From acc73923fea2710e74d6c5d3b896ba295f8a22c5 Mon Sep 17 00:00:00 2001
From: Benjamin Keen <[email protected]>
Date: Tue, 04 Aug 2026 14:00:07 -0700
Subject: [PATCH] Compute source_title from the committed origin of the primary main frame

`BuildMetadata()` previously derived the source origin from the
committed URL. For about:blank documents, this created an opaque origin
and fell back to reading the opener's current URL, which could be
spoofed if the opener navigated cross-origin.

This CL fixes this by using the committed origin of the primary main
frame directly, which handles about:blank inheritance and sandboxed
precursors, allowing the opener-chain fallback to be removed.

Bug: 514056835
Change-Id: Ia489373461d54591fe1df8af3e7071941f80d9b9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8191294
Commit-Queue: Benjamin Keen <[email protected]>
Reviewed-by: Tommy Steimel <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1673651}
---

diff --git a/chrome/browser/picture_in_picture/video_picture_in_picture_window_controller_browsertest.cc b/chrome/browser/picture_in_picture/video_picture_in_picture_window_controller_browsertest.cc
index ce23ee9c..b0c50c4b 100644
--- a/chrome/browser/picture_in_picture/video_picture_in_picture_window_controller_browsertest.cc
+++ b/chrome/browser/picture_in_picture/video_picture_in_picture_window_controller_browsertest.cc
@@ -2565,7 +2565,7 @@
   ASSERT_TRUE(ExecJs(popup_contents, script));
 
   // Wait until the Picture-in-Picture window is visible and its source title
-  // correctly falls back to the opener's origin (example.com).
+  // reflects the precursor origin of the opaque sandboxed frame (example.com).
   SetUpWindowController(popup_contents);
   ASSERT_TRUE(base::test::RunUntil([&]() {
     auto* overlay_window = GetOverlayWindow();
@@ -2622,8 +2622,7 @@
   ASSERT_TRUE(ExecJs(popup2_contents, script));
 
   // Wait until the Picture-in-Picture window is visible and its source title
-  // correctly falls back through the nested openers to the original origin
-  // (example.com).
+  // reflects the inherited precursor origin of the nested popups (example.com).
   SetUpWindowController(popup2_contents);
   ASSERT_TRUE(base::test::RunUntil([&]() {
     auto* overlay_window = GetOverlayWindow();
@@ -2635,7 +2634,7 @@
 }
 
 IN_PROC_BROWSER_TEST_F(VideoPictureInPictureWindowControllerBrowserTest,
-                       SourceTitle_ClosestAncestorFallback) {
+                       SourceTitle_InheritedFromNavigatedOpener) {
   const std::string kHost1 = "example.com";
   const std::string kHost2 = "another-site.com";
   const std::u16string kExpectedTitlePrefix = base::ASCIIToUTF16(kHost2);
@@ -2691,7 +2690,8 @@
       {video_url.spec()}, nullptr);
   ASSERT_TRUE(ExecJs(popup2_contents, script));
 
-  // Verify source title is Host 2 (the closest opener with a valid precursor).
+  // Verify the source title reflects the opener's origin at the time of the
+  // popup's creation (another-site.com).
   SetUpWindowController(popup2_contents);
   ASSERT_TRUE(base::test::RunUntil([&]() {
     auto* overlay_window = GetOverlayWindow();
@@ -2702,6 +2702,76 @@
   }));
 }
 
