Chrome · AI
CVE-2026-17991
Logic Error in AI
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
chrome/browser/extensions/ai_language_model_browsertest.ccchrome/renderer/chrome_content_renderer_client.ccdocs/experiments/prompt-api-for-extension.mdthird_party/blink/renderer/platform/runtime_enabled_features.json5
Patch
From 32213553c1efcb656069b417b19db79c7c3f8f71 Mon Sep 17 00:00:00 2001 From: Jingyun Liu <[email protected]> Date: Wed, 10 Jun 2026 11:54:47 -0700 Subject: [PATCH] Remove the PromptAPIForExtension flag as it has shipped for a while Bug: 520110535 Change-Id: I98fd0ff12a715dccca18f493c4d4532e4912529c Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7914988 Reviewed-by: Andrea Orru <[email protected]> Commit-Queue: Jingyun Liu <[email protected]> Reviewed-by: Frank Li <[email protected]> Reviewed-by: Dave Tapuska <[email protected]> Reviewed-by: Mike Wasserman <[email protected]> Cr-Commit-Position: refs/heads/main@{#1644764} --- diff --git a/chrome/browser/extensions/ai_language_model_browsertest.cc b/chrome/browser/extensions/ai_language_model_browsertest.cc index b28c3f43..a14fae0 100644 --- a/chrome/browser/extensions/ai_language_model_browsertest.cc +++ b/chrome/browser/extensions/ai_language_model_browsertest.cc @@ -46,17 +46,13 @@ // The boolean tuple describing: // 1. if the `kAIPromptAPI` chrome://flag is explicitly enabled; // 2. if the `kAIPromptAPI` kill switch is triggered; -// 3. if the `kAIPromptAPIForExtension` kill switch is triggered; -using Variant = std::tuple<bool, bool, bool>; +using Variant = std::tuple<bool, bool>; bool IsAPIFlagEnabled(Variant v) { return std::get<0>(v); } bool IsAPIKillSwitchTriggered(Variant v) { return std::get<1>(v); } -bool IsExtensionKillSwitchTriggered(Variant v) { - return std::get<2>(v); -} // Describes the test variants in a meaningful way in the parameterized tests. std::string DescribeTestVariant(const testing::TestParamInfo<Variant> info) { @@ -65,11 +61,8 @@ std::string api_kill_switch = IsAPIKillSwitchTriggered(info.param) ? "WithAPIKillswitch" : "NoAPIKillswitch"; - std::string extension_kill_switch = IsExtensionKillSwitchTriggered(info.param) - ? "WithExtensionKillswitch" - : "NoExtensionKillswitch"; return base::JoinString( - {api_flag_enabled, api_kill_switch, extension_kill_switch}, "_"); + {api_flag_enabled, api_kill_switch}, "_"); } } // namespace @@ -97,9 +90,6 @@ if (IsAPIKillSwitchTriggered(GetParam())) { feature_states[blink::features::kAIPromptAPI] = false; } - if (IsExtensionKillSwitchTriggered(GetParam())) { - feature_states[blink::features::kAIPromptAPIForExtension] = false; - } feature_list_.InitWithFeatureStates(feature_states); } @@ -110,7 +100,7 @@ INSTANTIATE_TEST_SUITE_P( /* no prefix */, MAYBE_ExtensionAILanguageModelBrowserTest, - testing::Combine(testing::Bool(), testing::Bool(), testing::Bool()), + testing::Combine(testing::Bool(), testing::Bool()), &DescribeTestVariant); // Check whether the API is exposed to the extension worker when expected. diff --git a/chrome/renderer/chrome_content_renderer_client.cc b/chrome/renderer/chrome_content_renderer_client.cc index e177ede..1579f8e0 100644 --- a/chrome/renderer/chrome_content_renderer_client.cc +++ b/chrome/renderer/chrome_content_renderer_client.cc @@ -1450,11 +1450,6 @@ #if !BUILDFLAG(IS_ANDROID) blink::WebRuntimeFeatures::EnableWebHIDOnServiceWorkers(true); #endif // !BUILDFLAG(IS_ANDROID) - if (blink::WebRuntimeFeatures::IsAIPromptAPIForExtensionEnabled() && - base::FeatureList::IsEnabled( - blink::features::kAIPromptAPIForExtension)) { - blink::WebRuntimeFeatures::EnableAIPromptAPI(true); - } blink::WebRuntimeFeatures::EnableAIPromptAPIForWorkers(true); blink::WebRuntimeFeatures::EnableAIPromptAPILegacyIdentifiers(true); blink::WebRuntimeFeatures::EnableAIPromptAPILegacyParams(true); diff --git a/docs/experiments/prompt-api-for-extension.md b/docs/experiments/prompt-api-for-extension.md deleted file mode 100644 index 6e54178..0000000 --- a/docs/experiments/prompt-api-for-extension.md +++ /dev/null @@ -1,40 +0,0 @@ -# Prompt API for extension - -This document describes the status of the current implementation