Low chrome Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInformation leak in Intents
DescriptionInformation leak in Intents
ComponentIntents
Bug ClassLogic Error
Tracker497493136
Fix commitc9b35fcba98c (chromium/src) +103/-22
CISA KEVNot listed
CreditedGoogle
Disclosed2026-08-25

Files Changed

  • chrome/android/java/src/org/chromium/chrome/browser/contextualsearch/ContextualSearchManager.java
  • chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabExternalNavigationTest.java
  • components/external_intents/android/BUILD.gn
  • components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationParams.java
From c9b35fcba98cc9986bdd859b2ea97a2ac9314315 Mon Sep 17 00:00:00 2001
From: Etienne Bergeron <[email protected]>
Date: Fri, 17 Jul 2026 07:40:43 -0700
Subject: [PATCH] Carry Referrer Policy into Java NavigationHandle.

Previously, the referrer policy was dropped when passing the referrer
from C++ to Java NavigationHandle via JNI. This resulted in Java side
only having the referrer URL.

This CL:
1. Updates JNI to pass the referrer policy along with the referrer URL
   to Java NavigationHandle.
2. Exposes the referrer policy in Java NavigationHandle.
3. Updates ExternalNavigationParams to carry the Referrer (URL +
   policy).
4. Updates InterceptNavigationDelegateImpl to use the preserved referrer
   policy when clobbering the main frame, instead of hardcoding
   ReferrerPolicy.ALWAYS.

Bug: 497493136

Change-Id: Iad7bf04ab7f861701182e3ff3fcd2cafbbd6d5f0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8092610
Commit-Queue: Etienne Bergeron <[email protected]>
Reviewed-by: Michael Thiessen <[email protected]>
Reviewed-by: Arthur Sonzogni <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1663892}
---

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/contextualsearch/ContextualSearchManager.java b/chrome/android/java/src/org/chromium/chrome/browser/contextualsearch/ContextualSearchManager.java
index 5831c3e1..3087848 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/contextualsearch/ContextualSearchManager.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/contextualsearch/ContextualSearchManager.java
@@ -78,7 +78,9 @@
 import org.chromium.content_public.browser.Visibility;
 import org.chromium.content_public.browser.WebContents;
 import org.chromium.content_public.common.ContentUrlConstants;
+import org.chromium.content_public.common.Referrer;
 import org.chromium.net.NetworkChangeNotifier;
+import org.chromium.network.mojom.ReferrerPolicy;
 import org.chromium.ui.base.IntentRequestTracker;
 import org.chromium.ui.base.LocalizationUtils;
 import org.chromium.ui.base.PageTransition;
@@ -1182,7 +1184,14 @@
                     isRendererInitiated);
             ExternalNavigationParams params =
                     new ExternalNavigationParams.Builder(
-                                    escapedUrl, false, referrerUrl, pageTransition, isRedirect)
+                                    escapedUrl,
+                                    false,
+                                    GURL.isEmptyOrInvalid(referrerUrl)
+                                            ? null
+                                            : new Referrer(
+                                                    referrerUrl.getSpec(), ReferrerPolicy.DEFAULT),
+                                    pageTransition,
+                                    isRedirect)
                             .setRedirectHandler(mRedirectHandler)
                             .setIsMainFrame(isInPrimaryMainFrame)
                             .build();
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabExternalNavigationTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabExternalNavigationTest.java
index f8d1d261..b41b4f2 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabExternalNavigationTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabExternalNavigationTest.java
@@ -306,7 +306,7 @@
                 new ExternalNavigationParams.Builder(
                                 insideVerifiedOriginUrl,
                                 /* isIncognito= */ false,
-                                /* referrer= */ GURL.emptyGURL(),
+                                /* referrer= */ null,
                                 /* pageTransition= */ 0,
                                 /* isRedirect= */ false)
                         .setRedirectHandler(RedirectHandler.create())
@@ -320,7 +320,7 @@
                 new ExternalNavigationParams.Builder(
                                 outsideVerifiedOriginUrl,
                                 /* isIncognito= */ false,
-                                /* referrer= */ GURL.emptyGURL(),
+                                /* referrer */ null,
                                 /* pageTransition= */ 0,
                                 /* isRedirect= */ false)
                         .setRedirectHandler(RedirectHandler.create())
@@ -335,7 +335,7 @@
                 new ExternalNavigationParams.Builder(
                                 insideVerifiedOriginUrl,
                                 /* isIncognito= */ false,
-                                /* referrer= */ GURL.emptyGURL(),
+                                /* referrer= */ null,
                                 /* pageTransition= */ 0,
                                 /* isRedirect= */ false)
                         .setRedirectHandler(RedirectHandler.create())
diff --git a/components/external_intents/android/BUILD.gn b/components/external_intents/android/BUILD.gn
index 44ce7da4..61dea7259 100644
--- a/components/external_intents/android/BUILD.gn
+++ b/components/external_intents/android/BUILD.gn
@@ -85,6 +85,7 @@
     "//base:base_java_test_support",
     "//content/public/android:content_java",
     "//content/public/test/android:content_java_test_support",
+    "//services/network/public/mojom:url_loader_base_java",
     "//third_party/android_sdk:android_test_mock_java",
     "//third_party/androidx:androidx_appcompat_appcompat_java",
     "//third_party/androidx:androidx_browser_browser_java",
diff --git a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationParams.java b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationParams.java
index 695d2af..135c2cd 100644
--- a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationParams.java
+++ b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationParams.java
@@ -12,6 +12,7 @@
 import org.chromium.base.RequiredCallback;
 import org.chromium.build.annotations.NullMarked;
 import org.chromium.build.annotations.Nullable;
+import org.chromium.content_public.common.Referrer;
 import org.chromium.ui.base.PageTransition;
 import org.chromium.url.GURL;
 import org.chromium.url.Origin;
@@ -82,6 +83,7 @@
 
