 @@
     mojo::PendingRemote<blink::mojom::AIManagerCreateSummarizerClient> client,
     blink::mojom::AISummarizerCreateOptionsPtr options,
     mojo::PendingRemote<on_device_model::mojom::DownloadObserver> monitor) {
+  if (!base::FeatureList::IsEnabled(blink::features::kAISummarizationAPI)) {
+    receivers_.ReportBadMessage("Feature not enabled");
+    return;
+  }
   if (IsBlocked(network::mojom::PermissionsPolicyFeature::kSummarizer)) {
     receivers_.ReportBadMessage("Policy or user setting disabled");
     return;
@@ -1103,6 +1132,11 @@
 void AIManager::CanCreateProofreader(
     blink::mojom::AIProofreaderCreateOptionsPtr options,
     CanCreateProofreaderCallback callback) {
+  if (!base::FeatureList::IsEnabled(blink::features::kAIProofreadingAPI)) {
+    std::move(callback).Run(blink::mojom::ModelAvailabilityCheckResult::
+                                kUnavailableFeatureNotEnabled);
+    return;
+  }
   // TODO(crbug.com/466425250): Enforce permissions policy.
   // TODO(crbug.com/424673180): Add a warning message when options
   // `includeCorrectionTypes` and `includeCorrectionExplanations` are set to
@@ -1126,6 +1160,10 @@
     mojo::PendingRemote<blink::mojom::AIManagerCreateProofreaderClient> client,
     blink::mojom::AIProofreaderCreateOptionsPtr options,
     mojo::PendingRemote<on_device_model::mojom::DownloadObserver> monitor) {
+  if (!base::FeatureList::IsEnabled(blink::features::kAIProofreadingAPI)) {
+    receivers_.ReportBadMessage("Feature not enabled");
+    return;
+  }
   // TODO(crbug.com/466425250): Enforce permissions policy.
   if (IsBlocked()) {
     receivers_.ReportBadMessage("Policy or user setting disabled");
@@ -1234,6 +1272,11 @@
 
 void AIManager::CanCreateWriter(blink::mojom::AIWriterCreateOptionsPtr options,
                                 CanCreateWriterCallback callback) {
+  if (!base::FeatureList::IsEnabled(blink::features::kAIWriterAPI)) {
+    std::move(callback).Run(blink::mojom::ModelAvailabilityCheckResult::
+                                kUnavailableFeatureNotEnabled);
+    return;
+  }
   if (IsPermissionsPolicyBlocked(
           network::mojom::PermissionsPolicyFeature::kWriter)) {
     receivers_.ReportBadMessage("Permissions policy disabled");
@@ -1268,6 +1311,10 @@
     mojo::PendingRemote<blink::mojom::AIManagerCreateWriterClient> client,
     blink::mojom::AIWriterCreateOptionsPtr options,
     mojo::PendingRemote<on_device_model::mojom::DownloadObserver> monitor) {
+  if (!base::FeatureList::IsEnabled(blink::features::kAIWriterAPI)) {
+    receivers_.ReportBadMessage("Feature not enabled");
+    return;
+  }
   if (IsBlocked(network::mojom::PermissionsPolicyFeature::kWriter)) {
     receivers_.ReportBadMessage("Policy or user setting disabled");
     return;
@@ -1337,6 +1384,11 @@
 void AIManager::CanCreateRewriter(
     blink::mojom::AIRewriterCreateOptionsPtr options,
     CanCreateRewriterCallback callback) {
+  if (!base::FeatureList::IsEnabled(blink::features::kAIRewriterAPI)) {
+    std::move(callback).Run(blink::mojom::ModelAvailabilityCheckResult::
+                                kUnavailableFeatureNotEnabled);
+    return;
+  }
   if (IsPermissionsPolicyBlocked(
           network::mojom::PermissionsPolicyFeature::kRewriter)) {
     receivers_.ReportBadMessage("Permissions policy disabled");
@@ -1370,6 +1422,10 @@
     mojo::PendingRemote<blink::mojom::AIManagerCreateRewriterClient> client,
     blink::mojom::AIRewriterCreateOptionsPtr options,
     mojo::PendingRemote<on_device_model::mojom::DownloadObserver> monitor) {
+  if (!base::FeatureList::IsEnabled(blink::features::kAIRewriterAPI)) {
+    receivers_.ReportBadMessage("Feature not enabled");
+    return;
+  }
   if (IsBlocked(network::mojom::PermissionsPolicyFeature::kRewriter)) {
     receivers_.ReportBadMessage("Policy or user setting disabled");
     return;
@@ -1440,7 +1496,8 @@
     blink::mojom::AIClassifierCreateOptionsPtr options,
     CanCreateClassifierCallback callback) {
   if (!base::FeatureList::IsEnabled(blink::features::kAIClassifierAPI)) {
-    receivers_.ReportBadMessage("Feature not enabled");
+    std::move(callback).Run(blink::mojom::ModelAvailabilityCheckResult::
+                                kUnavailableFeatureNotEnabled);
     return;
   }
   // TODO(crbug.com/499365168): Enforce permissions policy and
diff --git a/chrome/browser/ai/ai_manager.h b/chrome/browser/ai/ai_manager.h
index 79b050c5..37271f01 100644
--- a/chrome/browser/ai/ai_manager.h
+++ b/chrome/browser/ai/ai_manager.h
@@ -165,6 +165,8 @@
       const base::flat_set<std::string>& default_supported);
 