of the -[**Prompt API**](https://github.com/webmachinelearning/prompt-api) for Chrome -extensions, and how to verify. - -## What’s supported - -The implementation generally intends to follow the -[explainer](https://github.com/explainers-by-googlers/prompt-api). - -## Activation - -The API can be enabled by participating in the -[extension origin trial](https://developer.chrome.com/blog/prompt-api-origin-trial) -named `AIPromptAPIForExtension`. After obtaining the trial token, the -extension authors need to configure it in the `manifest.json`: - -```json -{ - "trial_tokens": [<GENERATED_TOKEN>], -} -``` - -## Verifying the API is working - -The extension authors can verify if the API is available by checking for the -presence of the `LanguageModel` entrypoint from extension window and worker -scripts. If the object is defined, the authors can follow the -[explainer](https://github.com/explainers-by-googlers/prompt-api) and -[developer docs](https://developer.chrome.com/docs/extensions/ai/prompt-api) -to check availability and test the APIs usage. - -## Related Links - -- [Explainer on GitHub](https://github.com/webmachinelearning/prompt-api) -- [API feedback](https://github.com/webmachinelearning/prompt-api/issues) -- [Reporting bugs](https://issues.chromium.org/issues/new?component=1583624) -- [Extension origin trial](https://developer.chrome.com/blog/prompt-api-origin-trial) -- [Developer docs](https://developer.chrome.com/docs/extensions/ai/prompt-api) diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5 index e682956..9d39720 100644 --- a/third_party/blink/renderer/platform/runtime_enabled_features.json5 +++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5 @@ -410,18 +410,6 @@ }, }, { - // Extension access to "AIPromptAPI". - name: "AIPromptAPIForExtension", - public: true, - status: { - "Win": "stable", - "Mac": "stable", - "Linux": "stable", - "ChromeOS": "stable", - "default": "", - }, - }, - { name: "AIPromptAPIForWorkers", public: true, },
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/chrome/browser/extensions/ai_language_model_browsertest.cc b/chrome/browser/extensions/ai_language_model_browsertest.cc
index b28c3f43..a14fae0 100644
--- a/chrome/browser/extensions/ai_language_model_browsertest.cc
+++ b/chrome/browser/extensions/ai_language_model_browsertest.cc
@@ -46,17 +46,13 @@
// The boolean tuple describing:
// 1. if the `kAIPromptAPI` chrome://flag is explicitly enabled;
// 2. if the `kAIPromptAPI` kill switch is triggered;
-// 3. if the `kAIPromptAPIForExtension` kill switch is triggered;
-using Variant = std::tuple<bool, bool, bool>;
+using Variant = std::tuple<bool, bool>;
bool IsAPIFlagEnabled(Variant v) {
return std::get<0>(v);
}
bool IsAPIKillSwitchTriggered(Variant v) {
return std::get<1>(v);
}
-bool IsExtensionKillSwitchTriggered(Variant v) {
- return std::get<2>(v);
-}
// Describes the test variants in a meaningful way in the parameterized tests.
std::string DescribeTestVariant(const testing::TestParamInfo<Variant> info) {
@@ -65,11 +61,8 @@
std::string api_kill_switch = IsAPIKillSwitchTriggered(info.param)
? "WithAPIKillswitch"
: "NoAPIKillswitch";
- std::string extension_kill_switch = IsExtensionKillSwitchTriggered(info.param)
- ? "WithExtensionKillswitch"
- : "NoExtensionKillswitch";
return base::JoinString(
- {api_flag_enabled, api_kill_switch, extension_kill_switch}, "_");
+ {api_flag_enabled, api_kill_switch}, "_");
}
} // namespace
@@ -97,9 +90,6 @@
if (IsAPIKillSwitchTriggered(GetParam())) {
feature_states[blink::features::kAIPromptAPI] = false;
}
- if (IsExtensionKillSwitchTriggered(GetParam())) {
- feature_states[blink::features::kAIPromptAPIForExtension] = false;
- }
feature_list_.InitWithFeatureStates(feature_states);
}
@@ -110,7 +100,7 @@
INSTANTIATE_TEST_SUITE_P(
/* no prefix */,
MAYBE_ExtensionAILanguageModelBrowserTest,
- testing::Combine(testing::Bool(), testing::Bool(), testing::Bool()),
+ testing::Combine(testing::Bool(), testing::Bool()),
&DescribeTestVariant);
// Check whether the API is exposed to the extension worker when expected.
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page