Chrome · Navigation
CVE-2026-8562
Logic Error in Navigation
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
components/page_load_metrics/browser/observers/use_counter/ukm_features.cc
Patch
From 6896f2f774f9b2bbfd8b13bc0a0edb4d73962c06 Mon Sep 17 00:00:00 2001 From: Camille Lamy <[email protected]> Date: Tue, 17 Mar 2026 11:47:35 -0700 Subject: [PATCH] Add UKM for same-document navs with a cross-origin initiator This CL adds the use counter for same-document navigations with a cross-origin initator to the list of use counters tracked by UKMs. These navigations have the potential to leak cross-origin information, so we'd like to force all navigations with cross-origin initiators to be cross-document. However, we want to better understand the compatibility impact, hence the UKM. Bug: 40057534 Change-Id: Ica85008a13220bc8c75476b26219dade6b470a88 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7666301 Auto-Submit: Camille Lamy <[email protected]> Commit-Queue: Camille Lamy <[email protected]> Reviewed-by: Alexei Svitkine <[email protected]> Cr-Commit-Position: refs/heads/main@{#1600696} --- diff --git a/components/page_load_metrics/browser/observers/use_counter/ukm_features.cc b/components/page_load_metrics/browser/observers/use_counter/ukm_features.cc index b179c50e..746dfd6 100644 --- a/components/page_load_metrics/browser/observers/use_counter/ukm_features.cc +++ b/components/page_load_metrics/browser/observers/use_counter/ukm_features.cc @@ -473,6 +473,7 @@ WebFeature::kSvgFilterPaintedOnLocalFrame, WebFeature::kSvgFilterPaintedOnRemoteFrame, WebFeature::kSvgFilterPaintedOnWebPlugin, + WebFeature::kSameDocumentCrossOriginInitiator, // NOTE: before adding new use counters here, verify in UMA that // their emissions are very rare, e.g. <1% of page loads. }));
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page