CVE-2026-87490

Low watch ~ plausible CVSS 6.5 chrome Info Disclosure 🔧 Commit mapped

Overview

Low

Severity

6.5

CVSS

Exploited ITW

Fixed

Fix Status

ImpactInformation leak in Transactions Platform

DescriptionInformation leak in Transactions Platform

ComponentTransactions Platform

Bug ClassInfo Disclosure

Action tierwatch — information disclosure — security-relevant, below the RCE-class bar — upheld by independent review by AI
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.

Independent review by AIPlausible
The mapped commit may not contain the whole fix.
Reviewer notes: Shown diff only relaxes IBAN regex/length and adds NO; no leak sink appears. autocomplete_history_manager.cc is cited but absent from shown diff. 'Attacker or subsequent web origin can obtain' IBAN is asserted without support.
A second, independent AI reviewer (not a human) re-derived this analysis from the fixing commit and the vendor advisory, looking for errors.

Tracker533112829

Fix commit43e38fad912e (chromium/src) +84/-215

CWECWE-200 (Information exposure)

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CISA KEVNot listed

CreditedGoogle

Reported2026-07-09 (per vendor advisory)

Fix landed2026-08-10 (public git)

Disclosed2026-09-08

Patch gap29 days — fix public in source before the advisory

Background

IBAN: International Bank Account Number, an ISO 13616 alphanumeric bank-account identifier whose structure and total length are country-specific (e.g. NO is 15 characters, KZ, RO, and LC embed letters in positions where some validators expect only digits).
`Iban::IsValid`: Autofill’s canonical IBAN check that strips separators, uppercases the value, enforces a length window, and matches it against a compile-time regex before running the mod-97 checksum.
`MatchesRegex<Pattern>`: a helper template that tests a string against the regex passed as its template argument (kCapitalizedIbanPattern before, kCapitalizedIbanGeneralPattern after).
`AutocompleteHistoryManager`: the Autofill component that persists submitted single-field form values to offer them later as suggestions; the patch newly #includes iban.h here, wiring IBAN recognition into that path (inferred: to gate persistence of IBAN-shaped values).

Root Cause Analysis

Verify before building a PoC

This analysis is consistent with the fixing commit but not fully provable from it: part of the vulnerable path lives in code the fix commit does not touch. Confirm the trigger and the sink against the source before relying on it for exploit development.
What the commit does not establish: Shown diff only relaxes IBAN regex/length and adds NO; no leak sink appears. autocomplete_history_manager.cc is cited but absent from shown diff. 'Attacker or subsequent web origin can obtain' IBAN is asserted without support.

The vulnerable path was IBAN recognition in Iban::IsValid (and its now-removed duplicate IsInternationalBankAccountNumber). The old constant kCapitalizedIbanPattern was u"^[A-Z]{2}[0-9]{2}[A-Z0-9]{4}[0-9]{7}[A-Z0-9]{0,18}$", which hard-codes a run of exactly seven digits ([0-9]{7}) at a fixed offset, and the length floor was iban_value.length() < 16; the removed comment (“IBANs must be at least 16 digits”) records that wrong assumption. Real IBANs that place letters in that region (KZ, RO, LC) or that are only 15 characters long (NO) therefore failed validation, so the invariant “every structurally valid IBAN is recognized as an IBAN” was violated — the check was too strict, producing false negatives. Because such values were classified as non-IBAN, they missed IBAN-specific handling; the advisory characterizes the resulting behavior as an information leak (inferred mechanism: unrecognized IBANs being persisted/suggested through the autocomplete-history path this patch also touches).

The fix relaxes the regex to the general kCapitalizedIbanGeneralPattern (u"^[A-Z]{2}[0-9]{2}[A-Z0-9]{11,30}$"), lowers the floor to < 15, unifies all callers on Iban::IsValid, and registers Norway (kNO, length 15). Note this diff broadens recognition and adds/moves checks; it does not add a bounds guard around a memory sink.

Key insight

The single mistake was an over-restrictive IBAN regex ([0-9]{7} at a fixed offset plus a 16-character floor) that rejected valid IBANs from several countries, so those sensitive account numbers were misclassified as ordinary values; the fix corrects the pattern to the ISO 13616-aligned kCapitalizedIbanGeneralPattern and lowers the length floor so all valid IBANs are recognized.

