PatchGap
Chrome · Select

CVE-2026-78946

Authorization Error in Select
Low watch CVSS 4.3 chrome Authorization Error 🔧 Commit mapped

Overview

Low
Severity
4.3
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactIncorrect authorization in Select
DescriptionIncorrect authorization in Select
ComponentSelect
Bug ClassAuthorization Error
Action tierwatch — logic/policy bug — security-relevant, no memory-unsafety
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.
Tracker517718241
Fix commit1918c9268431 (chromium/src) +36/-1
CWECWE-863
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CISA KEVNot listed
CreditedGoogle
Reported2026-05-29 (per vendor advisory)
Fix landed2026-06-01 (public git)
Disclosed2026-08-25
Patch gap85 days — fix public in source before the advisory

Background

Trusted vs. untrusted events
Browser-generated input events have isTrusted() == true. Events made by script (dispatchEvent(new MouseEvent('mousedown'))) are untrusted and should not trigger actions that need a real user, such as opening a <select> picker.
`is_trusted_or_click`
a local in Blink’s event dispatcher (event_dispatcher.cc) that decides whether an event counts as user-originated for default-action handling.
`GetWideViewportQuirkEnabled()`
a Blink Settings value that, according to the code comments, is turned on for Android WebView. The old quirk relied on it to identify WebView.
`SelectWebViewUntrustedEventRemoval`
a new runtime-enabled feature, status: "experimental". When enabled, it removes the WebView hack that let untrusted mousedown events open <select> pickers.

Root Cause Analysis

Blink’s event dispatcher had a compatibility hack (TODO(dtapuska), crbug.com/643705). For an untrusted mousedown MouseEvent targeting an HTMLSelectElement, it set is_trusted_or_click = settings->GetWideViewportQuirkEnabled(). On WebView, script-generated mousedowns were therefore treated as user-initiated for <select>, and could open the picker without a real gesture. That is the incorrect authorization: an untrusted event got trusted-event privileges.

The patch adds !RuntimeEnabledFeatures::SelectWebViewUntrustedEventRemovalEnabled() to the condition, so the upgrade is skipped when the feature is on. Apart from that guard and a TODO, the patch adds no new check. The feature is experimental, so it is off by default in the code. It is turned on only through fieldtrial_testing_config.json (testing/variations), the WebView developer flag list (ProductionSupportedFlagList.java), or a later default flip, which is (inferred). This commit makes the fix possible to roll out; on its own it does not change behavior on stable WebView.

Key insight
A platform quirk let a synthetic mousedown count as trusted for opening <select>. The patch puts that upgrade behind a kill-switch feature (SelectWebViewUntrustedEventRemoval) so the hack can be turned off and later removed.

Attack Path

  1. Content loaded in an Android WebView An attacker’s page runs in an app’s WebView. That is where GetWideViewportQuirkEnabled() is true according to the code comments, and the quirk does not apply elsewhere.
  2. Synthetic mousedown on a `<select>` Page script dispatches an untrusted mousedown MouseEvent on an HTMLSelectElement, with no user gesture.
  3. Event upgraded to trusted With the feature disabled (the default), the dispatcher sets is_trusted_or_click from the WebView quirk setting, so the event is handled as if the user clicked.
  4. Picker opens without user activation The <select> picker opens programmatically, which ordinary web content should not be able to do. Using this for UI spoofing or click redirection is (inferred).

Impact Assessment

The bug lets web content in Android WebView skip the user-activation requirement for opening a <select> picker, in the renderer and in the native picker UI it requests. The diff shows no memory-safety issue or cross-origin data access. Practical impact is likely limited to gesture bypass and UI-confusion scenarios (inferred). It is limited to WebView, or wherever the wide-viewport quirk setting is on, and it remains reachable until SelectWebViewUntrustedEventRemoval is enabled. The vendor advisory rates this low severity and does not report in-the-wild exploitation; NVD scores it CVSS 4.3.

Files Changed

  • testing/variations/fieldtrial_testing_config.json
  • third_party/blink/renderer/platform/runtime_enabled_features.json5
  • android_webview/java/src/org/chromium/android_webview/common/ProductionSupportedFlagList.java
  • third_party/blink/renderer/core/dom/events/event_dispatcher.cc

Audit Directions

  • Trust upgrades for synthetic events
    Search Blink for code that sets or overrides trust flags (is_trusted_or_click, SetTrusted, isTrusted() checks with platform exceptions). Any quirk that treats script-dispatched events as user-initiated weakens a gesture boundary.
  • Settings-gated compatibility hacks
    Review quirks keyed on embedder Settings (WebView-only flags such as GetWideViewportQuirkEnabled) that relax security-relevant checks. They tend to persist and are rarely re-examined.
  • Picker and popup openers
    Check other controls that open native UI (<input type=date/color/file>, showPicker(), <select> with appearance: base-select) for paths reachable from untrusted events or without transient user activation.

