PatchGap
Chrome · DevTools › Android

CVE-2026-7915

Input Validation in DevTools (Android)
High watch CVSS 4.3 chrome Input Validation 📄 Reporter bug report 🔧 Commit mapped

Overview

High
Severity
4.3
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInsufficient data validation in DevTools
DescriptionInsufficient data validation in DevTools
ComponentDevTools
Sub-componentAndroid
Bug ClassInput Validation
Action tierwatch — logic/policy bug — security-relevant, no memory-unsafety
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.
Tracker498454478
Fix commitf23db0dca7d1 (chromium/src) +1/-0
CWECWE-20 (Improper input validation)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CISA KEVNot listed
CreditedGoogle
Reported2026-04-01 (per vendor advisory)
Fix landed2026-04-02 (public git)
Disclosed2026-05-05
Patch gap33 days — fix public in source before the advisory

Background

`IntentHandler`
the Chrome-for-Android class that validates and parses incoming Android Intent data (including intents originating from other, untrusted apps) before a URL becomes a navigation.
`devtools://` scheme
a privileged internal WebUI scheme (UrlConstants.DEVTOOLS_SCHEME) backing the DevTools frontend, expected to be reachable only from trusted contexts.
Internal-scheme classification
the patched if condition that lists the internal schemes (CHROME_SCHEME, CHROME_NATIVE_SCHEME, DISTILLER_SCHEME, ABOUT_SCHEME) given special, controlled handling when they arrive via external intents.
Untrusted input validation
the requirement that scheme/URL data supplied by a foreign app be validated and correctly categorized before Chrome acts on it.

Root Cause Analysis

The single-line change adds UrlConstants.DEVTOOLS_SCHEME to the scheme-matching if in IntentHandler.java, placing it in the same recognized internal-scheme set as CHROME_SCHEME, CHROME_NATIVE_SCHEME, DISTILLER_SCHEME, and ABOUT_SCHEME whose retained comment reads “Allow certain ‘safe’ internal URLs to be launched by external [applications]”. Before the patch, a devtools:// URL arriving as external intent data was not matched by this classification, so the untrusted scheme value escaped the data-validation/handling that other privileged internal schemes receive. The violated invariant is that scheme data taken from a cross-app Intent must be validated and routed through the internal-scheme path for every privileged scheme, not silently fall through for devtools://.

The fix (BUG=497936728, BUG=498454478) adds the missing scheme so the untrusted devtools:// input is properly recognized and constrained. The enclosing method name is not present in the hunk context header, so I do not name it. No lines were removed; the old (deficient) behavior is simply the omission of DEVTOOLS_SCHEME.

Key insight
The core mistake was insufficient validation/classification of the devtools:// scheme from untrusted external intents because UrlConstants.DEVTOOLS_SCHEME was missing from IntentHandler’s internal-scheme set; the fix adds it so the scheme is validated and handled like the other privileged internal schemes.

Attack Path

  1. Build a crafted intent An external Android app creates an Intent whose URL carries the devtools:// scheme as attacker-controlled input.
  2. Deliver to Chrome Chrome receives the intent and IntentHandler computes lowerCaseScheme from the supplied data for classification.
  3. Fail classification (pre-patch) Lacking DEVTOOLS_SCHEME in the if, the handler did not categorize the value as a recognized internal scheme, so the untrusted URL skipped the intended validation/handling branch.
  4. Act on unvalidated scheme The devtools:// URL could then be processed without the data-validation/policy constraints applied to other internal schemes, reaching privileged DevTools surface from untrusted input (inferred).

Impact Assessment

An external application could feed a devtools:// URL through IntentHandler that was not subjected to the validation applied to other privileged internal schemes — an insufficient-data-validation flaw as the advisory states (“Insufficient data validation in DevTools,” severity high). The attacker gains the ability to have Chrome act on an unvalidated privileged-scheme URL supplied cross-app; any concrete escalation beyond that is not shown by this one-line diff and is (inferred). The advisory does not report exploitation in the wild.

Files Changed

  • chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java

Audit Directions

  • Incomplete scheme enumerations
    Diff every hardcoded internal-scheme list across Chrome (intent handling, external-navigation filters, WebUI gatekeepers) against the full set of privileged schemes in UrlConstants, flagging any that omit one.
  • External-input data paths
    Trace URL/scheme values that originate in third-party Intents and confirm each is validated before use, especially where classification drives whether extra checks run.
  • Divergent handling by scheme
    Where a privileged scheme is treated specially, verify newly added or less-common privileged schemes (devtools://, chrome-untrusted://) are included everywhere the older ones are.

Patch

view commit
From f23db0dca7d17241f43f015369f58139b60bd4f9 Mon Sep 17 00:00:00 2001
From: Ryo Hashimoto <[email protected]>
Date: Wed, 01 Apr 2026 17:15:44 -0700
Subject: [PATCH] android: Filter devtools scheme

BUG=497936728
BUG=498454478

Change-Id: I10db3564d28d9ae97e1831a83da28acf9b6aafb3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7720562
Reviewed-by: Theresa Sullivan <[email protected]>
Commit-Queue: Ryo Hashimoto <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1608884}
---

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java b/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
index 563e76b8..cf04bc9 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
@@ -1069,6 +1069,7 @@
             String lowerCaseScheme = scheme.toLowerCase(Locale.US);
             if (UrlConstants.CHROME_SCHEME.equals(lowerCaseScheme)
                     || UrlConstants.CHROME_NATIVE_SCHEME.equals(lowerCaseScheme)
+                    || UrlConstants.DEVTOOLS_SCHEME.equals(lowerCaseScheme)
                     || UrlConstants.DISTILLER_SCHEME.equals(lowerCaseScheme)
                     || ContentUrlConstants.ABOUT_SCHEME.equals(lowerCaseScheme)) {
                 // Allow certain "safe" internal URLs to be launched by external
Loading diff…

Original Bug Report

reported by [email protected]

IntentHandler.intentHasUnsafeInternalScheme() should reject devtools:// URLs

(Split from issue 497936728)

IntentHandler.intentHasUnsafeInternalScheme() should reject devtools:// URLs

View on issue tracker
Links in the report
On This Page