Attack Path

Victim enters a mis-covered IBAN A user types a structurally valid IBAN whose format the old regex rejects — e.g. KZ58125KZT1234567890, RO49AAAA1B31007593840000, LC09HEMM000000000000000123456789, or the 15-character NO9386011117947 — into a form field.
Recognition returns false Iban::IsValid (or the old IsInternationalBankAccountNumber) fails the value because [A-Z0-9]{4}[0-9]{7} cannot match letters in that region, or because length() < 16 rejects the 15-char Norwegian IBAN, so the value is classified as a non-IBAN.
Value escapes IBAN-specific handling Callers that branch on IBAN recognition (the ValuePatternsMetric::kIban classifier in browser_autofill_manager.cc, and the autocomplete-history path that newly includes iban.h) treat the account number as an ordinary field value rather than sensitive payment data.
Account number is disclosed (inferred) The unrecognized IBAN is persisted and later surfaced as an autocomplete suggestion or otherwise leaked as an information disclosure; the diff shows only the #include wiring and metric call site, not the persistence/suggestion sink, so this escalation is (inferred).

Impact Assessment

An attacker or a subsequent web origin can obtain a bank account number (IBAN) that Autofill mishandled because it was not recognized as an IBAN; per the advisory this is an information leak in the Transactions Platform (bug class InfoDisclosure), occurring in the browser-process Autofill component. The concrete disclosure vector beyond misclassification — persistence to and re-surfacing from autocomplete history — is (inferred), as the diff truncates the body of autocomplete_history_manager.cc. The advisory does not state exploited-in-the-wild status, and no memory-corruption, sandbox-escape, or code-execution capability is demonstrated by this patch.

Changed Functions

Function	Change	Notes
`if` components/autofill/core/browser/data_model/payments/iban.cc	modified

Files Changed

components/autofill/core/browser/data_quality/validation_unittest.cc
components/autofill/core/browser/data_model/payments/iban.cc
components/autofill/core/browser/data_quality/validation.cc
components/autofill/core/browser/data_model/payments/iban.h
components/autofill/core/browser/data_model/payments/iban_unittest.cc
components/autofill/core/browser/data_quality/validation.h
components/autofill/core/common/autofill_regex_constants.h
components/autofill/core/browser/single_field_fillers/autocomplete/autocomplete_history_manager.cc
components/autofill/core/browser/foundations/browser_autofill_manager.cc

Audit Directions

Fixed-offset structural regexes
Audit other format validators (credit cards, routing numbers, VPAs in validation.cc) for patterns that hard-code digit runs at fixed positions or overly narrow length floors, which produce false negatives that cause sensitive values to be misclassified and mishandled.
Duplicate validation helpers
Search for parallel implementations of the same check (as IsInternationalBankAccountNumber duplicated Iban::IsValid) that can drift apart, so one caller enforces a rule another does not.
Recognition-gated persistence
Trace every consumer of value-classification results (especially AutocompleteHistoryManager and other single-field fillers that persist submitted values) to confirm a misclassification cannot cause sensitive financial data to be stored or re-surfaced as a suggestion.

Patch

view commit

From 43e38fad912ec6436cacda32d6b90b0ffd14e5bb Mon Sep 17 00:00:00 2001
From: Gianmarco Picarella <[email protected]>
Date: Mon, 10 Aug 2026 03:42:02 -0700
Subject: [PATCH] Fix IBAN validation regex and unify validation logic

Fixes IBAN validation by aligning the regex with the ISO 13616 standard
and replaces duplicate validation helpers with `Iban::IsValid()`.

Changes:
- Update IBAN regex, removing the broken `[0-9]{7}` restriction that
failed for KZ, RO, and LC.
- Remove `IsInternationalBankAccountNumber()` and its regex constant in
favor of `Iban::IsValid()`.
- Update `Iban::IsValid()` to accept `std::u16string_view`.
- Add support for Norway (NO, length 15).
- Add unit tests covering KZ, RO, LC, NO, and other countries.