+IN_PROC_BROWSER_TEST_F(VideoPictureInPictureWindowControllerBrowserTest,
+                       SourceTitle_AboutBlankPopupUsesInheritedOrigin) {
+  const std::string kHost1 = "example.com";
+  const std::string kHost2 = "another-site.com";
+  const std::u16string kExpectedTitlePrefix = base::ASCIIToUTF16(kHost1);
+
+  // Open a non-sandboxed page on Host 1.
+  GURL url1 = embedded_test_server()->GetURL(kHost1, "/title1.html");
+  ASSERT_TRUE(ui_test_utils::NavigateToURL(browser(), url1));
+  content::WebContents* active_web_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+
+  // Open an about:blank popup. The popup's committed URL is about:blank, but
+  // its committed origin is inherited from Host 1.
+  content::WebContents* popup_contents;
+  {
+    content::WebContentsAddedObserver observer;
+    ASSERT_TRUE(ExecJs(active_web_contents, "window.open('about:blank');"));
+    popup_contents = observer.GetWebContents();
+  }
+  ASSERT_FALSE(
+      popup_contents->GetPrimaryMainFrame()->GetLastCommittedOrigin().opaque());
+  ASSERT_EQ(url::Origin::Create(url1),
+            popup_contents->GetPrimaryMainFrame()->GetLastCommittedOrigin());
+
+  // Navigate the opener cross-origin to Host 2. The popup keeps its inherited
+  // Host 1 origin and its opener relationship.
+  GURL url2 = embedded_test_server()->GetURL(kHost2, "/title1.html");
+  {
+    content::TestNavigationObserver nav_observer(active_web_contents);
+    ASSERT_TRUE(ExecJs(active_web_contents,
+                       base::StringPrintf("window.location.href = '%s';",
+                                          url2.spec().c_str())));
+    nav_observer.Wait();
+  }
+  ASSERT_EQ(active_web_contents->GetPrimaryMainFrame(),
+            popup_contents->GetOpener());
+
+  // Play video in the popup and request Picture-in-Picture.
+  GURL video_url = embedded_test_server()->GetURL(kHost1, "/media/bear.webm");
+  std::string script = base::ReplaceStringPlaceholders(
+      R"(
+        const video = document.createElement('video');
+        video.src = '$1';
+        video.loop = true;
+        document.body.appendChild(video);
+        video.play().then(() => video.requestPictureInPicture());
+      )",
+      {video_url.spec()}, nullptr);
+  ASSERT_TRUE(ExecJs(popup_contents, script));
+
+  // Wait until the Picture-in-Picture window is visible and its source title
+  // has been populated.
+  SetUpWindowController(popup_contents);
+  ASSERT_TRUE(base::test::RunUntil([&]() {
+    auto* overlay_window = GetOverlayWindow();
+    return overlay_window && overlay_window->IsVisible() &&
+           overlay_window->origin_for_testing() &&
+           !overlay_window->origin_for_testing()->GetText().empty();
+  }));
+
+  // The source title must reflect the popup's own (inherited) origin, not the
+  // opener's current origin.
+  EXPECT_TRUE(
+      base::StartsWith(GetOverlayWindow()->origin_for_testing()->GetText(),
+                       kExpectedTitlePrefix))
+      << "source title is '"
+      << GetOverlayWindow()->origin_for_testing()->GetText() << "'";
+}
+
 struct InteractionTestParam {
   ui::EventType event_type;
   bool title_should_be_visible;
diff --git a/content/browser/media/session/media_session_impl.cc b/content/browser/media/session/media_session_impl.cc
index a4580de..297a5049 100644
--- a/content/browser/media/session/media_session_impl.cc
+++ b/content/browser/media/session/media_session_impl.cc
@@ -8,7 +8,6 @@
 #include <memory>
 #include <utility>
 
-#include "base/containers/flat_set.h"
 #include "base/functional/bind.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
@@ -2063,35 +2062,13 @@
       source_title =
           content_client->GetLocalizedString(IDS_MEDIA_SESSION_DATA_SOURCE);
     } else {
-      url::Origin origin = url::Origin::Create(url);
-      GURL format_url = origin.GetURL();
-
-      // If the origin is opaque, use its precursor origin if available.
-      // Otherwise, traverse the opener chain to find the closest ancestor with
-      // a valid precursor origin. This ensures we display a recognizable origin
-      // to the user.
-      if (origin.opaque()) {
-        WebContents* current_web_contents = web_contents();
-        base::flat_set<WebContents*> seen_web_contents;
-
-        while (current_web_contents &&
-               !seen_web_contents.contains(current_web_contents)) {
-          seen_web_contents.insert(current_web_contents);
-
-          url::Origin current_origin =
-              url::Origin::Create(current_web_contents->GetLastCommittedURL());
-          const auto& precursor =
-              current_origin.GetTupleOrPrecursorTupleIfOpaque();
-          if (precursor.IsValid()) {
-            format_url = precursor.GetURL();
-            break;
-          }
-
-          RenderFrameHost* opener = current_web_contents->GetOpener();
-          current_web_contents =
-              opener ? WebContents::FromRenderFrameHost(opener) : nullptr;
-        }
-      }
+      // Use the frame's committed origin to determine the source title.
+      // This retrieves the inherited origin for "about:blank" documents
+      // (which is the origin of their creator) and the precursor origin for
+      // sandboxed documents (which have opaque origins).
+      const url::Origin& origin =
+          web_contents()->GetPrimaryMainFrame()->GetLastCommittedOrigin();
+      GURL format_url = origin.GetTupleOrPrecursorTupleIfOpaque().GetURL();
 
       source_title = url_formatter::FormatUrl(
           format_url,

diff --git a/chrome/browser/picture_in_picture/video_picture_in_picture_window_controller_browsertest.cc b/chrome/browser/picture_in_picture/video_picture_in_picture_window_controller_browsertest.cc
index ce23ee9c..b0c50c4b 100644
--- a/chrome/browser/picture_in_picture/video_picture_in_picture_window_controller_browsertest.cc
+++ b/chrome/browser/picture_in_picture/video_picture_in_picture_window_controller_browsertest.cc
@@ -2565,7 +2565,7 @@
   ASSERT_TRUE(ExecJs(popup_contents, script));
 
   // Wait until the Picture-in-Picture window is visible and its source title
-  // correctly falls back to the opener's origin (example.com).
+  // reflects the precursor origin of the opaque sandboxed frame (example.com).
   SetUpWindowController(popup_contents);
   ASSERT_TRUE(base::test::RunUntil([&]() {
     auto* overlay_window = GetOverlayWindow();
@@ -2622,8 +2622,7 @@
   ASSERT_TRUE(ExecJs(popup2_contents, script));
 
