Chrome · Intents
CVE-2026-79124
Logic Error in Intents
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
chrome/android/java/src/org/chromium/chrome/browser/contextualsearch/ContextualSearchManager.javachrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabExternalNavigationTest.javacomponents/external_intents/android/BUILD.gncomponents/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationParams.java
Patch
From c9b35fcba98cc9986bdd859b2ea97a2ac9314315 Mon Sep 17 00:00:00 2001 From: Etienne Bergeron <[email protected]> Date: Fri, 17 Jul 2026 07:40:43 -0700 Subject: [PATCH] Carry Referrer Policy into Java NavigationHandle. Previously, the referrer policy was dropped when passing the referrer from C++ to Java NavigationHandle via JNI. This resulted in Java side only having the referrer URL. This CL: 1. Updates JNI to pass the referrer policy along with the referrer URL to Java NavigationHandle. 2. Exposes the referrer policy in Java NavigationHandle. 3. Updates ExternalNavigationParams to carry the Referrer (URL + policy). 4. Updates InterceptNavigationDelegateImpl to use the preserved referrer policy when clobbering the main frame, instead of hardcoding ReferrerPolicy.ALWAYS. Bug: 497493136 Change-Id: Iad7bf04ab7f861701182e3ff3fcd2cafbbd6d5f0 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8092610 Commit-Queue: Etienne Bergeron <[email protected]> Reviewed-by: Michael Thiessen <[email protected]> Reviewed-by: Arthur Sonzogni <[email protected]> Cr-Commit-Position: refs/heads/main@{#1663892} --- diff --git a/chrome/android/java/src/org/chromium/chrome/browser/contextualsearch/ContextualSearchManager.java b/chrome/android/java/src/org/chromium/chrome/browser/contextualsearch/ContextualSearchManager.java index 5831c3e1..3087848 100644 --- a/chrome/android/java/src/org/chromium/chrome/browser/contextualsearch/ContextualSearchManager.java +++ b/chrome/android/java/src/org/chromium/chrome/browser/contextualsearch/ContextualSearchManager.java @@ -78,7 +78,9 @@ import org.chromium.content_public.browser.Visibility; import org.chromium.content_public.browser.WebContents; import org.chromium.content_public.common.ContentUrlConstants; +import org.chromium.content_public.common.Referrer; import org.chromium.net.NetworkChangeNotifier; +import org.chromium.network.mojom.ReferrerPolicy; import org.chromium.ui.base.IntentRequestTracker; import org.chromium.ui.base.LocalizationUtils; import org.chromium.ui.base.PageTransition; @@ -1182,7 +1184,14 @@ isRendererInitiated); ExternalNavigationParams params = new ExternalNavigationParams.Builder( - escapedUrl, false, referrerUrl, pageTransition, isRedirect) + escapedUrl, + false, + GURL.isEmptyOrInvalid(referrerUrl) + ? null + : new Referrer( + referrerUrl.getSpec(), ReferrerPolicy.DEFAULT), + pageTransition, + isRedirect) .setRedirectHandler(mRedirectHandler) .setIsMainFrame(isInPrimaryMainFrame) .build(); diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabExternalNavigationTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabExternalNavigationTest.java index f8d1d261..b41b4f2 100644 --- a/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabExternalNavigationTest.java +++ b/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabExternalNavigationTest.java @@ -306,7 +306,7 @@ new ExternalNavigationParams.Builder( insideVerifiedOriginUrl, /* isIncognito= */ false, - /* referrer= */ GURL.emptyGURL(), + /* referrer= */ null, /* pageTransition= */ 0, /* isRedirect= */ false) .setRedirectHandler(RedirectHandler.create()) @@ -320,7 +320,7 @@ new ExternalNavigationParams.Builder( outsideVerifiedOriginUrl, /* isIncognito= */ false, - /* referrer= */ GURL.emptyGURL(), + /* referrer */ null, /* pageTransition= */ 