Low chrome Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInappropriate implementation in Chrome for iOS
DescriptionInappropriate implementation in Chrome for iOS
ComponentChrome for iOS
Bug ClassLogic Error
Tracker522479633
Fix commit1b6768698b4b (chromium/src) +39/-2
CISA KEVNot listed
CreditedGoogle
Disclosed2026-07-29

Changed Functions

FunctionChangeNotes
if
ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator.mm
modified
ReauthenticationCoordinatorTest
ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
modified

Files Changed

  • ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator.mm
  • ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
From 1b6768698b4b36c888cf30843e8b2959b22d2bd3 Mon Sep 17 00:00:00 2001
From: Rafał Godlewski <[email protected]>
Date: Tue, 16 Jun 2026 00:46:05 -0700
Subject: [PATCH] [iOS] Close UI on failed reauth VC push in foreground inactive

Fixed: 522479633
Change-Id: I7bba821c3699cef35cc74afe6f86e6183eb0b4b9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7927831
Reviewed-by: Ernesto Izquierdo Clua <[email protected]>
Commit-Queue: Rafał Godlewski <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1647368}
---

diff --git a/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator.mm b/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator.mm
index 0f6004eb..18faaa6 100644
--- a/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator.mm
+++ b/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator.mm
@@ -240,9 +240,11 @@
       }
       [[fallthrough]];
     case SceneActivationLevelForegroundInactive:
-      // Present reauth vc if not presented already.
+      // If pushing view controller fails, close the UI.
       if (!_reauthViewController) {
-        [self pushReauthenticationViewControllerWithRequestAuth:NO];
+        if (![self pushReauthenticationViewControllerWithRequestAuth:NO]) {
+          [self closeUI];
+        }
       }
       break;
 
diff --git a/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm b/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
index 5a6e51b6b..3d887457 100644
--- a/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
+++ b/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
@@ -63,6 +63,18 @@
 
 @end
 
+@interface FailedPushNavigationController : UINavigationController
+@end
+
+@implementation FailedPushNavigationController
+
+- (void)pushViewController:(UIViewController*)viewController
+                  animated:(BOOL)animated {
+  // Simulate push failure by doing nothing.
+}
+
+@end
+
 // Test fixture for LocalReauthenticationCoordinator.
 class ReauthenticationCoordinatorTest : public PlatformTest {
  protected:
@@ -351,3 +363,26 @@
       base_navigation_controller_.topViewController;
   EXPECT_TRUE(topViewController.modalInPresentation);
 }
+
+// Tests that if pushing the reauth view controller fails on ForegroundInactive,
+// the coordinator dismisses the sensitive UI.
+TEST_F(ReauthenticationCoordinatorTest,
+       ReauthViewControllerClosesUIOnFailedVCPush) {
+  FailedPushNavigationController* navigation_controller =
+      [[FailedPushNavigationController alloc]
+          initWithRootViewController:[[UIViewController alloc] init]];
+  scoped_window_.Get().rootViewController = navigation_controller;
+
+  LocalReauthenticationCoordinator* coordinator =
+      [[LocalReauthenticationCoordinator alloc]
+          initWithBaseNavigationController:navigation_controller
+                                   browser:browser_.get()
+                               authOnStart:NO];
+  coordinator.delegate = delegate_;
+  [coordinator start];
+
+  scene_state_.activationLevel = SceneActivationLevelForegroundInactive;
+  EXPECT_TRUE(delegate_.dismissUICalled);
+
+  [coordinator stop];
+}
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm b/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
index 5a6e51b6b..3d887457 100644
--- a/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
+++ b/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
@@ -63,6 +63,18 @@
 
 @end
 
+@interface FailedPushNavigationController : UINavigationController
+@end
+
+@implementation FailedPushNavigationController
+
+- (void)pushViewController:(UIViewController*)viewController
+                  animated:(BOOL)animated {
+  // Simulate push failure by doing nothing.
+}
+
+@end
+
 // Test fixture for LocalReauthenticationCoordinator.
 class ReauthenticationCoordinatorTest : public PlatformTest {
  protected:
@@ -351,3 +363,26 @@
       base_navigation_controller_.topViewController;
   EXPECT_TRUE(topViewController.modalInPresentation);
 }
+
+// Tests that if pushing the reauth view controller fails on ForegroundInactive,
+// the coordinator dismisses the sensitive UI.
+TEST_F(ReauthenticationCoordinatorTest,
+       ReauthViewControllerClosesUIOnFailedVCPush) {
+  FailedPushNavigationController* navigation_controller =
+      [[FailedPushNavigationController alloc]
+          initWithRootViewController:[[UIViewController alloc] init]];
+  scoped_window_.Get().rootViewController = navigation_controller;
+
+  LocalReauthenticationCoordinator* coordinator =
+      [[LocalReauthenticationCoordinator alloc]
+          initWithBaseNavigationController:navigation_controller
+                                   browser:browser_.get()
+                               authOnStart:NO];
+  coordinator.delegate = delegate_;
+  [coordinator start];
+
+  scene_state_.activationLevel = SceneActivationLevelForegroundInactive;
+  EXPECT_TRUE(delegate_.dismissUICalled);
+
+  [coordinator stop];
+}
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.