  private:
+  bool IsPromptApiEnabled() const;
+
   base::OnceCallback<void(std::unique_ptr<optimization_guide::OnDeviceSession>)>
   CreateSummarizerSessionCallback(
       blink::mojom::AISummarizerCreateOptionsPtr options,
diff --git a/chrome/browser/ai/ai_language_model_unittest.cc b/chrome/browser/ai/ai_language_model_unittest.cc
index 94f36c8..02cc58d 100644
--- a/chrome/browser/ai/ai_language_model_unittest.cc
+++ b/chrome/browser/ai/ai_language_model_unittest.cc
@@ -275,7 +275,8 @@
  public:
   AILanguageModelTest() {
     scoped_feature_list_.InitWithFeaturesAndParameters(
-        {{blink::features::kAIPromptAPIMultimodalInput, {}},
+        {{blink::features::kAIPromptAPI, {}},
+         {blink::features::kAIPromptAPIMultimodalInput, {}},
          {features::kAILanguageModelOverrideConfiguration,
           {{"ai_language_model_output_buffer", "100"}}},
          {features::kAILanguageModelAppendOutputTokensToContext, {}},
diff --git a/chrome/browser/ai/ai_manager_unittest.cc b/chrome/browser/ai/ai_manager_unittest.cc
index 571e471..954ec75 100644
--- a/chrome/browser/ai/ai_manager_unittest.cc
+++ b/chrome/browser/ai/ai_manager_unittest.cc
@@ -28,6 +28,7 @@
 #include "components/policy/core/common/policy_pref_names.h"
 #include "components/prefs/pref_service.h"
 #include "content/public/browser/web_contents.h"
+#include "mojo/public/cpp/test_support/test_utils.h"
 #include "mojo/public/mojom/base/work_in_progress.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/features_generated.h"
@@ -59,8 +60,12 @@
 class AIManagerTest : public AITestUtils::AITestBase {
  public:
   AIManagerTest() {
-    scoped_feature_list_.InitAndEnableFeature(
-        blink::features::kAIClassifierAPI);
+    scoped_feature_list_.InitWithFeatures(
+        {blink::features::kAIPromptAPI, blink::features::kAIWriterAPI,
+         blink::features::kAISummarizationAPI, blink::features::kAIRewriterAPI,
+         blink::features::kAIProofreadingAPI,
+         blink::features::kAIClassifierAPI},
+        {});
   }
 
