Medium CVSS 4.3 chrome Info Disclosure 🔧 Commit mapped

Overview

Medium
Severity
4.3
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactSide-channel information leakage in Navigation
DescriptionSide-channel information leakage in Navigation
ComponentNavigation
Bug ClassInfo Disclosure
Tracker40057534
Fix commit6896f2f774f9 (chromium/src) +1/-0
CWECWE-1300
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CISA KEVNot listed
CreditedGoogle
Reported2021-10-06 (per vendor advisory)
Fix landed2026-03-17 (public git)
Disclosed2026-05-12
Patch gapNot computed: only measurement/test/docs commits cite the bug.

What the public commits show

The public commit citing this bug, 6896f2f774f9 (“Add UKM for same-document navs with a cross-origin initiator”), adds a single UKM feature entry to measure same-document navigations started by a cross-origin initiator. It is measurement only. The bug report is still restricted.

These commits cite this CVE's bug, but none of them contains a code change that removes the vulnerability, so no root-cause analysis is published. If the code fix later becomes public (or is identified under another bug), it will be analyzed then.

Files Changed

  • components/page_load_metrics/browser/observers/use_counter/ukm_features.cc
From 6896f2f774f9b2bbfd8b13bc0a0edb4d73962c06 Mon Sep 17 00:00:00 2001
From: Camille Lamy <[email protected]>
Date: Tue, 17 Mar 2026 11:47:35 -0700
Subject: [PATCH] Add UKM for same-document navs with a cross-origin initiator

This CL adds the use counter for same-document navigations with a
cross-origin initator to the list of use counters tracked by UKMs. These
navigations have the potential to leak cross-origin information, so we'd
like to force all navigations with cross-origin initiators to be
cross-document. However, we want to better understand the compatibility
impact, hence the UKM.

Bug: 40057534
Change-Id: Ica85008a13220bc8c75476b26219dade6b470a88
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7666301
Auto-Submit: Camille Lamy <[email protected]>
Commit-Queue: Camille Lamy <[email protected]>
Reviewed-by: Alexei Svitkine <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1600696}
---

diff --git a/components/page_load_metrics/browser/observers/use_counter/ukm_features.cc b/components/page_load_metrics/browser/observers/use_counter/ukm_features.cc
index b179c50e..746dfd6 100644
--- a/components/page_load_metrics/browser/observers/use_counter/ukm_features.cc
+++ b/components/page_load_metrics/browser/observers/use_counter/ukm_features.cc
@@ -473,6 +473,7 @@
           WebFeature::kSvgFilterPaintedOnLocalFrame,
           WebFeature::kSvgFilterPaintedOnRemoteFrame,
           WebFeature::kSvgFilterPaintedOnWebPlugin,
+          WebFeature::kSameDocumentCrossOriginInitiator,
           // NOTE: before adding new use counters here, verify in UMA that
           // their emissions are very rare, e.g. <1% of page loads.
       }));
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.