Fixed: 533112829
Change-Id: Id08f724ea925a6dc634fbefacbf50d90512c729a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8226265
Reviewed-by: Jihad Hanna <[email protected]>
Commit-Queue: Gianmarco Picarella <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1676334}
---
diff --git a/components/autofill/core/browser/data_model/payments/iban.cc b/components/autofill/core/browser/data_model/payments/iban.cc
index 9ed93726..8b0cdb19 100644
--- a/components/autofill/core/browser/data_model/payments/iban.cc
+++ b/components/autofill/core/browser/data_model/payments/iban.cc
@@ -15,6 +15,8 @@
 
 #include "base/check.h"
 #include "base/check_op.h"
+#include "base/containers/fixed_flat_map.h"
+#include "base/containers/map_util.h"
 #include "base/i18n/case_conversion.h"
 #include "base/notreached.h"
 #include "base/strings/string_number_conversions.h"
@@ -94,8 +96,9 @@
 
 }  // namespace
 
-constexpr char16_t kCapitalizedIbanPattern[] =
-    u"^[A-Z]{2}[0-9]{2}[A-Z0-9]{4}[0-9]{7}[A-Z0-9]{0,18}$";
+constexpr char16_t kCapitalizedIbanGeneralPattern[] =
+    u"^[A-Z]{2}[0-9]{2}[A-Z0-9]{11,30}$";
+
 // \u2006 - SIX-PER-EM SPACE (small space).
 constexpr char16_t kEllipsisOneSpace = u'\u2006';
 
@@ -125,17 +128,17 @@
 }
 
 // static
-bool Iban::IsValid(const std::u16string& value) {
+bool Iban::IsValid(std::u16string_view value) {
   std::u16string iban_value = RemoveIbanSeparators(value);
   iban_value = base::i18n::ToUpper(iban_value);
-  // IBANs must be at least 16 digits and at most 33 digits long.
-  if (iban_value.length() < 16 || iban_value.length() > 33) {
+  // IBANs must be at least 15 digits and at most 33 digits long.
+  if (iban_value.length() < 15 || iban_value.length() > 33) {
     return false;
   }
 
   // IBAN must match the regex pattern. Note that we made the IBAN uppercased,
   // so we only need to check against an uppercased pattern.
-  if (!MatchesRegex<kCapitalizedIbanPattern>(iban_value)) {
+  if (!MatchesRegex<kCapitalizedIbanGeneralPattern>(iban_value)) {
     return false;
   }
 
