From 1918c92684315e4c284e52c7e03729754513c1c3 Mon Sep 17 00:00:00 2001
From: Joey Arhar <[email protected]>
Date: Mon, 01 Jun 2026 13:10:13 -0700
Subject: [PATCH] Move <select> WebView untrusted click fix behind flag

This hack which allows untrusted mousedown events to open select pickers
on WebView has low enough usage that it should be removable. This patch
moves it behind a flag so that we can remove it.

Bug: 41273490, 517718241
Change-Id: Id7bbf6741c3dcf23d54f58758784d99f22ff246d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7886363
Reviewed-by: David Grogan <[email protected]>
Commit-Queue: David Grogan <[email protected]>
Reviewed-by: Joey Arhar <[email protected]>
Commit-Queue: Joey Arhar <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1639616}
---

diff --git a/android_webview/java/src/org/chromium/android_webview/common/ProductionSupportedFlagList.java b/android_webview/java/src/org/chromium/android_webview/common/ProductionSupportedFlagList.java
index 3e2fa34..094089f8 100644
--- a/android_webview/java/src/org/chromium/android_webview/common/ProductionSupportedFlagList.java
+++ b/android_webview/java/src/org/chromium/android_webview/common/ProductionSupportedFlagList.java
@@ -1402,6 +1402,10 @@
         Flag.baseFeature(
                 AwFeatures.WEBVIEW_CPP_METRICS_FILTERING,
                 "Enables WebView UMA metrics filtering in C++ instead of Java."),
+        Flag.baseFeature(
+                BlinkFeatures.SELECT_WEBVIEW_UNTRUSTED_EVENT_REMOVAL,
+                "Enables the removal of a WebView-specific hack to allow select elements to be"
+                        + " opened with untrusted mousedown events."),
         // Add new commandline switches and features above. The final entry should have a
         // trailing comma for cleaner diffs.
     };
diff --git a/testing/variations/fieldtrial_testing_config.json b/testing/variations/fieldtrial_testing_config.json
index 152fd23..e0c1f97 100644
--- a/testing/variations/fieldtrial_testing_config.json
+++ b/testing/variations/fieldtrial_testing_config.json
@@ -21631,6 +21631,26 @@
             ]
         }
     ],
+    "SelectWebViewUntrustedEventRemoval": [
+        {
+            "platforms": [
+                "android",
+                "android_webview",
+                "chromeos",
+                "linux",
+                "mac",
+                "windows"
+            ],
+            "experiments": [
+                {
+                    "name": "Enabled",
+                    "enable_features": [
+                        "SelectWebViewUntrustedEventRemoval"
+                    ]
+                }
+            ]
+        }
+    ],
     "SensitiveContent": [
         {
             "platforms": [
diff --git a/third_party/blink/renderer/core/dom/events/event_dispatcher.cc b/third_party/blink/renderer/core/dom/events/event_dispatcher.cc
index d22ef41c..9168a5b 100644
--- a/third_party/blink/renderer/core/dom/events/event_dispatcher.cc
+++ b/third_party/blink/renderer/core/dom/events/event_dispatcher.cc
@@ -428,7 +428,8 @@
   // TODO(dtapuska): Change this to a target SDK quirk crbug.com/643705
   if (!is_trusted_or_click && event_->IsMouseEvent() &&
       event_->type() == event_type_names::kMousedown &&
-      IsA<HTMLSelectElement>(*node_)) {
+      IsA<HTMLSelectElement>(*node_) &&
+      !RuntimeEnabledFeatures::SelectWebViewUntrustedEventRemovalEnabled()) {
     if (Settings* settings = node_->GetDocument().GetSettings()) {
       is_trusted_or_click = settings->GetWideViewportQuirkEnabled();
     }
@@ -476,6 +477,8 @@
   // Track the usage of sending a mousedown event to a select element to force
   // it to open. This measures a possible breakage of not allowing untrusted
   // events to open select boxes.
+  // TODO(crbug.com/41273490): Obsolete this UseCounter and remove this code
+  // after removing the corresponding functionality.
   if (!event_->isTrusted() && event_->IsMouseEvent() &&
       event_->type() == event_type_names::kMousedown &&
       IsA<HTMLSelectElement>(*node_)) {
diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
index 4f47db3..b7ecb44e 100644
--- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
+++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
@@ -5353,6 +5353,14 @@
       status: "stable",
     },
     {
+      // Removes a hack which allows select elements to be opened with a script
+      // dispatched mousedown event on WebView, as opposed to a real user
+      // click.
+      // https://issues.chromium.org/issues/41273490
+      name: "SelectWebViewUntrustedEventRemoval",
+      status: "experimental",
+    },
+    {
       name: "SendBeaconThrowForBlobWithNonSimpleType",
       public: true,
       status: "stable",