PatchGap
Chrome · Downloads

CVE-2026-8565

Logic Error in Downloads
Medium chrome Logic Error 📄 Reporter bug report 🔧 Commit mapped

Overview

Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInappropriate implementation in Downloads
DescriptionInappropriate implementation in Downloads
ComponentDownloads
Bug ClassLogic Error
Tracker442860473
Fix commit69626ea817c6 (chromium/src) +2/-1
CISA KEVNot listed
CreditedFarras Givari
Disclosed2026-05-12

Files Changed

  • chrome/app/generated_resources.grd
  • chrome/app/generated_resources_grd/IDS_DOWNLOAD_BY_EXTENSION_URL.png.sha1

Patch

view commit
From 69626ea817c67a6450bf47627483671e030fa5d5 Mon Sep 17 00:00:00 2001
From: Yaw Frempong <[email protected]>
Date: Thu, 19 Mar 2026 11:23:03 -0700
Subject: [PATCH] [Downloads Origin] Update String for Download by Extension URL

Details: Update the text for downloads triggered by an extension URL to
make spoofing attempts more obvious to the end-user.

Screenshot: https://crbug.com/442860473#attachment74524550

Bug: 442860473
Change-Id: Ibb900e954a2d4cb1ba9b0852846a9634d842db7a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7681374
Reviewed-by: Lily Chen <[email protected]>
Reviewed-by: Andrew Liu <[email protected]>
Commit-Queue: Yaw Frempong <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1602119}
---

diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
index 2971987..5e61840 100644
--- a/chrome/app/generated_resources.grd
+++ b/chrome/app/generated_resources.grd
@@ -2554,7 +2554,7 @@
       </message>
       <message name="IDS_DOWNLOAD_BY_EXTENSION_URL"
                desc="Indicates which extension downloaded this file by name and URL.">
-        Downloaded by &lt;a href=&quot;<ph name="URL">$1<ex>adblock.com</ex></ph>&quot;&gt;<ph name="EXTENSION">$2<ex>The Best Chrome Extension Ever</ex></ph>&lt;/a&gt;
+        Downloaded by extension: &lt;a href=&quot;<ph name="URL">$1<ex>adblock.com</ex></ph>&quot;&gt;<ph name="EXTENSION">$2<ex>The Best Chrome Extension Ever</ex></ph>&lt;/a&gt;
       </message>
       <message name="IDS_DOWNLOADS_PAGE_INITIATOR_LINE" desc="Line that indicates the site that initiated a file download.">
         From <ph name="DISPLAY_INITIATOR_ORIGIN">$1<ex>https://example.com</ex></ph>
diff --git a/chrome/app/generated_resources_grd/IDS_DOWNLOAD_BY_EXTENSION_URL.png.sha1 b/chrome/app/generated_resources_grd/IDS_DOWNLOAD_BY_EXTENSION_URL.png.sha1
new file mode 100644
index 0000000..bd9577f
--- /dev/null
+++ b/chrome/app/generated_resources_grd/IDS_DOWNLOAD_BY_EXTENSION_URL.png.sha1
@@ -0,0 +1 @@
+be7e7e58432e297c51f8baff1f3365b9c45e41f1
\ No newline at end of file
Loading diff…

Original Bug Report

reported by [email protected]

File Source Origin Spoofing via Extension Name

Steps to reproduce the problem

  1. Load the extension
  2. Go to chrome://extensions
  3. Reload the extension
  4. Go to chrome://downloads and you will see the google.apk origin is pointing to https://google.com

Problem Description

This vulnerability occurs when the chrome://downloads source origin can be spoofed via the extension name. By default, if we install an extension that downloads a file, Chrome will set the downloaded file’s origin to the extension’s name. For example, if a file is downloaded by an extension named “Frozzipies Extension”, Chrome will display the origin as “Downloaded by Frozzipies Extension”.

However, in this case, we can use any valid URL (like https://google.com) as the extension name, which causes Chrome to display the file origin as “Downloaded by https://google.com”, leading to an origin spoofing issue.

Summary

File Source Origin Spoofing via Extension Name

Additional Data

Category: Security
Chrome Channel: Not sure
Regression: N/A \

View on issue tracker
Links in the report
On This Page