PatchGap
Chrome · Downloads › Downloads Origin

CVE-2026-8565

Logic Error in Downloads (Downloads Origin)
Medium watch CVSS 4.7 chrome Logic Error 📄 Reporter bug report 🔧 Commit mapped

Overview

Medium
Severity
4.7
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInappropriate implementation in Downloads
DescriptionInappropriate implementation in Downloads
ComponentDownloads
Sub-componentDownloads Origin
Bug ClassLogic Error
Action tierwatch — logic/policy bug — security-relevant, no memory-unsafety
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.
Tracker442860473
Fix commit69626ea817c6 (chromium/src) +2/-1
CWECWE-451
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:L
CISA KEVNot listed
CreditedFarras Givari
Reported2025-09-04 (per vendor advisory)
Fix landed2026-03-19 (public git)
Disclosed2026-05-12
Patch gap54 days — fix public in source before the advisory

Background

Downloads origin attribution
the download UI surface shows who initiated a download, including a dedicated string for downloads triggered by an extension URL.
`IDS_DOWNLOAD_BY_EXTENSION_URL`
the localized message resource (in chrome/app/generated_resources.grd) rendering the “Downloaded by …” attribution line with the extension name linked to its URL.
UI spoofing
misleading the user about the true source/trust of content; here, an extension-initiated download could be presented so it reads like an ordinary site download.
`.grd` message / `.png.sha1` screenshot baseline
the resource string plus a checked-in screenshot hash used by the translation/screenshot tooling.

Root Cause Analysis

This is a user-facing string change, not a code-logic fix. The IDS_DOWNLOAD_BY_EXTENSION_URL message previously read “Downloaded by <extension link>”, which did not clearly convey that an extension (rather than a website) initiated the download, enabling spoofing where an extension-triggered download looked like a normal one.

The patch changes the text to “Downloaded by extension: <extension link>”, explicitly labeling the initiator as an extension so spoofing attempts are more obvious to the end user. The only other change is a new IDS_DOWNLOAD_BY_EXTENSION_URL.png.sha1 screenshot-baseline file for the translation pipeline. No validation, parsing, or control-flow logic is altered; this neither tightens nor relaxes any runtime check — it is purely clarifying copy.

Key insight
The attribution string omitted the word “extension,” letting extension-initiated downloads be presented ambiguously; the fix prefixes “Downloaded by extension:” to make the initiator unmistakable.

Attack Path

  1. Extension triggers a download A download is initiated via an extension URL, so the download UI renders IDS_DOWNLOAD_BY_EXTENSION_URL.
  2. Ambiguous attribution Pre-patch, the line reads “Downloaded by <name/URL>” without signaling it was an extension, so the user may read it as an ordinary site download.
  3. User misjudges trust Relying on the unclear attribution, the user may trust or act on the downloaded file believing it came from a benign source (a spoofing/social-engineering outcome; no memory-safety sink is involved).

Impact Assessment

The advisory rates this medium severity (Inappropriate implementation in Downloads). The issue is a UI-spoofing weakness: an extension-initiated download could be presented ambiguously, potentially misleading the user about its origin; the fix is a clarifying string change and provides no memory-corruption or code-execution surface. No exploited-in-the-wild status is stated by the advisory.

Files Changed

  • chrome/app/generated_resources.grd
  • chrome/app/generated_resources_grd/IDS_DOWNLOAD_BY_EXTENSION_URL.png.sha1

Audit Directions

  • Initiator/origin attribution strings
    Review download and permission UI strings that attribute an action to a site vs. an extension vs. the browser, ensuring the actor type is always explicit to resist spoofing.
  • Extension-sourced UI surfaces
    Audit other places where extension-driven activity (downloads, notifications, prompts) is rendered to confirm the extension origin is clearly disclosed.
  • Linkified names in trust decisions
    Where a user-visible link embeds an attacker-influenced name/URL, verify surrounding copy prevents the link from masquerading as a first-party or site-initiated action.

Patch

view commit
From 69626ea817c67a6450bf47627483671e030fa5d5 Mon Sep 17 00:00:00 2001
From: Yaw Frempong <[email protected]>
Date: Thu, 19 Mar 2026 11:23:03 -0700
Subject: [PATCH] [Downloads Origin] Update String for Download by Extension URL

Details: Update the text for downloads triggered by an extension URL to
make spoofing attempts more obvious to the end-user.

Screenshot: https://crbug.com/442860473#attachment74524550

Bug: 442860473
Change-Id: Ibb900e954a2d4cb1ba9b0852846a9634d842db7a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7681374
Reviewed-by: Lily Chen <[email protected]>
Reviewed-by: Andrew Liu <[email protected]>
Commit-Queue: Yaw Frempong <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1602119}
---

diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
index 2971987..5e61840 100644
--- a/chrome/app/generated_resources.grd
+++ b/chrome/app/generated_resources.grd
@@ -2554,7 +2554,7 @@
       </message>
       <message name="IDS_DOWNLOAD_BY_EXTENSION_URL"
                desc="Indicates which extension downloaded this file by name and URL.">
-        Downloaded by &lt;a href=&quot;<ph name="URL">$1<ex>adblock.com</ex></ph>&quot;&gt;<ph name="EXTENSION">$2<ex>The Best Chrome Extension Ever</ex></ph>&lt;/a&gt;
+        Downloaded by extension: &lt;a href=&quot;<ph name="URL">$1<ex>adblock.com</ex></ph>&quot;&gt;<ph name="EXTENSION">$2<ex>The Best Chrome Extension Ever</ex></ph>&lt;/a&gt;
       </message>
       <message name="IDS_DOWNLOADS_PAGE_INITIATOR_LINE" desc="Line that indicates the site that initiated a file download.">
         From <ph name="DISPLAY_INITIATOR_ORIGIN">$1<ex>https://example.com</ex></ph>
diff --git a/chrome/app/generated_resources_grd/IDS_DOWNLOAD_BY_EXTENSION_URL.png.sha1 b/chrome/app/generated_resources_grd/IDS_DOWNLOAD_BY_EXTENSION_URL.png.sha1
new file mode 100644
index 0000000..bd9577f
--- /dev/null
+++ b/chrome/app/generated_resources_grd/IDS_DOWNLOAD_BY_EXTENSION_URL.png.sha1
@@ -0,0 +1 @@
+be7e7e58432e297c51f8baff1f3365b9c45e41f1
\ No newline at end of file
Loading diff…

Original Bug Report

reported by [email protected]

File Source Origin Spoofing via Extension Name

Steps to reproduce the problem

  1. Load the extension
  2. Go to chrome://extensions
  3. Reload the extension
  4. Go to chrome://downloads and you will see the google.apk origin is pointing to https://google.com

Problem Description

This vulnerability occurs when the chrome://downloads source origin can be spoofed via the extension name. By default, if we install an extension that downloads a file, Chrome will set the downloaded file’s origin to the extension’s name. For example, if a file is downloaded by an extension named “Frozzipies Extension”, Chrome will display the origin as “Downloaded by Frozzipies Extension”.

However, in this case, we can use any valid URL (like https://google.com) as the extension name, which causes Chrome to display the file origin as “Downloaded by https://google.com”, leading to an origin spoofing issue.

Summary

File Source Origin Spoofing via Extension Name

Additional Data

Category: Security
Chrome Channel: Not sure
Regression: N/A \

View on issue tracker
Links in the report
On This Page