Chrome · DevTools
CVE-2026-79154
Logic Error in DevTools
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifchrome/browser/devtools/devtools_ui_bindings.cc |
modified |
Files Changed
chrome/browser/devtools/devtools_ui_bindings.cctools/metrics/histograms/metadata/dev/enums.xmltools/metrics/histograms/metadata/dev/histograms.xml
Patch
From 3431f8c719ae078361e10e6afa9d2f0c933a6cce Mon Sep 17 00:00:00 2001 From: Danil Somsikov <[email protected]> Date: Thu, 16 Jul 2026 09:52:06 -0700 Subject: [PATCH] Add UMA histogram for DevTools frontend location. This CL introduces a new UMA histogram, DevTools.FrontendLocation, to record whether the DevTools frontend is loaded from a local source (e.g., bundled with Chrome or a custom local build) or a remote source (e.g., served from a CDN). This metric is recorded once per DevTools session at the start. Bug: 520492291 Change-Id: Icefc85c70d7407a15d2a9004ad64ab32802bddbd Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8106695 Reviewed-by: Alex Rudenko <[email protected]> Auto-Submit: Danil Somsikov <[email protected]> Commit-Queue: Danil Somsikov <[email protected]> Cr-Commit-Position: refs/heads/main@{#1663215} --- diff --git a/chrome/browser/devtools/devtools_ui_bindings.cc b/chrome/browser/devtools/devtools_ui_bindings.cc index 49472ab..b431b7e 100644 --- a/chrome/browser/devtools/devtools_ui_bindings.cc +++ b/chrome/browser/devtools/devtools_ui_bindings.cc @@ -549,6 +549,12 @@ base::Value(encoded)); } +enum class DevToolsFrontendLocation { + kLocal = 0, + kRemote = 1, + kMaxValue = kRemote, +}; + bool IsLocalDevToolsFrontendURL(const GURL& url) { if (!url.is_valid() || url.IsAboutBlank() || !url.SchemeIs(content::kChromeDevToolsScheme) || @@ -2462,6 +2468,14 @@ if (!remote_debugging_enabled) { session_tags |= SessionTags::kDevToolsRemoteDebuggingDisabled; } + + // Log the frontend location explicitly + GURL frontend_url = web_contents_->GetVisibleURL(); + DevToolsFrontendLocation location = IsLocalDevToolsFrontendURL(frontend_url) + ? DevToolsFrontendLocation::kLocal + : DevToolsFrontendLocation::kRemote; + base::UmaHistogramEnumeration("DevTools.FrontendLocation", location); + metrics::structured::StructuredMetricsClient::Record( metrics::structured::events::v2::dev_tools::SessionStart() .SetTags(session_tags) diff --git a/tools/metrics/histograms/metadata/dev/enums.xml b/tools/metrics/histograms/metadata/dev/enums.xml index 7fc33db1..0f8bd1b7 100644 --- a/tools/metrics/histograms/metadata/dev/enums.xml +++ b/tools/metrics/histograms/metadata/dev/enums.xml @@ -1012,6 +1012,11 @@ <int value="2" label="Other Extension"/> </enum> +<enum name="DevToolsFrontendLocation"> + <int value="0" label="Local"/> + <int value="1" label="Remote"/> +</enum> + <enum name="DevToolsIssueCreated"> <int value="0" label="MixedContentIssue"/> <int value="1" label="ContentSecurityPolicyIssue::kInlineViolation"/> diff --git a/tools/metrics/histograms/metadata/dev/histograms.xml b/tools/metrics/histograms/metadata/dev/histograms.xml index 529c9ef..617578bf 100644 --- a/tools/metrics/histograms/metadata/dev/histograms.xml +++ b/tools/metrics/histograms/metadata/dev/histograms.xml @@ -185,6 +185,17 @@ </summary> </histogram> +<histogram name="DevTools.FrontendLocation" enum="DevToolsFrontendLocation" + expires_after="2027-01-16"> + <owner>[email protected]</owner> + <owner>[email protected]</owner> + <summary> + Records whether the DevTools frontend being loaded is local (bundled/custom) + or remote (served via CDN). Recorded once per DevTools session at session + start. + </summary> +</histogram> + <histogram name="DevTools.Insights.LongTeaserGenerationTime" units="ms" expires_after="2026-10-24"> <owner>[email protected]</owner>
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page