PatchGap
Chrome · Browser › Android

CVE-2026-79225

Authorization Error in Browser (Android)
Low watch CVSS 4.3 chrome Authorization Error 🔧 Commit mapped

Overview

Low
Severity
4.3
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactIncorrect authorization in Browser
DescriptionIncorrect authorization in Browser
ComponentBrowser
Sub-componentAndroid
Bug ClassAuthorization Error
Action tierwatch — logic/policy bug — security-relevant, no memory-unsafety
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.
Tracker533059149
Fix commitea3598ed49db (chromium/src) +5/-2
CWECWE-863
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CISA KEVNot listed
CreditedGoogle
Reported2026-07-09 (per vendor advisory)
Fix landed2026-07-16 (public git)
Disclosed2026-08-25
Patch gap40 days — fix public in source before the advisory

Background

Renderer debug URLs
special URLs such as javascript:, chrome://crash, chrome://kill and similar that instruct the renderer to perform debug actions, and which are gated because they can be triggered programmatically.
DevTools access policy
an enterprise/profile setting that can block DevTools for a page; when DevTools is blocked, debug URLs are supposed to be blocked too.
`ENABLE_DEVTOOLS_FRONTEND`
a build flag indicating the DevTools frontend is compiled in; it can be false even on non-Android desktop builds and is generally false where DevTools is not shipped.
`IS_ANDROID`
a build flag that is true on Android builds.

Root Cause Analysis

The changed function (the enclosing name is not in the hunk; from the file it is ChromeContentBrowserClient::ShouldBlockRendererDebugURL (inferred)) decides whether a renderer debug URL should be blocked, and it contains a block that consults the DevTools access policy: “If devtools access is blocked for the page, debug URLs should also be blocked.”

Pre-patch, that block was compiled under #if !BUILDFLAG(IS_ANDROID), meaning the DevTools-blocked-implies-debug-URL-blocked check was simply skipped on Android.

As a result, on Android a debug URL could be permitted even when DevTools access was blocked for the page, an incorrect authorization.

The fix changes the guard to #if BUILDFLAG(ENABLE_DEVTOOLS_FRONTEND) and moves the devtools_window.h include under the same flag, so the policy check now runs on Android (where DevTools frontend is enabled) and correctly ties debug-URL blocking to DevTools blocking, while excluding builds that lack the DevTools frontend entirely.

Key insight
The DevTools-access check that gates debug URLs was conditioned on the wrong build flag (!IS_ANDROID), excluding Android entirely; the fix re-conditions it on ENABLE_DEVTOOLS_FRONTEND so the check runs wherever DevTools exists, including Android.

Attack Path

  1. Target an Android profile with DevTools blocked A page runs in a context where the DevTools access policy blocks DevTools for that page, which should also block debug URLs.
  2. Invoke a renderer debug URL The page attempts to navigate to or trigger a renderer debug URL that the debug-URL handler evaluates.
  3. Skip the policy check on Android Because the DevTools-blocked check was compiled out under #if !BUILDFLAG(IS_ANDROID), the handler does not consult the DevTools policy on Android and fails to block the debug URL.
  4. Debug action proceeds The debug URL is honored despite the DevTools/debug restriction, violating the intended authorization (the concrete downstream effect is not shown in the diff) (inferred).

Impact Assessment

On Android, a page that should have debug URLs blocked (because DevTools access is blocked for it) could nonetheless invoke renderer debug URLs, bypassing the intended DevTools-based restriction in the browser process’s decision path. The precondition is a build/configuration where DevTools access is blocked for the page. The vendor advisory rates this low severity and does not report in-the-wild exploitation; NVD scores it CVSS 4.3.

Files Changed

  • chrome/browser/chrome_content_browser_client.cc

Audit Directions

  • Platform-conditional security checks
    Search for #if !BUILDFLAG(IS_ANDROID) (or other platform guards) wrapping authorization or policy checks; verify the platform exclusion is intentional rather than accidentally disabling enforcement.
  • Feature-flag vs platform-flag mismatch
    Look for checks that depend on a subsystem (e.g., DevTools) but are gated on a platform flag instead of the subsystem’s own capability flag (e.g., ENABLE_DEVTOOLS_FRONTEND).
  • Debug/privileged URL gating
    Audit all decision points that permit javascript:/chrome:// debug URLs to ensure each consults the relevant access policies uniformly across every platform.

Patch

view commit
From ea3598ed49db149f49fea869b5cb4d1bde0de32e Mon Sep 17 00:00:00 2001
From: Ryo Hashimoto <[email protected]>
Date: Thu, 16 Jul 2026 09:24:51 -0700
Subject: [PATCH] android: Block renderer debug URL if DevTools is not allowed

BUG=533059149

Change-Id: I5315837844c3d801778762a5fea5465a0c3d9d96
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8068618
Reviewed-by: Danil Somsikov <[email protected]>
Commit-Queue: Ryo Hashimoto <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1663171}
---
diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
index 7a8f0d2..9c1c3cc 100644
--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc
@@ -549,7 +549,6 @@
 #include "chrome/browser/actor/actor_keyed_service.h"
 #include "chrome/browser/actor/actor_keyed_service_factory.h"
 #include "chrome/browser/devtools/chrome_devtools_manager_delegate.h"
-#include "chrome/browser/devtools/devtools_window.h"
 #include "chrome/browser/digital_credentials/digital_identity_provider_desktop.h"
 #include "chrome/browser/direct_sockets/chrome_direct_sockets_delegate.h"
 #include "chrome/browser/indigo/onboarding/indigo_onboarding_dialog.h"
@@ -640,6 +639,10 @@
 #include "components/captive_portal/content/captive_portal_url_loader_throttle.h"
 #endif
 
+#if BUILDFLAG(ENABLE_DEVTOOLS_FRONTEND)
+#include "chrome/browser/devtools/devtools_window.h"
+#endif
+
 #if BUILDFLAG(ENABLE_EXTENSIONS_CORE)
 #include "chrome/browser/extensions/chrome_content_browser_client_extensions_part.h"
 #include "chrome/browser/extensions/chrome_extension_cookies.h"
@@ -7790,7 +7793,7 @@
     const GURL& url,
     content::BrowserContext* context,
     content::RenderFrameHost* render_frame_host) {
-#if !BUILDFLAG(IS_ANDROID)
+#if BUILDFLAG(ENABLE_DEVTOOLS_FRONTEND)
   // If devtools access is blocked for the page, debug URLs should also be
   // blocked for the page.
   Profile* profile = Profile::FromBrowserContext(context);
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
On This Page