Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInsufficient policy enforcement in PDF
DescriptionInsufficient policy enforcement in PDF
ComponentPDF
Bug ClassLogic Error
Tracker40058077
Fix commitb6371f6acfdb (chromium/src) +28/-17
CISA KEVNot listed
CreditedNDevTK
Disclosed2026-03-10

Changed Functions

FunctionChangeNotes
if
chrome/browser/extensions/api/tabs/tabs_api.cc
modified
if
chrome/browser/extensions/open_tab_helper.cc
modified
BrowserWindowInterface
chrome/browser/extensions/open_tab_helper.h
modified
ExtensionFunction
chrome/browser/extensions/open_tab_helper.h
modified
GURL
chrome/browser/extensions/open_tab_helper.h
modified
WebContents
chrome/browser/extensions/open_tab_helper.h
modified

Files Changed

  • chrome/browser/extensions/api/tabs/tabs_api.cc
  • chrome/browser/extensions/open_tab_helper.cc
  • chrome/browser/extensions/open_tab_helper.h
From b6371f6acfdb3ce7dbac92ff054f41123637020f Mon Sep 17 00:00:00 2001
From: Lei Zhang <[email protected]>
Date: Thu, 29 Jan 2026 14:44:40 -0800
Subject: [PATCH] Refactor common code into OpenTabHelper::MaybeSetPdfNavigateParams()

Combine duplicate PDF navigation code in OpenTabHelper::OpenTab() and
WindowsCreateFunction::OnBrowserWindowCreated() into a common function.

Bug: 40058077
Change-Id: If0de22a2514a4ae79be478e565d34ad36147b8df
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7517501
Reviewed-by: Charlie Reis <[email protected]>
Commit-Queue: Lei Zhang <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1576873}
---

diff --git a/chrome/browser/extensions/api/tabs/tabs_api.cc b/chrome/browser/extensions/api/tabs/tabs_api.cc
index c8789f35..1eef7ed 100644
--- a/chrome/browser/extensions/api/tabs/tabs_api.cc
+++ b/chrome/browser/extensions/api/tabs/tabs_api.cc
@@ -1027,15 +1027,11 @@
     // to be compatible with the navigation capturing behavior.
     navigate_params.pwa_navigation_capturing_force_off = true;
 
-    if (extension() && extension()->id() == extension_misc::kPdfExtensionId) {
-      // Treat PDF open-in-new-window navigations consistently with other PDF
-      // navigations, as done in TabsUpdateFunction::UpdateURL().
-      navigate_params.is_renderer_initiated = true;
-      navigate_params.initiator_origin = extension()->origin();
-      navigate_params.source_site_instance =
-          content::SiteInstance::CreateForURL(
-              browser_context(), navigate_params.initiator_origin->GetURL());
-    } else if (set_self_as_opener_) {
+    if (OpenTabHelper::MaybeSetPdfNavigateParams(*this, navigate_params)) {
+      return navigate_params;
+    }
+
+    if (set_self_as_opener_) {
       // Depending on the `setSelfAsOpener` option, we need to put the new
       // contents in the same BrowsingInstance as their opener.  See also
       // https://crbug.com/713888.
diff --git a/chrome/browser/extensions/open_tab_helper.cc b/chrome/browser/extensions/open_tab_helper.cc
index 1f1aaadc..4591ee08 100644
--- a/chrome/browser/extensions/open_tab_helper.cc
+++ b/chrome/browser/extensions/open_tab_helper.cc
@@ -204,14 +204,7 @@
   // the navigation capturing behavior.
   navigate_params.pwa_navigation_capturing_force_off = true;
 
-  if (extension && extension->id() == extension_misc::kPdfExtensionId) {
-    // Treat PDF open-in-new-tab navigations consistently with other PDF
-    // navigations, as done in TabsUpdateFunction::UpdateURL().
-    navigate_params.is_renderer_initiated = true;
-    navigate_params.initiator_origin = extension->origin();
-    navigate_params.source_site_instance = content::SiteInstance::CreateForURL(
-        function.browser_context(), navigate_params.initiator_origin->GetURL());
-  }
+  MaybeSetPdfNavigateParams(function, navigate_params);
 
   base::WeakPtr<content::NavigationHandle> handle = Navigate(&navigate_params);
   if (handle && params.bookmark_id) {
@@ -235,4 +228,19 @@
   return new_contents;
 }
 
+// static
+bool OpenTabHelper::MaybeSetPdfNavigateParams(const ExtensionFunction& function,
+                                              NavigateParams& navigate_params) {
+  auto* const extension = function.extension();
+  if (!extension || extension->id() != extension_misc::kPdfExtensionId) {
+    return false;
+  }
+
+  navigate_params.is_renderer_initiated = true;
+  navigate_params.initiator_origin = extension->origin();
+  navigate_params.source_site_instance = content::SiteInstance::CreateForURL(
+      function.browser_context(), navigate_params.initiator_origin->GetURL());
+  return true;
+}
+
 }  // namespace extensions
diff --git a/chrome/browser/extensions/open_tab_helper.h b/chrome/browser/extensions/open_tab_helper.h
index 3a23f797..05130f8 100644
--- a/chrome/browser/extensions/open_tab_helper.h
+++ b/chrome/browser/extensions/open_tab_helper.h
@@ -14,6 +14,7 @@
 class BrowserWindowInterface;
 class ExtensionFunction;
 class GURL;
+struct NavigateParams;
 
 namespace content {
 class WebContents;
@@ -53,6 +54,12 @@
       BrowserWindowInterface& browser,
       const ExtensionFunction& function,
       const Params& params);
+
+  // If `function` is for the PDF Viewer, then mark the PDF-initiated navigation
+  // as renderer-initiated in `navigate_params` and return true. Otherwise
+  // return false and `navigate_params` remains the same.
+  static bool MaybeSetPdfNavigateParams(const ExtensionFunction& function,
+                                        NavigateParams& navigate_params);
 };
 
 }  // namespace extensions
Loading diff…

Original Bug Report

reported by [email protected]

PDF bookmarks bypass SameSite Strict cookies.

UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Steps to reproduce the problem:

  1. On the target set a cookie using document.cookie = “A=A;Secure;SameSite=Strict”;
  2. Create a PDF with a URL bookmark or use https://github.com/chromium/chromium/blob/main/chrome/test/data/pdf/test-bookmarks-with-zoom.pdf
  3. Click the bookmark on the PDF and notice the cookies gets sent. With the following headers: sec-fetch-site “none” sec-fetch-mode “navigate” sec-fetch-dest “document”

I think because extension APIs are used such as chrome.tabs.create, Restrictions that are normally put on navigation’s get bypassed excluding the schemes since that gets checked well not sure if it gets checked for submitForm but thats POST only.

What is the expected behavior? For it to be like chrome.tabs.update and keep the initiator.

What went wrong? PDF viewer bypassing SameSite Strict cookies and Fetch metadata defenses.

Did this work before? N/A

Chrome version: 96.0.4664.45 Channel: stable OS Version: 10.0

View on issue tracker