  protected:
@@ -172,6 +177,30 @@
   }
 }
 
+TEST_F(AIManagerTest, CanCreateFeatureDisabled) {
+  base::test::ScopedFeatureList scoped_feature_list;
+  scoped_feature_list.InitWithFeatures(
+      {}, {blink::features::kAIPromptAPI,
+           blink::features::kAIPromptAPIMultimodalInput,
+           blink::features::kAIWriterAPI, blink::features::kAISummarizationAPI,
+           blink::features::kAIRewriterAPI, blink::features::kAIProofreadingAPI,
+           blink::features::kAIClassifierAPI});
+
+  base::MockCallback<
+      base::OnceCallback<void(blink::mojom::ModelAvailabilityCheckResult)>>
+      callback;
+  EXPECT_CALL(callback, Run(blink::mojom::ModelAvailabilityCheckResult::
+                                kUnavailableFeatureNotEnabled))
+      .Times(6);
+
+  ai_manager_->CanCreateLanguageModel(/*options=*/{}, callback.Get());
+  ai_manager_->CanCreateWriter(/*options=*/{}, callback.Get());
+  ai_manager_->CanCreateSummarizer(/*options=*/{}, callback.Get());
+  ai_manager_->CanCreateRewriter(/*options=*/{}, callback.Get());
+  ai_manager_->CanCreateProofreader(/*options=*/{}, callback.Get());
+  ai_manager_->CanCreateClassifier(/*options=*/{}, callback.Get());
+}
+
 TEST_F(AIManagerTest, CanCreateEnterprisePolicyDisabled) {
   SetBuiltInAIAPIsEnterprisePolicy(false);
   base::MockCallback<
diff --git a/chrome/browser/ai/ai_proofreader_unittest.cc b/chrome/browser/ai/ai_proofreader_unittest.cc
index c94ce91a..816f903 100644
--- a/chrome/browser/ai/ai_proofreader_unittest.cc
+++ b/chrome/browser/ai/ai_proofreader_unittest.cc
@@ -31,6 +31,7 @@
 #include "services/on_device_model/public/cpp/features.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/common/features_generated.h"
 #include "third_party/blink/public/mojom/ai/ai_manager.mojom.h"
 #include "third_party/blink/public/mojom/ai/model_streaming_responder.mojom.h"
 
@@ -124,6 +125,12 @@
 }
 
 class AIProofreaderTest : public AITestUtils::AITestBase {
+ public:
+  AIProofreaderTest() {
+    scoped_feature_list_.InitAndEnableFeature(
+        blink::features::kAIProofreadingAPI);
+  }
+
  protected:
   optimization_guide::proto::OnDeviceModelExecutionFeatureConfig CreateConfig()
       override {
@@ -203,6 +210,9 @@
     auto result = proofreader_client.result().Take();
     EXPECT_OK(result);
   }
+
+ private:
+  base::test::ScopedFeatureList scoped_feature_list_;
 };
 
 TEST_F(AIProofreaderTest, CreateProofreaderNoService) {
diff --git a/chrome/browser/ai/ai_rewriter_unittest.cc b/chrome/browser/ai/ai_rewriter_unittest.cc
index 6ec1729..0c929d08 100644
--- a/chrome/browser/ai/ai_rewriter_unittest.cc
+++ b/chrome/browser/ai/ai_rewriter_unittest.cc
@@ -38,6 +38,7 @@
 #include "services/on_device_model/public/cpp/features.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/common/features_generated.h"
 #include "third_party/blink/public/mojom/ai/ai_manager.mojom.h"
 #include "third_party/blink/public/mojom/ai/model_streaming_responder.mojom.h"
 
@@ -163,6 +164,11 @@
 }
 
 class AIRewriterTest : public AITestUtils::AITestBase {
+ public:
+  AIRewriterTest() {
+    scoped_feature_list_.InitAndEnableFeature(blink::features::kAIRewriterAPI);
+  }
+
  protected:
   optimization_guide::proto::OnDeviceModelExecutionFeatureConfig CreateConfig()
       override {
@@ -225,6 +231,9 @@
     auto result = rewriter_client.result().Take();
     EXPECT_OK(result);
   }
+
+ private:
+  base::test::ScopedFeatureList scoped_feature_list_;
 };
 
 TEST_F(AIRewriterTest, CreateRewriterNoService) {
@@ -793,7 +802,8 @@
  public:
   AIRewriterManifestTest() {
     scoped_feature_list_.InitWithFeatures(
-        {optimization_guide::kOptimizationGuideManifestBroker,
+        {blink::features::kAIRewriterAPI,
+         optimization_guide::kOptimizationGuideManifestBroker,
          on_device_model::features::kOnDeviceModelLitertLmBackend},
         {});
   }
diff --git a/chrome/browser/ai/ai_summarizer_unittest.cc b/chrome/browser/ai/ai_summarizer_unittest.cc
index e299ffa8..44d4be61 100644
--- a/chrome/browser/ai/ai_summarizer_unittest.cc
+++ b/chrome/browser/ai/ai_summarizer_unittest.cc
@@ -134,6 +134,12 @@
 #endif  // !BUILDFLAG(IS_ANDROID)
 
 class AISummarizerTest : public AITestUtils::AITestBase {
+ public:
+  AISummarizerTest() {
+    scoped_feature_list_.InitAndEnableFeature(
+        blink::features::kAISummarizationAPI);
+  }
+
  protected:
   optimization_guide::proto::OnDeviceModelExecutionFeatureConfig CreateConfig()
       override {
@@ -215,6 +221,9 @@
     auto result = summarizer_client.result().Take();
     EXPECT_OK(result);
   }
+
+ private:
+  base::test::ScopedFeatureList scoped_feature_list_;
 };
 