@@ -166,167 +169,57 @@
 // static
 Iban::IbanSupportedCountry Iban::GetIbanSupportedCountry(
     std::string_view country_code) {
-  if (country_code == "AD") {
-    return IbanSupportedCountry::kAD;
-  } else if (country_code == "AE") {
-    return IbanSupportedCountry::kAE;
-  } else if (country_code == "AL") {
-    return IbanSupportedCountry::kAL;
-  } else if (country_code == "AT") {
-    return IbanSupportedCountry::kAT;
-  } else if (country_code == "AZ") {
-    return IbanSupportedCountry::kAZ;
-  } else if (country_code == "BA") {
-    return IbanSupportedCountry::kBA;
-  } else if (country_code == "BE") {
-    return IbanSupportedCountry::kBE;
-  } else if (country_code == "BG") {
-    return IbanSupportedCountry::kBG;
-  } else if (country_code == "BH") {
-    return IbanSupportedCountry::kBH;
-  } else if (country_code == "BR") {
-    return IbanSupportedCountry::kBR;
-  } else if (country_code == "BY") {
-    return IbanSupportedCountry::kBY;
-  } else if (country_code == "CH") {
-    return IbanSupportedCountry::kCH;
-  } else if (country_code == "CR") {
-    return IbanSupportedCountry::kCR;
-  } else if (country_code == "CY") {
-    return IbanSupportedCountry::kCY;
-  } else if (country_code == "CZ") {
-    return IbanSupportedCountry::kCZ;
-  } else if (country_code == "DE") {
-    return IbanSupportedCountry::kDE;
-  } else if (country_code == "DK") {
-    return IbanSupportedCountry::kDK;
-  } else if (country_code == "DO") {
-    return IbanSupportedCountry::kDO;
-  } else if (country_code == "EE") {
-    return IbanSupportedCountry::kEE;
-  } else if (country_code == "EG") {
-    return IbanSupportedCountry::kEG;
-  } else if (country_code == "ES") {
-    return IbanSupportedCountry::kES;
-  } else if (country_code == "FI") {
-    return IbanSupportedCountry::kFI;
-  } else if (country_code == "FO") {
-    return IbanSupportedCountry::kFO;
-  } else if (country_code == "FR") {
-    return IbanSupportedCountry::kFR;
-  } else if (country_code == "GB") {
-    return IbanSupportedCountry::kGB;
-  } else if (country_code == "GE") {
-    return IbanSupportedCountry::kGE;
-  } else if (country_code == "GI") {
-    return IbanSupportedCountry::kGI;
-  } else if (country_code == "GL") {
-    return IbanSupportedCountry::kGL;
-  } else if (country_code == "GR") {
-    return IbanSupportedCountry::kGR;
-  } else if (country_code == "GT") {
-    return IbanSupportedCountry::kGT;
-  } else if (country_code == "HR") {
-    return IbanSupportedCountry::kHR;
-  } else if (country_code == "HU") {
-    return IbanSupportedCountry::kHU;
-  } else if (country_code == "IE") {
-    return IbanSupportedCountry::kIE;
-  } else if (country_code == "IL") {
-    return IbanSupportedCountry::kIL;
-  } else if (country_code == "IQ") {
-    return IbanSupportedCountry::kIQ;
-  } else if (country_code == "IS") {
-    return IbanSupportedCountry::kIS;
-  } else if (country_code == "IT") {
-    return IbanSupportedCountry::kIT;
-  } else if (country_code == "JO") {
-    return IbanSupportedCountry::kJO;
-  } else if (country_code == "KW") {
-    return IbanSupportedCountry::kKW;
-  } else if (country_code == "KZ") {
-    return IbanSupportedCountry::kKZ;
-  } else if (country_code == "LB") {
-    return IbanSupportedCountry::kLB;
-  } else if (country_code == "LC") {
-    return IbanSupportedCountry::kLC;
-  } else if (country_code == "LI") {
-    return IbanSupportedCountry::kLI;
-  } else if (country_code == "LT") {
-    return IbanSupportedCountry::kLT;
-  } else if (country_code == "LU") {
-    return IbanSupportedCountry::kLU;
-  } else if (country_code == "LV") {
-    return IbanSupportedCountry::kLV;
-  } else if (country_code == "LY") {
-    return IbanSupportedCountry::kLY;
-  } else if (country_code == "MC") {
-    return IbanSupportedCountry::kMC;
-  } else if (country_code == "MD") {
-    return IbanSupportedCountry::kMD;
-  } else if (country_code == "ME") {
-    return IbanSupportedCountry::kME;
-  } else if (country_code == "MK") {
-    return IbanSupportedCountry::kMK;
-  } else if (country_code == "MR") {
-    return IbanSupportedCountry::kMR;
-  } else if (country_code == "MT") {
-    return IbanSupportedCountry::kMT;
-  } else if (country_code == "MU") {
-    return IbanSupportedCountry::kMU;
-  } else if (country_code == "NL") {
-    return IbanSupportedCountry::kNL;
-  } else if (country_code == "PK") {
-    return IbanSupportedCountry::kPK;
-  } else if (country_code == "PL") {
-    return IbanSupportedCountry::kPL;
-  } else if (country_code == "PS") {
-    return IbanSupportedCountry::kPS;
-  } else if (country_code == "PT") {
-    return IbanSupportedCountry::kPT;
-  } else if (country_code == "QA") {
-    return IbanSupportedCountry::kQA;
-  } else if (country_code == "RO") {
-    return IbanSupportedCountry::kRO;
-  } else if (country_code == "RS") {
-    return IbanSupportedCountry::kRS;
-  } else if (country_code == "RU") {
-    return IbanSupportedCountry::kRU;
-  } else if (country_code == "SA") {
-    return IbanSupportedCountry::kSA;
