Chrome · Linux Toolkit Theming
CVE-2026-78974
Logic Error in Linux Toolkit Theming
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
ui/gtk/gtk.sigsui/gtk/select_file_dialog_linux_gtk.cc
Patch
From 1580de16c61d14aa215901fab5eb0ffbab454cf5 Mon Sep 17 00:00:00 2001 From: Tom Anderson <[email protected]> Date: Tue, 07 Jul 2026 17:18:32 -0700 Subject: [PATCH] [GTK] Mitigate file picker accept button focus stealing Explicitly set the file open and folder selection dialog's default response to GTK_RESPONSE_CANCEL using gtk_dialog_set_default_response. The previous mitigation (CL 7399531) used a custom 0 response ID to attempt to prevent GTK from preselecting the accept button. However, certain desktop environments like XFCE and custom GTK themes still focus the first non-cancel button upon the dialog's appearance. By designating GTK_RESPONSE_CANCEL as the default response for open/upload dialogs, unintended Enter key presses will safely close the dialog. Standard user selection via pressing Enter in the file list or filename entry remains unaffected as they are handled internally by GtkFileChooser via its file-activated signal. This focus-prevention behavior is restricted to File Open and Select Folder dialogs. Save As dialogs continue to use the default Save button to avoid usability regressions when typing filenames. Bug: 503048520 Change-Id: I5d2243c5ea2bf113180ea5a091945943fa34bab3 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8061985 Reviewed-by: Lei Zhang <[email protected]> Commit-Queue: Thomas Anderson <[email protected]> Cr-Commit-Position: refs/heads/main@{#1658399} --- diff --git a/ui/gtk/gtk.sigs b/ui/gtk/gtk.sigs index 8e13d2d..a669940 100644 --- a/ui/gtk/gtk.sigs +++ b/ui/gtk/gtk.sigs @@ -196,3 +196,5 @@ void gtk_window_set_modal(GtkWindow* window, gboolean modal); void gtk_print_settings_set_printer(GtkPrintSettings* settings, const gchar* printer); GType gtk_settings_get_type(void); +GType gtk_dialog_get_type(void); +void gtk_dialog_set_default_response(GtkDialog* dialog, gint response_id); diff --git a/ui/gtk/select_file_dialog_linux_gtk.cc b/ui/gtk/select_file_dialog_linux_gtk.cc index c354a04..e56fa5b 100644 --- a/ui/gtk/select_file_dialog_linux_gtk.cc +++ b/ui/gtk/select_file_dialog_linux_gtk.cc @@ -464,6 +464,7 @@ GtkWidget* dialog = GtkFileChooserDialogNew( title.c_str(), nullptr, GTK_FILE_CHOOSER_ACTION_OPEN, GetCancelLabel(), GTK_RESPONSE_CANCEL, GetOpenLabel(), kResponseTypeAccept); + gtk_dialog_set_default_response(GTK_DIALOG(dialog), GTK_RESPONSE_CANCEL); SetGtkTransientForAura(dialog, parent, platform_); AddFilters(GTK_FILE_CHOOSER(dialog)); @@ -504,6 +505,7 @@ title_string.c_str(), nullptr, GTK_FILE_CHOOSER_ACTION_SELECT_FOLDER, GetCancelLabel(), GTK_RESPONSE_CANCEL, accept_button_label.c_str(), kResponseTypeAccept); + gtk_dialog_set_default_response(GTK_DIALOG(dialog), GTK_RESPONSE_CANCEL); SetGtkTransientForAura(dialog, parent, platform_); GtkFileChooser* chooser = GTK_FILE_CHOOSER(dialog); if (type == SELECT_UPLOAD_FOLDER || type == SELECT_EXISTING_FOLDER)
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page