 TEST(AISummarizerStandaloneTest, CombineContexts) {
@@ -898,7 +907,8 @@
  public:
   AISummarizerManifestTest() {
     scoped_feature_list_.InitWithFeaturesAndParameters(
-        {{blink::features::kAISummarizationPerformancePreference, {}},
+        {{blink::features::kAISummarizationAPI, {}},
+         {blink::features::kAISummarizationPerformancePreference, {}},
          {optimization_guide::kOptimizationGuideManifestBroker, {}},
          {on_device_model::features::kOnDeviceModelLitertLmBackend, {}}},
         {});
diff --git a/chrome/browser/ai/ai_writer_unittest.cc b/chrome/browser/ai/ai_writer_unittest.cc
index 25a4f20..31900186 100644
--- a/chrome/browser/ai/ai_writer_unittest.cc
+++ b/chrome/browser/ai/ai_writer_unittest.cc
@@ -37,6 +37,7 @@
 #include "services/on_device_model/public/cpp/features.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/common/features_generated.h"
 #include "third_party/blink/public/mojom/ai/ai_manager.mojom.h"
 #include "third_party/blink/public/mojom/ai/model_streaming_responder.mojom.h"
 
@@ -162,6 +163,11 @@
 }
 
 class AIWriterTest : public AITestUtils::AITestBase {
+ public:
+  AIWriterTest() {
+    scoped_feature_list_.InitAndEnableFeature(blink::features::kAIWriterAPI);
+  }
+
  protected:
   optimization_guide::proto::OnDeviceModelExecutionFeatureConfig CreateConfig()
       override {
@@ -224,6 +230,9 @@
     auto result = writer_client.result().Take();
     EXPECT_OK(result);
   }
+
+ private:
+  base::test::ScopedFeatureList scoped_feature_list_;
 };
 
 TEST_F(AIWriterTest, CanCreateDefaultOptions) {
@@ -780,7 +789,8 @@
  protected:
   AIWriterManifestTest() {
     scoped_feature_list_.InitWithFeatures(
-        {optimization_guide::kOptimizationGuideManifestBroker,
+        {blink::features::kAIWriterAPI,
+         optimization_guide::kOptimizationGuideManifestBroker,
          on_device_model::features::kOnDeviceModelLitertLmBackend},
         {});
   }
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/chrome/browser/ai/ai_language_model_unittest.cc b/chrome/browser/ai/ai_language_model_unittest.cc
index 94f36c8..02cc58d 100644
--- a/chrome/browser/ai/ai_language_model_unittest.cc
+++ b/chrome/browser/ai/ai_language_model_unittest.cc
@@ -275,7 +275,8 @@
  public:
   AILanguageModelTest() {
     scoped_feature_list_.InitWithFeaturesAndParameters(
-        {{blink::features::kAIPromptAPIMultimodalInput, {}},
+        {{blink::features::kAIPromptAPI, {}},
+         {blink::features::kAIPromptAPIMultimodalInput, {}},
          {features::kAILanguageModelOverrideConfiguration,
           {{"ai_language_model_output_buffer", "100"}}},
          {features::kAILanguageModelAppendOutputTokensToContext, {}},
diff --git a/chrome/browser/ai/ai_manager_unittest.cc b/chrome/browser/ai/ai_manager_unittest.cc
index 571e471..954ec75 100644
--- a/chrome/browser/ai/ai_manager_unittest.cc
+++ b/chrome/browser/ai/ai_manager_unittest.cc
@@ -28,6 +28,7 @@
 #include "components/policy/core/common/policy_pref_names.h"
 #include "components/prefs/pref_service.h"
 #include "content/public/browser/web_contents.h"
+#include "mojo/public/cpp/test_support/test_utils.h"
 #include "mojo/public/mojom/base/work_in_progress.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/features_generated.h"
@@ -59,8 +60,12 @@
 class AIManagerTest : public AITestUtils::AITestBase {
  public:
   AIManagerTest() {
-    scoped_feature_list_.InitAndEnableFeature(
-        blink::features::kAIClassifierAPI);
+    scoped_feature_list_.InitWithFeatures(
+        {blink::features::kAIPromptAPI, blink::features::kAIWriterAPI,
+         blink::features::kAISummarizationAPI, blink::features::kAIRewriterAPI,
+         blink::features::kAIProofreadingAPI,
+         blink::features::kAIClassifierAPI},
+        {});
   }
 