-  } else if (country_code == "SC") {
-    return IbanSupportedCountry::kSC;
-  } else if (country_code == "SD") {
-    return IbanSupportedCountry::kSD;
-  } else if (country_code == "SE") {
-    return IbanSupportedCountry::kSE;
-  } else if (country_code == "SI") {
-    return IbanSupportedCountry::kSI;
-  } else if (country_code == "SK") {
-    return IbanSupportedCountry::kSK;
-  } else if (country_code == "SM") {
-    return IbanSupportedCountry::kSM;
-  } else if (country_code == "ST") {
-    return IbanSupportedCountry::kST;
-  } else if (country_code == "SV") {
-    return IbanSupportedCountry::kSV;
-  } else if (country_code == "TL") {
-    return IbanSupportedCountry::kTL;
-  } else if (country_code == "TN") {
-    return IbanSupportedCountry::kTN;
-  } else if (country_code == "TR") {
-    return IbanSupportedCountry::kTR;
-  } else if (country_code == "UA") {
-    return IbanSupportedCountry::kUA;
-  } else if (country_code == "VA") {
-    return IbanSupportedCountry::kVA;
-  } else if (country_code == "VG") {
-    return IbanSupportedCountry::kVG;
-  } else if (country_code == "XK") {
-    return IbanSupportedCountry::kXK;
-  } else {
-    return IbanSupportedCountry::kUnsupported;
-  }
+  static constexpr auto kSupportedCountryMap =
+      base::MakeFixedFlatMap<std::string_view, IbanSupportedCountry>({
+          {"AD", IbanSupportedCountry::kAD}, {"AE", IbanSupportedCountry::kAE},
+          {"AL", IbanSupportedCountry::kAL}, {"AT", IbanSupportedCountry::kAT},
+          {"AZ", IbanSupportedCountry::kAZ}, {"BA", IbanSupportedCountry::kBA},
+          {"BE", IbanSupportedCountry::kBE}, {"BG", IbanSupportedCountry::kBG},
+          {"BH", IbanSupportedCountry::kBH}, {"BR", IbanSupportedCountry::kBR},
+          {"BY", IbanSupportedCountry::kBY}, {"CH", IbanSupportedCountry::kCH},
+          {"CR", IbanSupportedCountry::kCR}, {"CY", IbanSupportedCountry::kCY},
+          {"CZ", IbanSupportedCountry::kCZ}, {"DE", IbanSupportedCountry::kDE},
+          {"DK", IbanSupportedCountry::kDK}, {"DO", IbanSupportedCountry::kDO},
+          {"EE", IbanSupportedCountry::kEE}, {"EG", IbanSupportedCountry::kEG},
+          {"ES", IbanSupportedCountry::kES}, {"FI", IbanSupportedCountry::kFI},
+          {"FO", IbanSupportedCountry::kFO}, {"FR", IbanSupportedCountry::kFR},
+          {"GB", IbanSupportedCountry::kGB}, {"GE", IbanSupportedCountry::kGE},
+          {"GI", IbanSupportedCountry::kGI}, {"GL", IbanSupportedCountry::kGL},
+          {"GR", IbanSupportedCountry::kGR}, {"GT", IbanSupportedCountry::kGT},
+          {"HR", IbanSupportedCountry::kHR}, {"HU", IbanSupportedCountry::kHU},
+          {"IE", IbanSupportedCountry::kIE}, {"IL", IbanSupportedCountry::kIL},
+          {"IQ", IbanSupportedCountry::kIQ}, {"IS", IbanSupportedCountry::kIS},
+          {"IT", IbanSupportedCountry::kIT}, {"JO", IbanSupportedCountry::kJO},
+          {"KW", IbanSupportedCountry::kKW}, {"KZ", IbanSupportedCountry::kKZ},
+          {"LB", IbanSupportedCountry::kLB}, {"LC", IbanSupportedCountry::kLC},
+          {"LI", IbanSupportedCountry::kLI}, {"LT", IbanSupportedCountry::kLT},
+          {"LU", IbanSupportedCountry::kLU}, {"LV", IbanSupportedCountry::kLV},
+          {"LY", IbanSupportedCountry::kLY}, {"MC", IbanSupportedCountry::kMC},
+          {"MD", IbanSupportedCountry::kMD}, {"ME", IbanSupportedCountry::kME},
+          {"MK", IbanSupportedCountry::kMK}, {"MR", IbanSupportedCountry::kMR},
+          {"MT", IbanSupportedCountry::kMT}, {"MU", IbanSupportedCountry::kMU},
+          {"NL", IbanSupportedCountry::kNL}, {"NO", IbanSupportedCountry::kNO},
+          {"PK", IbanSupportedCountry::kPK}, {"PL", IbanSupportedCountry::kPL},
+          {"PS", IbanSupportedCountry::kPS}, {"PT", IbanSupportedCountry::kPT},
+          {"QA", IbanSupportedCountry::kQA}, {"RO", IbanSupportedCountry::kRO},
+          {"RS", IbanSupportedCountry::kRS}, {"RU", IbanSupportedCountry::kRU},
+          {"SA", IbanSupportedCountry::kSA}, {"SC", IbanSupportedCountry::kSC},
+          {"SD", IbanSupportedCountry::kSD}, {"SE", IbanSupportedCountry::kSE},
+          {"SI", IbanSupportedCountry::kSI}, {"SK", IbanSupportedCountry::kSK},
+          {"SM", IbanSupportedCountry::kSM}, {"ST", IbanSupportedCountry::kST},
+          {"SV", IbanSupportedCountry::kSV}, {"TL", IbanSupportedCountry::kTL},
+          {"TN", IbanSupportedCountry::kTN}, {"TR", IbanSupportedCountry::kTR},
+          {"UA", IbanSupportedCountry::kUA}, {"VA", IbanSupportedCountry::kVA},
+          {"VG", IbanSupportedCountry::kVG}, {"XK", IbanSupportedCountry::kXK},
+      });
+  // Ensure every country enum (excluding kUnsupported) is registered in the
+  // map.
+  static_assert(kSupportedCountryMap.size() ==
+                    static_cast<size_t>(IbanSupportedCountry::kMaxValue),
+                "Missing IbanSupportedCountry mapping in kSupportedCountryMap");
+  const IbanSupportedCountry* country =
+      base::FindOrNull(kSupportedCountryMap, country_code);
+  return country ? *country : IbanSupportedCountry::kUnsupported;
 }
 
