Chrome · Navigation
CVE-2026-8562
Info Disclosure in Navigation
Overview
Medium
Severity
4.3
CVSS
No
Exploited ITW
Fixed
Fix Status
What the public commits show
The public commit citing this bug,
6896f2f774f9 (“Add UKM for same-document navs with a cross-origin initiator”), adds a single UKM feature entry to measure same-document navigations started by a cross-origin initiator. It is measurement only. The bug report is still restricted.
These commits cite this CVE's bug, but none of them contains a code change that removes the vulnerability, so no root-cause analysis is published. If the code fix later becomes public (or is identified under another bug), it will be analyzed then.
Files Changed
components/page_load_metrics/browser/observers/use_counter/ukm_features.cc
Patch
From 6896f2f774f9b2bbfd8b13bc0a0edb4d73962c06 Mon Sep 17 00:00:00 2001 From: Camille Lamy <[email protected]> Date: Tue, 17 Mar 2026 11:47:35 -0700 Subject: [PATCH] Add UKM for same-document navs with a cross-origin initiator This CL adds the use counter for same-document navigations with a cross-origin initator to the list of use counters tracked by UKMs. These navigations have the potential to leak cross-origin information, so we'd like to force all navigations with cross-origin initiators to be cross-document. However, we want to better understand the compatibility impact, hence the UKM. Bug: 40057534 Change-Id: Ica85008a13220bc8c75476b26219dade6b470a88 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7666301 Auto-Submit: Camille Lamy <[email protected]> Commit-Queue: Camille Lamy <[email protected]> Reviewed-by: Alexei Svitkine <[email protected]> Cr-Commit-Position: refs/heads/main@{#1600696} --- diff --git a/components/page_load_metrics/browser/observers/use_counter/ukm_features.cc b/components/page_load_metrics/browser/observers/use_counter/ukm_features.cc index b179c50e..746dfd6 100644 --- a/components/page_load_metrics/browser/observers/use_counter/ukm_features.cc +++ b/components/page_load_metrics/browser/observers/use_counter/ukm_features.cc @@ -473,6 +473,7 @@ WebFeature::kSvgFilterPaintedOnLocalFrame, WebFeature::kSvgFilterPaintedOnRemoteFrame, WebFeature::kSvgFilterPaintedOnWebPlugin, + WebFeature::kSameDocumentCrossOriginInitiator, // NOTE: before adding new use counters here, verify in UMA that // their emissions are very rare, e.g. <1% of page loads. }));
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page