Chrome · Chrome for iOS
CVE-2026-18011
Logic Error in Chrome for iOS
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator.mm |
modified | |
ReauthenticationCoordinatorTestios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm |
modified |
Files Changed
ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator.mmios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
Patch
From 1b6768698b4b36c888cf30843e8b2959b22d2bd3 Mon Sep 17 00:00:00 2001 From: Rafał Godlewski <[email protected]> Date: Tue, 16 Jun 2026 00:46:05 -0700 Subject: [PATCH] [iOS] Close UI on failed reauth VC push in foreground inactive Fixed: 522479633 Change-Id: I7bba821c3699cef35cc74afe6f86e6183eb0b4b9 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7927831 Reviewed-by: Ernesto Izquierdo Clua <[email protected]> Commit-Queue: Rafał Godlewski <[email protected]> Cr-Commit-Position: refs/heads/main@{#1647368} --- diff --git a/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator.mm b/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator.mm index 0f6004eb..18faaa6 100644 --- a/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator.mm +++ b/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator.mm @@ -240,9 +240,11 @@ } [[fallthrough]]; case SceneActivationLevelForegroundInactive: - // Present reauth vc if not presented already. + // If pushing view controller fails, close the UI. if (!_reauthViewController) { - [self pushReauthenticationViewControllerWithRequestAuth:NO]; + if (![self pushReauthenticationViewControllerWithRequestAuth:NO]) { + [self closeUI]; + } } break; diff --git a/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm b/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm index 5a6e51b6b..3d887457 100644 --- a/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm +++ b/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm @@ -63,6 +63,18 @@ @end +@interface FailedPushNavigationController : UINavigationController +@end + +@implementation FailedPushNavigationController + +- (void)pushViewController:(UIViewController*)viewController + animated:(BOOL)animated { + // Simulate push failure by doing nothing. +} + +@end + // Test fixture for LocalReauthenticationCoordinator. class ReauthenticationCoordinatorTest : public PlatformTest { protected: @@ -351,3 +363,26 @@ base_navigation_controller_.topViewController; EXPECT_TRUE(topViewController.modalInPresentation); } + +// Tests that if pushing the reauth view controller fails on ForegroundInactive, +// the coordinator dismisses the sensitive UI. +TEST_F(ReauthenticationCoordinatorTest, + ReauthViewControllerClosesUIOnFailedVCPush) { + FailedPushNavigationController* navigation_controller = + [[FailedPushNavigationController alloc] + initWithRootViewController:[[UIViewController alloc] init]]; + scoped_window_.Get().rootViewController = navigation_controller; + + LocalReauthenticationCoordinator* coordinator = + [[LocalReauthenticationCoordinator alloc] + initWithBaseNavigationController:navigation_controller + browser:browser_.get() + authOnStart:NO]; + coordinator.delegate = delegate_; + [coordinator start]; + + scene_state_.activationLevel = SceneActivationLevelForegroundInactive; + EXPECT_TRUE(delegate_.dismissUICalled); + + [coordinator stop]; +}
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm b/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
index 5a6e51b6b..3d887457 100644
--- a/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
+++ b/ios/chrome/browser/settings/ui_bundled/password/reauthentication/local_reauthentication_coordinator_unittest.mm
@@ -63,6 +63,18 @@
@end
+@interface FailedPushNavigationController : UINavigationController
+@end
+
+@implementation FailedPushNavigationController
+
+- (void)pushViewController:(UIViewController*)viewController
+ animated:(BOOL)animated {
+ // Simulate push failure by doing nothing.
+}
+
+@end
+
// Test fixture for LocalReauthenticationCoordinator.
class ReauthenticationCoordinatorTest : public PlatformTest {
protected:
@@ -351,3 +363,26 @@
base_navigation_controller_.topViewController;
EXPECT_TRUE(topViewController.modalInPresentation);
}
+
+// Tests that if pushing the reauth view controller fails on ForegroundInactive,
+// the coordinator dismisses the sensitive UI.
+TEST_F(ReauthenticationCoordinatorTest,
+ ReauthViewControllerClosesUIOnFailedVCPush) {
+ FailedPushNavigationController* navigation_controller =
+ [[FailedPushNavigationController alloc]
+ initWithRootViewController:[[UIViewController alloc] init]];
+ scoped_window_.Get().rootViewController = navigation_controller;
+
+ LocalReauthenticationCoordinator* coordinator =
+ [[LocalReauthenticationCoordinator alloc]
+ initWithBaseNavigationController:navigation_controller
+ browser:browser_.get()
+ authOnStart:NO];
+ coordinator.delegate = delegate_;
+ [coordinator start];
+
+ scene_state_.activationLevel = SceneActivationLevelForegroundInactive;
+ EXPECT_TRUE(delegate_.dismissUICalled);
+
+ [coordinator stop];
+}
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page