CVE-2026-79006
Overview
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifchrome/browser/ssl/https_upgrades_interceptor.cc |
modified |
Files Changed
chrome/browser/ssl/https_upgrades_browsertest.ccchrome/browser/ssl/https_upgrades_interceptor.cc
Patch
From 4407087b8829dc0dca96f1d8c957b00a2e7431b4 Mon Sep 17 00:00:00 2001 From: Chris Thompson <[email protected]> Date: Tue, 14 Jul 2026 15:49:40 -0700 Subject: [PATCH] Only HTTP-allowlist the initial host of exempted navigations HttpsUpgradesInterceptor::MaybeCreateLoader() runs once per redirect hop. For navigations exempted from upgrades (typed http:// URLs and captive-portal login pages) it was adding the current hop's host to the persistent HTTP_ALLOWED list on every invocation, so a server controlling the first hop could allowlist arbitrary redirect-target hosts for the lifetime of the entry. Restrict the allowlist write to the initial request URL only; redirect hops of an exempted navigation still load over HTTP but no longer add their hosts to the persistent allowlist. TAG=agy CONV=a47522ad-72e5-4f49-9a02-96961f6324e5 Bug: 502344135 Change-Id: Ifb62ec8a705fce3e12ea266b607a4a9e1bd93962 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8094102 Commit-Queue: Chris Thompson <[email protected]> Reviewed-by: Mustafa Emre Acer <[email protected]> Cr-Commit-Position: refs/heads/main@{#1662228} --- diff --git a/chrome/browser/ssl/https_upgrades_browsertest.cc b/chrome/browser/ssl/https_upgrades_browsertest.cc index 2893345..11096ee 100644 --- a/chrome/browser/ssl/https_upgrades_browsertest.cc +++ b/chrome/browser/ssl/https_upgrades_browsertest.cc @@ -3656,6 +3656,56 @@ contents->GetPrimaryMainFrame()->GetStoragePartition())); } +// Tests that when a URL typed with an explicit http:// scheme is redirected by +// the server to other hosts, only the host of the originally typed URL is +// added to the allowlist. The exemption applies to the navigation as a whole, +// but server-chosen redirect targets must not be persistently allowlisted. +IN_PROC_BROWSER_TEST_P(HttpsUpgradesBrowserTest, + URLsTypedWithHttpSchemeAllowlistOnlyInitialHost) { + if (IsHttpsFirstModeInterstitialEnabledAcrossSites()) { + return; + } + GURL final_url = http_server()->GetURL("baz.com", "/simple.html"); + GURL hop_url = http_server()->GetURL( + "bar.com", "/server-redirect?" + final_url.spec()); + GURL initial_url = http_server()->GetURL( + "foo.com", "/server-redirect?" + hop_url.spec()); + auto* contents = GetBrowser()->tab_strip_model()->GetActiveWebContents(); + OmniboxClient* omnibox_client = BrowserWindow::FromBrowser(GetBrowser()) + ->GetLocationBar() + ->GetOmniboxController() + ->client(); + + Profile* profile = Profile::FromBrowserContext(contents->GetBrowserContext()); + content::SSLHostStateDelegate* state = profile->GetSSLHostStateDelegate(); + auto* storage_partition = + contents->GetPrimaryMainFrame()->GetStoragePartition(); + + // None of the hosts should be in the allowlist yet. + EXPECT_FALSE(state->IsHttpAllowedForHost("foo.com", storage_partition)); + EXPECT_FALSE(state->IsHttpAllowedForHost("bar.com", storage_partition)); + EXPECT_FALSE(state->IsHttpAllowedForHost("baz.com", storage_partition)); + + // Simulate the full URL was typed with an http scheme. The server redirects + // through bar.com and baz.com. + content::TestNavigationObserver nav_observer(contents, 1); + omnibox_client->OnAutocompleteAccept( + initial_url, nullptr, WindowOpenDisposition::CURRENT_TAB, + ui::PAGE_TRANSITION_TYPED, AutocompleteMatchType::URL_WHAT_YOU_TYPED, + base::TimeTicks(), false, true, std::u16string(), AutocompleteMatch(), + AutocompleteMatch()); + nav_observer.Wait(); + + // None of the hops should have been upgraded. + EXPECT_EQ(final_url, contents->GetLastCommittedURL()); + + // The host the user typed should be in the allowlist, but the + // server-selected redirect targets should not. + EXPECT_TRUE(state->IsHttpAllowedForHost("foo.com", storage_partition)); + EXPECT_FALSE(state->IsHttpAllowedForHost("bar.com", storage_partition)); + EXPECT_FALSE(state->IsHttpAllowedForHost("baz.com", storage_partition)); +} + // Returns a URL loader interceptor that responds to HTTPS URLs with a timeout // error. std::unique_ptr<content::URLLoaderInterceptor> MakeTimeoutInterceptor() { diff --git a/chrome/browser/ssl/https_upgrades_interceptor.cc b/chrome/browser/ssl/https_upgrades_interceptor.cc index 1cfb2b85..6922671 100644 --- a/chrome/browser/ssl/https_upgrades_interceptor.cc +++ b/chrome/browser/ssl/https_upgrades_interceptor.cc @@ -364,7 +364,11 @@ // portal hostnames. if (!IsStrictInterstitialEnabled(*interstitial_state_) && ShouldExcludeNavigationFromUpgrades(navigation_ui_data_, web_contents)) { - if (state) { + // Only allowlist the initial host of the navigation. Server-side redirect + // targets are not chosen by the user and shouldn't be persistently + // allowlisted. + if (state && + tentative_resource_request.navigation_redirect_chain.size() <= 1) { state->AllowHttpForHost(tentative_resource_request.url.GetHost(), storage_partition); }
Regression Test / PoC
diff --git a/chrome/browser/ssl/https_upgrades_browsertest.cc b/chrome/browser/ssl/https_upgrades_browsertest.cc
index 2893345..11096ee 100644
--- a/chrome/browser/ssl/https_upgrades_browsertest.cc
+++ b/chrome/browser/ssl/https_upgrades_browsertest.cc
@@ -3656,6 +3656,56 @@
contents->GetPrimaryMainFrame()->GetStoragePartition()));
}
+// Tests that when a URL typed with an explicit http:// scheme is redirected by
+// the server to other hosts, only the host of the originally typed URL is
+// added to the allowlist. The exemption applies to the navigation as a whole,
+// but server-chosen redirect targets must not be persistently allowlisted.