     private final GURL mUrl;
     private final boolean mIsIncognito;
+    private final @Nullable Referrer mReferrer;
     private final GURL mReferrerUrl;
     private final int mPageTransition;
     private final boolean mIsRedirect;
@@ -108,7 +110,7 @@
     private ExternalNavigationParams(
             GURL url,
             boolean isIncognito,
-            @Nullable GURL referrerUrl,
+            @Nullable Referrer referrer,
             int pageTransition,
             boolean isRedirect,
             RedirectHandler redirectHandler,
@@ -130,7 +132,11 @@
         mUrl = url;
         mIsIncognito = isIncognito;
         mPageTransition = pageTransition;
-        mReferrerUrl = (referrerUrl == null) ? GURL.emptyGURL() : referrerUrl;
+        mReferrer = referrer;
+        mReferrerUrl =
+                (mReferrer != null && mReferrer.getUrl() != null)
+                        ? new GURL(mReferrer.getUrl())
+                        : GURL.emptyGURL();
         mIsRedirect = isRedirect;
         mRedirectHandler = redirectHandler;
         mOpenInNewTab = openInNewTab;
@@ -166,12 +172,23 @@
         return mIsIncognito;
     }
 
-    /** @return The referrer URL. */
+    /**
+     * @return The referrer URL.
+     */
     public GURL getReferrerUrl() {
         return mReferrerUrl;
     }
 
-    /** @return The page transition for the current navigation. */
+    /**
+     * @return The referrer.
+     */
+    public @Nullable Referrer getReferrer() {
+        return mReferrer;
+    }
+
+    /**
+     * @return The page transition for the current navigation.
+     */
     public int getPageTransition() {
         return mPageTransition;
     }
@@ -289,7 +306,7 @@
     public static class Builder {
         private final GURL mUrl;
         private final boolean mIsIncognito;
-        private @Nullable GURL mReferrerUrl;
+        private @Nullable Referrer mReferrer;
         private int mPageTransition;
         private boolean mIsRedirect;
         private @Nullable RedirectHandler mRedirectHandler;
@@ -317,12 +334,12 @@
         public Builder(
                 GURL url,
                 boolean isIncognito,
-                GURL referrer,
+                @Nullable Referrer referrer,
                 int pageTransition,
                 boolean isRedirect) {
             mUrl = url;
             mIsIncognito = isIncognito;
-            mReferrerUrl = referrer;
+            mReferrer = referrer;
             mPageTransition = pageTransition;
             mIsRedirect = isRedirect;
         }
@@ -429,7 +446,7 @@
             return new ExternalNavigationParams(
                     mUrl,
                     mIsIncognito,
-                    mReferrerUrl,
+                    mReferrer,
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.