  protected:
@@ -172,6 +177,30 @@
   }
 }
 
+TEST_F(AIManagerTest, CanCreateFeatureDisabled) {
+  base::test::ScopedFeatureList scoped_feature_list;
+  scoped_feature_list.InitWithFeatures(
+      {}, {blink::features::kAIPromptAPI,
+           blink::features::kAIPromptAPIMultimodalInput,
+           blink::features::kAIWriterAPI, blink::features::kAISummarizationAPI,
+           blink::features::kAIRewriterAPI, blink::features::kAIProofreadingAPI,
+           blink::features::kAIClassifierAPI});
+
+  base::MockCallback<
+      base::OnceCallback<void(blink::mojom::ModelAvailabilityCheckResult)>>
+      callback;
+  EXPECT_CALL(callback, Run(blink::mojom::ModelAvailabilityCheckResult::
+                                kUnavailableFeatureNotEnabled))
+      .Times(6);
+
+  ai_manager_->CanCreateLanguageModel(/*options=*/{}, callback.Get());
+  ai_manager_->CanCreateWriter(/*options=*/{}, callback.Get());
+  ai_manager_->CanCreateSummarizer(/*options=*/{}, callback.Get());
+  ai_manager_->CanCreateRewriter(/*options=*/{}, callback.Get());
+  ai_manager_->CanCreateProofreader(/*options=*/{}, callback.Get());
+  ai_manager_->CanCreateClassifier(/*options=*/{}, callback.Get());
+}
+
 TEST_F(AIManagerTest, CanCreateEnterprisePolicyDisabled) {
   SetBuiltInAIAPIsEnterprisePolicy(false);
   base::MockCallback<
diff --git a/chrome/browser/ai/ai_proofreader_unittest.cc b/chrome/browser/ai/ai_proofreader_unittest.cc
index c94ce91a..816f903 100644
--- a/chrome/browser/ai/ai_proofreader_unittest.cc
+++ b/chrome/browser/ai/ai_proofreader_unittest.cc
@@ -31,6 +31,7 @@
 #include "services/on_device_model/public/cpp/features.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/common/features_generated.h"
 #include "third_party/blink/public/mojom/ai/ai_manager.mojom.h"
 #include "third_party/blink/public/mojom/ai/model_streaming_responder.mojom.h"
 
@@ -124,6 +125,12 @@
 }
 
 class AIProofreaderTest : public AITestUtils::AITestBase {
+ public:
+  AIProofreaderTest() {
+    scoped_feature_list_.InitAndEnableFeature(
+        blink::features::kAIProofreadingAPI);
+  }
+
  protected:
   optimization_guide::proto::OnDeviceModelExecutionFeatureConfig CreateConfig()
       override {
@@ -203,6 +210,9 @@
     auto result = proofreader_client.result().Take();
     EXPECT_OK(result);
   }
+
+ private:
+  base::test::ScopedFeatureList scoped_feature_list_;
 };
 
 TEST_F(AIProofreaderTest, CreateProofreaderNoService) {
diff --git a/chrome/browser/ai/ai_rewriter_unittest.cc b/chrome/browser/ai/ai_rewriter_unittest.cc
index 6ec1729..0c929d08 100644
--- a/chrome/browser/ai/ai_rewriter_unittest.cc
+++ b/chrome/browser/ai/ai_rewriter_unittest.cc
@@ -38,6 +38,7 @@
 #include "services/on_device_model/public/cpp/features.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/common/features_generated.h"
 #include "third_party/blink/public/mojom/ai/ai_manager.mojom.h"
 #include "third_party/blink/public/mojom/ai/model_streaming_responder.mojom.h"
 