+IN_PROC_BROWSER_TEST_P(HttpsUpgradesBrowserTest,
+ URLsTypedWithHttpSchemeAllowlistOnlyInitialHost) {
+ if (IsHttpsFirstModeInterstitialEnabledAcrossSites()) {
+ return;
+ }
+ GURL final_url = http_server()->GetURL("baz.com", "/simple.html");
+ GURL hop_url = http_server()->GetURL(
+ "bar.com", "/server-redirect?" + final_url.spec());
+ GURL initial_url = http_server()->GetURL(
+ "foo.com", "/server-redirect?" + hop_url.spec());
+ auto* contents = GetBrowser()->tab_strip_model()->GetActiveWebContents();
+ OmniboxClient* omnibox_client = BrowserWindow::FromBrowser(GetBrowser())
+ ->GetLocationBar()
+ ->GetOmniboxController()
+ ->client();
+
+ Profile* profile = Profile::FromBrowserContext(contents->GetBrowserContext());
+ content::SSLHostStateDelegate* state = profile->GetSSLHostStateDelegate();
+ auto* storage_partition =
+ contents->GetPrimaryMainFrame()->GetStoragePartition();
+
+ // None of the hosts should be in the allowlist yet.
+ EXPECT_FALSE(state->IsHttpAllowedForHost("foo.com", storage_partition));
+ EXPECT_FALSE(state->IsHttpAllowedForHost("bar.com", storage_partition));
+ EXPECT_FALSE(state->IsHttpAllowedForHost("baz.com", storage_partition));
+
+ // Simulate the full URL was typed with an http scheme. The server redirects
+ // through bar.com and baz.com.
+ content::TestNavigationObserver nav_observer(contents, 1);
+ omnibox_client->OnAutocompleteAccept(
+ initial_url, nullptr, WindowOpenDisposition::CURRENT_TAB,
+ ui::PAGE_TRANSITION_TYPED, AutocompleteMatchType::URL_WHAT_YOU_TYPED,
+ base::TimeTicks(), false, true, std::u16string(), AutocompleteMatch(),
+ AutocompleteMatch());
+ nav_observer.Wait();
+
+ // None of the hops should have been upgraded.
+ EXPECT_EQ(final_url, contents->GetLastCommittedURL());
+
+ // The host the user typed should be in the allowlist, but the
+ // server-selected redirect targets should not.
+ EXPECT_TRUE(state->IsHttpAllowedForHost("foo.com", storage_partition));
+ EXPECT_FALSE(state->IsHttpAllowedForHost("bar.com", storage_partition));
+ EXPECT_FALSE(state->IsHttpAllowedForHost("baz.com", storage_partition));
+}
+
// Returns a URL loader interceptor that responds to HTTPS URLs with a timeout
// error.
std::unique_ptr<content::URLLoaderInterceptor> MakeTimeoutInterceptor() {
Original Bug Report
HTTPS-First Mode bypass via redirect chains poisoning the allowlist
Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports without the Chrome Security team.
Overview: A discrepancy in how the force_no_https_upgrade flag is propagated causes the HttpsUpgradesInterceptor to be erroneously attached to navigations exempt from HTTPS upgrades. During redirect chains on these exempt navigations, the interceptor reuses the initial exemption state, incorrectly adding every target host in the chain to the 15-day HTTP allowlist. This allows a malicious captive portal or MITM attacker to silently disable HTTPS-First Mode protections for arbitrary domains.