0, /* isRedirect= */ false) .setRedirectHandler(RedirectHandler.create()) @@ -335,7 +335,7 @@ new ExternalNavigationParams.Builder( insideVerifiedOriginUrl, /* isIncognito= */ false, - /* referrer= */ GURL.emptyGURL(), + /* referrer= */ null, /* pageTransition= */ 0, /* isRedirect= */ false) .setRedirectHandler(RedirectHandler.create()) diff --git a/components/external_intents/android/BUILD.gn b/components/external_intents/android/BUILD.gn index 44ce7da4..61dea7259 100644 --- a/components/external_intents/android/BUILD.gn +++ b/components/external_intents/android/BUILD.gn @@ -85,6 +85,7 @@ "//base:base_java_test_support", "//content/public/android:content_java", "//content/public/test/android:content_java_test_support", + "//services/network/public/mojom:url_loader_base_java", "//third_party/android_sdk:android_test_mock_java", "//third_party/androidx:androidx_appcompat_appcompat_java", "//third_party/androidx:androidx_browser_browser_java", diff --git a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationParams.java b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationParams.java index 695d2af..135c2cd 100644 --- a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationParams.java +++ b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationParams.java @@ -12,6 +12,7 @@ import org.chromium.base.RequiredCallback; import org.chromium.build.annotations.NullMarked; import org.chromium.build.annotations.Nullable; +import org.chromium.content_public.common.Referrer; import org.chromium.ui.base.PageTransition; import org.chromium.url.GURL; import org.chromium.url.Origin; @@ -82,6 +83,7 @@ private final GURL mUrl; private final boolean mIsIncognito; + private final @Nullable Referrer mReferrer; private final GURL mReferrerUrl; private final int mPageTransition; private final boolean mIsRedirect; @@ -108,7 +110,7 @@ private ExternalNavigationParams( GURL url, boolean isIncognito, - @Nullable GURL referrerUrl, + @Nullable Referrer referrer, int pageTransition, boolean isRedirect, RedirectHandler redirectHandler, @@ -130,7 +132,11 @@ mUrl = url; mIsIncognito = isIncognito; mPageTransition = pageTransition; - mReferrerUrl = (referrerUrl == null) ? GURL.emptyGURL() : referrerUrl; + mReferrer = referrer; + mReferrerUrl = + (mReferrer != null && mReferrer.getUrl() != null) + ? new GURL(mReferrer.getUrl()) + : GURL.emptyGURL(); mIsRedirect = isRedirect; mRedirectHandler = redirectHandler; mOpenInNewTab = openInNewTab; @@ -166,12 +172,23 @@ return mIsIncognito; } - /** @return The referrer URL. */ + /** + * @return The referrer URL. + */ public GURL getReferrerUrl() { return mReferrerUrl; } - /** @return The page transition for the current navigation. */ + /** + * @return The referrer. + */ + public @Nullable Referrer getReferrer() { + return mReferrer; + } + + /** + * @return The page transition for the current navigation. + */ public int getPageTransition() { return mPageTransition; } @@ -289,7 +306,7 @@ public static class Builder { private final GURL mUrl; private final boolean mIsIncognito; - private @Nullable GURL mReferrerUrl; + private @Nullable Referrer mReferrer; private int mPageTransition; private boolean mIsRedirect; private @Nullable RedirectHandler mRedirectHandler; @@ -317,12 +334,12 @@ public Builder( GURL url, boolean isIncognito, - GURL referrer, + @Nullable Referrer referrer, int pageTransition, boolean isRedirect) { mUrl = url; mIsIncognito = isIncognito; - mReferrerUrl = referrer; + mReferrer = referrer; mPageTransition = pageTransition; mIsRedirect = isRedirect; } @@ -429,7 +446,7 @@ return new ExternalNavigationParams( mUrl, mIsIncognito, - mReferrerUrl, + mReferrer,
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page