Patch

view commit
From 1918c92684315e4c284e52c7e03729754513c1c3 Mon Sep 17 00:00:00 2001
From: Joey Arhar <[email protected]>
Date: Mon, 01 Jun 2026 13:10:13 -0700
Subject: [PATCH] Move <select> WebView untrusted click fix behind flag

This hack which allows untrusted mousedown events to open select pickers
on WebView has low enough usage that it should be removable. This patch
moves it behind a flag so that we can remove it.

Bug: 41273490, 517718241
Change-Id: Id7bbf6741c3dcf23d54f58758784d99f22ff246d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7886363
Reviewed-by: David Grogan <[email protected]>
Commit-Queue: David Grogan <[email protected]>
Reviewed-by: Joey Arhar <[email protected]>
Commit-Queue: Joey Arhar <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1639616}
---
diff --git a/android_webview/java/src/org/chromium/android_webview/common/ProductionSupportedFlagList.java b/android_webview/java/src/org/chromium/android_webview/common/ProductionSupportedFlagList.java
index 3e2fa34..094089f8 100644
--- a/android_webview/java/src/org/chromium/android_webview/common/ProductionSupportedFlagList.java
+++ b/android_webview/java/src/org/chromium/android_webview/common/ProductionSupportedFlagList.java
@@ -1402,6 +1402,10 @@
         Flag.baseFeature(
                 AwFeatures.WEBVIEW_CPP_METRICS_FILTERING,
                 "Enables WebView UMA metrics filtering in C++ instead of Java."),
+        Flag.baseFeature(
+                BlinkFeatures.SELECT_WEBVIEW_UNTRUSTED_EVENT_REMOVAL,
+                "Enables the removal of a WebView-specific hack to allow select elements to be"
+                        + " opened with untrusted mousedown events."),
         // Add new commandline switches and features above. The final entry should have a
         // trailing comma for cleaner diffs.
     };
diff --git a/testing/variations/fieldtrial_testing_config.json b/testing/variations/fieldtrial_testing_config.json
index 152fd23..e0c1f97 100644
--- a/testing/variations/fieldtrial_testing_config.json
+++ b/testing/variations/fieldtrial_testing_config.json
@@ -21631,6 +21631,26 @@
             ]
         }
     ],
+    "SelectWebViewUntrustedEventRemoval": [
+        {
+            "platforms": [
+                "android",
+                "android_webview",
+                "chromeos",
+                "linux",
+                "mac",
+                "windows"
+            ],
+            "experiments": [
+                {
+                    "name": "Enabled",
+                    "enable_features": [
+                        "SelectWebViewUntrustedEventRemoval"
+                    ]
+                }
+            ]
+        }
+    ],
     "SensitiveContent": [
         {
             "platforms": [
diff --git a/third_party/blink/renderer/core/dom/events/event_dispatcher.cc b/third_party/blink/renderer/core/dom/events/event_dispatcher.cc
index d22ef41c..9168a5b 100644
--- a/third_party/blink/renderer/core/dom/events/event_dispatcher.cc
+++ b/third_party/blink/renderer/core/dom/events/event_dispatcher.cc
@@ -428,7 +428,8 @@
   // TODO(dtapuska): Change this to a target SDK quirk crbug.com/643705
   if (!is_trusted_or_click && event_->IsMouseEvent() &&
       event_->type() == event_type_names::kMousedown &&
-      IsA<HTMLSelectElement>(*node_)) {
+      IsA<HTMLSelectElement>(*node_) &&
+      !RuntimeEnabledFeatures::SelectWebViewUntrustedEventRemovalEnabled()) {
     if (Settings* settings = node_->GetDocument().GetSettings()) {
       is_trusted_or_click = settings->GetWideViewportQuirkEnabled();
     }
@@ -476,6 +477,8 @@
   // Track the usage of sending a mousedown event to a select element to force
   // it to open. This measures a possible breakage of not allowing untrusted
   // events to open select boxes.
+  // TODO(crbug.com/41273490): Obsolete this UseCounter and remove this code
+  // after removing the corresponding functionality.
   if (!event_->isTrusted() && event_->IsMouseEvent() &&
       event_->type() == event_type_names::kMousedown &&
       IsA<HTMLSelectElement>(*node_)) {
diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
index 4f47db3..b7ecb44e 100644
--- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
+++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
@@ -5353,6 +5353,14 @@
       status: "stable",
     },
     {
+      // Removes a hack which allows select elements to be opened with a script
+      // dispatched mousedown event on WebView, as opposed to a real user
+      // click.
+      // https://issues.chromium.org/issues/41273490
+      name: "SelectWebViewUntrustedEventRemoval",
+      status: "experimental",
+    },
+    {
       name: "SendBeaconThrowForBlobWithNonSimpleType",
       public: true,
       status: "stable",
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
On This Page