@@ -163,6 +164,11 @@
 }
 
 class AIRewriterTest : public AITestUtils::AITestBase {
+ public:
+  AIRewriterTest() {
+    scoped_feature_list_.InitAndEnableFeature(blink::features::kAIRewriterAPI);
+  }
+
  protected:
   optimization_guide::proto::OnDeviceModelExecutionFeatureConfig CreateConfig()
       override {
@@ -225,6 +231,9 @@
     auto result = rewriter_client.result().Take();
     EXPECT_OK(result);
   }
+
+ private:
+  base::test::ScopedFeatureList scoped_feature_list_;
 };
 
 TEST_F(AIRewriterTest, CreateRewriterNoService) {
@@ -793,7 +802,8 @@
  public:
   AIRewriterManifestTest() {
     scoped_feature_list_.InitWithFeatures(
-        {optimization_guide::kOptimizationGuideManifestBroker,
+        {blink::features::kAIRewriterAPI,
+         optimization_guide::kOptimizationGuideManifestBroker,
          on_device_model::features::kOnDeviceModelLitertLmBackend},
         {});
   }
diff --git a/chrome/browser/ai/ai_summarizer_unittest.cc b/chrome/browser/ai/ai_summarizer_unittest.cc
index e299ffa8..44d4be61 100644
--- a/chrome/browser/ai/ai_summarizer_unittest.cc
+++ b/chrome/browser/ai/ai_summarizer_unittest.cc
@@ -134,6 +134,12 @@
 #endif  // !BUILDFLAG(IS_ANDROID)
 
 class AISummarizerTest : public AITestUtils::AITestBase {
+ public:
+  AISummarizerTest() {
+    scoped_feature_list_.InitAndEnableFeature(
+        blink::features::kAISummarizationAPI);
+  }
+
  protected:
   optimization_guide::proto::OnDeviceModelExecutionFeatureConfig CreateConfig()
       override {
@@ -215,6 +221,9 @@
     auto result = summarizer_client.result().Take();
     EXPECT_OK(result);
   }
+
+ private:
+  base::test::ScopedFeatureList scoped_feature_list_;
 };
 
 TEST(AISummarizerStandaloneTest, CombineContexts) {
@@ -898,7 +907,8 @@
  public:
   AISummarizerManifestTest() {
     scoped_feature_list_.InitWithFeaturesAndParameters(
-        {{blink::features::kAISummarizationPerformancePreference, {}},
+        {{blink::features::kAISummarizationAPI, {}},
+         {blink::features::kAISummarizationPerformancePreference, {}},
          {optimization_guide::kOptimizationGuideManifestBroker, {}},
          {on_device_model::features::kOnDeviceModelLitertLmBackend, {}}},
         {});
diff --git a/chrome/browser/ai/ai_writer_unittest.cc b/chrome/browser/ai/ai_writer_unittest.cc
index 25a4f20..31900186 100644
--- a/chrome/browser/ai/ai_writer_unittest.cc
+++ b/chrome/browser/ai/ai_writer_unittest.cc
@@ -37,6 +37,7 @@
 #include "services/on_device_model/public/cpp/features.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/common/features_generated.h"
 #include "third_party/blink/public/mojom/ai/ai_manager.mojom.h"
 #include "third_party/blink/public/mojom/ai/model_streaming_responder.mojom.h"
 
@@ -162,6 +163,11 @@
 }
 
 class AIWriterTest : public AITestUtils::AITestBase {
+ public:
+  AIWriterTest() {
+    scoped_feature_list_.InitAndEnableFeature(blink::features::kAIWriterAPI);
+  }
+
  protected:
   optimization_guide::proto::OnDeviceModelExecutionFeatureConfig CreateConfig()
       override {
@@ -224,6 +230,9 @@
     auto result = writer_client.result().Take();
     EXPECT_OK(result);
   }
+
+ private:
+  base::test::ScopedFeatureList scoped_feature_list_;
 };
 
 TEST_F(AIWriterTest, CanCreateDefaultOptions) {
@@ -780,7 +789,8 @@
  protected:
   AIWriterManifestTest() {
     scoped_feature_list_.InitWithFeatures(
-        {optimization_guide::kOptimizationGuideManifestBroker,
+        {blink::features::kAIWriterAPI,
+         optimization_guide::kOptimizationGuideManifestBroker,
          on_device_model::features::kOnDeviceModelLitertLmBackend},
         {});
   }
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.