Chrome · DevTools
CVE-2026-7915
Logic Error in DevTools
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
Patch
From f23db0dca7d17241f43f015369f58139b60bd4f9 Mon Sep 17 00:00:00 2001 From: Ryo Hashimoto <[email protected]> Date: Wed, 01 Apr 2026 17:15:44 -0700 Subject: [PATCH] android: Filter devtools scheme BUG=497936728 BUG=498454478 Change-Id: I10db3564d28d9ae97e1831a83da28acf9b6aafb3 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7720562 Reviewed-by: Theresa Sullivan <[email protected]> Commit-Queue: Ryo Hashimoto <[email protected]> Cr-Commit-Position: refs/heads/main@{#1608884} --- diff --git a/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java b/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java index 563e76b8..cf04bc9 100644 --- a/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java +++ b/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java @@ -1069,6 +1069,7 @@ String lowerCaseScheme = scheme.toLowerCase(Locale.US); if (UrlConstants.CHROME_SCHEME.equals(lowerCaseScheme) || UrlConstants.CHROME_NATIVE_SCHEME.equals(lowerCaseScheme) + || UrlConstants.DEVTOOLS_SCHEME.equals(lowerCaseScheme) || UrlConstants.DISTILLER_SCHEME.equals(lowerCaseScheme) || ContentUrlConstants.ABOUT_SCHEME.equals(lowerCaseScheme)) { // Allow certain "safe" internal URLs to be launched by external
Loading diff…
Original Bug Report
reported by [email protected]
IntentHandler.intentHasUnsafeInternalScheme() should reject devtools:// URLs
(Split from issue 497936728)
IntentHandler.intentHasUnsafeInternalScheme() should reject devtools:// URLs
References
On This Page