   // Wait until the Picture-in-Picture window is visible and its source title
-  // correctly falls back through the nested openers to the original origin
-  // (example.com).
+  // reflects the inherited precursor origin of the nested popups (example.com).
   SetUpWindowController(popup2_contents);
   ASSERT_TRUE(base::test::RunUntil([&]() {
     auto* overlay_window = GetOverlayWindow();
@@ -2635,7 +2634,7 @@
 }
 
 IN_PROC_BROWSER_TEST_F(VideoPictureInPictureWindowControllerBrowserTest,
-                       SourceTitle_ClosestAncestorFallback) {
+                       SourceTitle_InheritedFromNavigatedOpener) {
   const std::string kHost1 = "example.com";
   const std::string kHost2 = "another-site.com";
   const std::u16string kExpectedTitlePrefix = base::ASCIIToUTF16(kHost2);
@@ -2691,7 +2690,8 @@
       {video_url.spec()}, nullptr);
   ASSERT_TRUE(ExecJs(popup2_contents, script));
 
-  // Verify source title is Host 2 (the closest opener with a valid precursor).
+  // Verify the source title reflects the opener's origin at the time of the
+  // popup's creation (another-site.com).
   SetUpWindowController(popup2_contents);
   ASSERT_TRUE(base::test::RunUntil([&]() {
     auto* overlay_window = GetOverlayWindow();
@@ -2702,6 +2702,76 @@
   }));
 }
 
+IN_PROC_BROWSER_TEST_F(VideoPictureInPictureWindowControllerBrowserTest,
+                       SourceTitle_AboutBlankPopupUsesInheritedOrigin) {
+  const std::string kHost1 = "example.com";
+  const std::string kHost2 = "another-site.com";
+  const std::u16string kExpectedTitlePrefix = base::ASCIIToUTF16(kHost1);
+
+  // Open a non-sandboxed page on Host 1.
+  GURL url1 = embedded_test_server()->GetURL(kHost1, "/title1.html");
+  ASSERT_TRUE(ui_test_utils::NavigateToURL(browser(), url1));
+  content::WebContents* active_web_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+
+  // Open an about:blank popup. The popup's committed URL is about:blank, but
+  // its committed origin is inherited from Host 1.
+  content::WebContents* popup_contents;
+  {
+    content::WebContentsAddedObserver observer;
+    ASSERT_TRUE(ExecJs(active_web_contents, "window.open('about:blank');"));
+    popup_contents = observer.GetWebContents();
+  }
+  ASSERT_FALSE(
+      popup_contents->GetPrimaryMainFrame()->GetLastCommittedOrigin().opaque());
+  ASSERT_EQ(url::Origin::Create(url1),
+            popup_contents->GetPrimaryMainFrame()->GetLastCommittedOrigin());
+
+  // Navigate the opener cross-origin to Host 2. The popup keeps its inherited
+  // Host 1 origin and its opener relationship.
+  GURL url2 = embedded_test_server()->GetURL(kHost2, "/title1.html");
+  {
+    content::TestNavigationObserver nav_observer(active_web_contents);
+    ASSERT_TRUE(ExecJs(active_web_contents,
+                       base::StringPrintf("window.location.href = '%s';",
+                                          url2.spec().c_str())));
+    nav_observer.Wait();
+  }
+  ASSERT_EQ(active_web_contents->GetPrimaryMainFrame(),
+            popup_contents->GetOpener());
+
+  // Play video in the popup and request Picture-in-Picture.
+  GURL video_url = embedded_test_server()->GetURL(kHost1, "/media/bear.webm");
+  std::string script = base::ReplaceStringPlaceholders(
+      R"(
+        const video = document.createElement('video');
+        video.src = '$1';
+        video.loop = true;
+        document.body.appendChild(video);
+        video.play().then(() => video.requestPictureInPicture());
+      )",
+      {video_url.spec()}, nullptr);
+  ASSERT_TRUE(ExecJs(popup_contents, script));
+
+  // Wait until the Picture-in-Picture window is visible and its source title
+  // has been populated.
+  SetUpWindowController(popup_contents);
+  ASSERT_TRUE(base::test::RunUntil([&]() {
+    auto* overlay_window = GetOverlayWindow();
+    return overlay_window && overlay_window->IsVisible() &&
+           overlay_window->origin_for_testing() &&
+           !overlay_window->origin_for_testing()->GetText().empty();
+  }));
+
+  // The source title must reflect the popup's own (inherited) origin, not the
+  // opener's current origin.
+  EXPECT_TRUE(
+      base::StartsWith(GetOverlayWindow()->origin_for_testing()->GetText(),
+                       kExpectedTitlePrefix))
+      << "source title is '"
+      << GetOverlayWindow()->origin_for_testing()->GetText() << "'";
+}
+
 struct InteractionTestParam {
   ui::EventType event_type;
   bool title_should_be_visible;