CVE-2026-8011
Overview
Files Changed
components/search_engines/template_url_fetcher.cc
Patch
From 17407bee77cc109057d1b3de9ae3a7d5b339e57a Mon Sep 17 00:00:00 2001 From: Dylan Cutler <[email protected]> Date: Tue, 31 Mar 2026 15:27:47 -0700 Subject: [PATCH] Use initiator for SiteForCookies in TemplateURLFetcher::RequestDelegate This fixes a privacy bug that can bypass 3PC protections when blocking is enabled. This bug allows link with type "application/opensearchdescription+xml" to send its 1P cookies even when 3PCB is on. This can also be a SameSite leak which allows credentialed GET requests. Bug: 496626029 Change-Id: Ie1a0ef6e2681f593fafb583240eaf7fb0ad5d4da Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7713898 Reviewed-by: Justin Donnelly <[email protected]> Commit-Queue: Dylan Cutler <[email protected]> Cr-Commit-Position: refs/heads/main@{#1608144} --- diff --git a/components/search_engines/template_url_fetcher.cc b/components/search_engines/template_url_fetcher.cc index 47651252..34bdaf00 100644 --- a/components/search_engines/template_url_fetcher.cc +++ b/components/search_engines/template_url_fetcher.cc @@ -137,7 +137,8 @@ resource_request->resource_type = /* blink::mojom::ResourceType::kSubResource */ 6; resource_request->destination = network::mojom::RequestDestination::kEmpty; - resource_request->site_for_cookies = net::SiteForCookies::FromUrl(osdd_url); + resource_request->site_for_cookies = + net::SiteForCookies::FromOrigin(initiator); simple_url_loader_ = network::SimpleURLLoader::Create( std::move(resource_request), kTrafficAnnotation); simple_url_loader_->SetAllowHttpErrorResults(true);
Original Bug Report
3PCD bypass via incorrect site_for_cookies in OSDD fetch
Project Fortify, an experimental security project, has identified the following potential security issue.
Overview: A logic error in the OpenSearch Description Document (OSDD) fetcher incorrectly sets the request’s site_for_cookies to the target URL rather than the initiator. This causes the network service to misclassify cross-site OSDD fetches as first-party requests, bypassing Third-Party Cookie Deprecation (3PCD) protections and sending unpartitioned SameSite=None cookies.
Affected files:
components/search_engines/template_url_fetcher.ccchrome/browser/ui/search_engines/search_engine_tab_helper.cc
Estimated timestamp from git blame: 2025-01-08
Description
There is a potential logic error in how Chrome fetches OpenSearch Description Documents (OSDD) that allows a cross-site attacker to trigger a credentialed GET request to a victim’s server, bypassing Third-Party Cookie Deprecation (3PCD) protections.
The vulnerability exists in components/search_engines/template_url_fetcher.cc. When a page declares an OSDD via a <link rel='search'> tag, the browser eventually invokes TemplateURLFetcher::ScheduleDownload to fetch the document. In the TemplateURLFetcher::RequestDelegate constructor, the network::ResourceRequest is initialized with:
// components/search_engines/template_url_fetcher.cc:140
resource_request->site_for_cookies = net::SiteForCookies::FromUrl(osdd_url);
Because site_for_cookies is derived directly from the target osdd_url rather than the top-level initiating document’s site, the network service’s cookie policy logic (CookieSettingsBase::GetCookieSettingInternal) incorrectly evaluates IsThirdPartyRequest(url, site_for_cookies) as false. The request is treated as a first-party request, completely bypassing 3PCD blocking logic.
While SameSite=Lax and Strict cookies remain protected because ComputeSameSiteContextForRequest independently verifies the request_initiator (which is correctly set to the attacker’s site), all unpartitioned SameSite=None cookies are included in the outgoing cross-site request.
Potential Reproduction Steps
Note: These are suggested steps based on static analysis, as this agent does not have the ability to run a live proof-of-concept.
- Ensure third-party cookies are blocked (default behavior under 3PCD).
- A victim logs into
victim.com, which sets aSameSite=None; Securesession cookie (without thePartitionedattribute). - The victim navigates to a malicious site hosted at the root path (e.g.,
https://attacker.com/). Note: The root path is required becauseSearchEngineTabHelper::GenerateKeywordFromNavigationEntryskips keyword generation for URLs with a path length > 1. - The
attacker.compage includes the following tag in its<head>:<link rel='search' type='application/opensearchdescription+xml' href='https://victim.com/api/endpoint'> - The browser processes the tag and dispatches an OSDD fetch to
victim.com. - Because of the
site_for_cookiesflaw, the request will carry the victim’s unpartitionedSameSite=Nonecookies tovictim.com/api/endpoint, successfully bypassing 3PCD.
Impact
- Cross-site tracking bypass: A victim site can receive a credentialed request whenever a user visits an attacker-controlled page, allowing the victim to track the user across sites despite 3PCD.
- Blind GET-based CSRF: An attacker can trigger credentialed GET requests to sensitive endpoints on a victim’s site that rely on 3PCD for protection rather than explicit
SameSiteattributes. - Note: The attacker cannot read the response body, as the OSDD fetch response is consumed internally by the browser process (
TemplateURLParser).
Suggested Fix
Update TemplateURLFetcher::RequestDelegate to correctly construct the site_for_cookies based on the initiating document’s origin, or explicitly use an empty net::SiteForCookies() for cross-site OSDD fetches so that the network service correctly identifies them as third-party requests and applies 3PCD blocking appropriately:
resource_request->site_for_cookies = net::SiteForCookies::FromOrigin(initiator);
Evaluated with Chrome root at commit: 0eb4855bda702feaaa8b899336664f97e3df88b8
Results so far have been promising, but there can be wrong deductions. If this proves to be a false positive, please close as WAI; data from false positives will be used to improve accuracy over time. Please feel free to reach out to me if you have concerns or feedback.