Affected files:
chrome/browser/ssl/https_upgrades_interceptor.ccchrome/browser/ui/browser_navigator_params_utils.ccchrome/browser/chrome_content_browser_client.cc
Estimated timestamp from git blame: 2025-10-01
Summary
A potential logic error exists in the initialization of navigation parameters that causes HttpsUpgradesInterceptor to be attached to navigations that are meant to be explicitly excluded from HTTPS upgrades (such as captive portal probes or explicitly typed http:// URLs). Because interceptors are reused across redirect legs, the interceptor incorrectly applies the original navigation’s exemption status to every subsequent host in a redirect chain. This results in the persistent (15-day) allowlisting of arbitrary domains, silently bypassing HTTPS-First Mode (HFM) protections.
Technical Details
The root cause is a discrepancy in how force_no_https_upgrade is populated in chrome/browser/ui/browser_navigator_params_utils.cc:
- Missing Flag Propagation: When
LoadURLParamsFromNavigateParamsconstructs the navigation parameters for a captive portal probe or an explicitly typed HTTP URL, it correctly setsforce_no_https_upgrade_ = trueinside theChromeNavigationUIDataobject. However, it fails to set the correspondingforce_no_https_upgradeboolean field in thecontent::NavigationController::LoadURLParamsstruct (which defaults tofalse). - Erroneous Interceptor Creation: Because
LoadURLParams.force_no_https_upgradeisfalse,NavigationControllerImplinitializes theNavigationRequestwithforce_no_https_upgrade_ = false. Consequently,ChromeContentBrowserClient::WillCreateURLLoaderRequestInterceptorserroneously creates anHttpsUpgradesInterceptorfor the request. - Initial Allowlist Write: Inside
HttpsUpgradesInterceptor::MaybeCreateLoader, the code checksShouldExcludeNavigationFromUpgrades. This function reads the correctly populatedChromeNavigationUIDataand returnstrue. If Strict Mode is not enabled (e.g., the user is in Balanced Mode), the interceptor explicitly allowlists the initial host by callingStatefulSSLHostStateDelegate::AllowHttpForHost, writing a persistentContentSettingsType::HTTP_ALLOWEDentry valid for 15 days. - Redirect Chain Poisoning: When the initial HTTP request receives a 30x redirect,
NavigationURLLoaderImpl::Restartis called. Crucially,Restartreuses the exact same interceptor array and the sameChromeNavigationUIDatainstance for the new URL. The interceptor evaluates the new target host, sees the persistent exemption state in the UI data, and callsAllowHttpForHostagain for the redirect target. This repeats for every hop in the chain.
Impact
A malicious captive portal or MITM attacker can intercept an exempt HTTP request (like a connectivity check) and respond with a redirect chain pointing to up to 20 victim domains (e.g., http://bank.example, http://email.example). This silently writes persistent HTTP exceptions for those domains into the user’s profile across all networks. For the next 15 days, any navigation to those domains will bypass HTTPS-First Mode upgrades, allowing the attacker to seamlessly impersonate the origins via plaintext HTTP.
Potential Reproduction Steps
Note: Our tooling agent does not have the ability to run code, so these are potential steps to reproduce the issue.
- Configure a Chrome profile with default HFM settings (e.g., Balanced mode enabled).
- As a MITM attacker or captive portal, intercept a plaintext HTTP connectivity probe (e.g.,
http://connectivitycheck.gstatic.com/generate_204). - Respond with a chain of 30x redirects to target victim hosts:
http://victim1.example->http://victim2.example. - End the redirect chain at the actual captive portal login page.
- Observe in
chrome://settings/content/allorHostContentSettingsMapthatvictim1.exampleandvictim2.examplehave been added to the HTTP allowlist with a 15-day expiration. - On a trusted network, navigate to
http://victim1.exampleand observe that no HFM interstitial is shown and the connection remains plaintext HTTP.
Suggested Fix
Update LoadURLParamsFromNavigateParams in chrome/browser/ui/browser_navigator_params_utils.cc to explicitly populate the force_no_https_upgrade field in content::NavigationController::LoadURLParams whenever it calculates the exemption for ChromeNavigationUIData.
if (params->frame_tree_node_id.is_null()) {
bool force_no_https_upgrade =
params->url_typed_with_http_scheme ||
params->captive_portal_window_type !=
captive_portal::CaptivePortalWindowType::kNone;
load_url_params.force_no_https_upgrade = force_no_https_upgrade; // <-- Add this line
std::unique_ptr<ChromeNavigationUIData> navigation_ui_data =
ChromeNavigationUIData::CreateForMainFrameNavigation(
target_contents, params->is_using_https_as_default_scheme,
force_no_https_upgrade);
navigation_ui_data->set_navigation_initiated_from_sync(
params->navigation_initiated_from_sync);
load_url_params.navigation_ui_data = std::move(navigation_ui_data);
}
This ensures that the NavigationRequest correctly understands the exemption, preventing the HttpsUpgradesInterceptor from being instantiated in the first place.
Evaluated with Chrome root at commit: 096fc8fdbfacf2546485756d03f160a3d04fcc9b
Results so far have been promising, but there can be wrong deductions. If this proves to be a false positive, please close as WAI; data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.