 // static
@@ -444,6 +337,8 @@
       return 30;
     case IbanSupportedCountry::kNL:
       return 18;
+    case IbanSupportedCountry::kNO:
+      return 15;
     case IbanSupportedCountry::kPK:
       return 24;
     case IbanSupportedCountry::kPL:
diff --git a/components/autofill/core/browser/data_model/payments/iban.h b/components/autofill/core/browser/data_model/payments/iban.h
index b96927a..d651d15 100644
--- a/components/autofill/core/browser/data_model/payments/iban.h
+++ b/components/autofill/core/browser/data_model/payments/iban.h
@@ -49,7 +49,7 @@
 
   // These values are persisted to logs. Entries should not be renumbered and
   // numeric values should never be reused.
-  // Next ID: 80
+  // Next ID: 81
   enum class IbanSupportedCountry {
     kUnsupported = 0,
     kAD = 1,   // Andorra
@@ -107,6 +107,7 @@
     kMT = 52,  // Malta
     kMU = 53,  // Mauritius
     kNL = 54,  // Netherlands
+    kNO = 80,  // Norway
     kPK = 55,  // Pakistan
     kPL = 56,  // Poland
     kPS = 57,  // Palestinian territories
@@ -131,7 +132,7 @@
     kVA = 76,  // Vatican City
     kVG = 77,  // Virgin Islands, British
     kXK = 78,  // Kosovo
-    kMaxValue = kIE,
+    kMaxValue = kNO,
   };
 
   // Creates an IBAN with `kUnknown` record type.
@@ -161,7 +162,7 @@
   //
   // The validation algorithm is from:
   // https://en.wikipedia.org/wiki/International_Bank_Account_Number#Algorithms
-  static bool IsValid(const std::u16string& value);
+  static bool IsValid(std::u16string_view value);
 
   // Returns the capitalized country code of the given `iban_value`.
   static std::string GetCountryCode(const std::u16string& iban_value);
diff --git a/components/autofill/core/browser/data_quality/validation.cc b/components/autofill/core/browser/data_quality/validation.cc
index ac68f84..a153c85 100644
--- a/components/autofill/core/browser/data_quality/validation.cc
+++ b/components/autofill/core/browser/data_quality/validation.cc
@@ -207,12 +207,6 @@
   return MatchesRegex<kUPIVirtualPaymentAddressRe>(value);
 }
 
-bool IsInternationalBankAccountNumber(std::u16string_view value) {
-  std::u16string no_spaces;
-  base::RemoveChars(value, u" ", &no_spaces);
-  return MatchesRegex<kInternationalBankAccountNumberValueRe>(no_spaces);
-}
-
 bool IsAchRoutingTransitNumber(std::u16string_view value) {
   // For a 9-digit Routing Transit Number, multiply the first eight digits by
   // [3,7,1,3,7,1,3,7], and total the results. The remaining ninth digit is the
diff --git a/components/autofill/core/browser/data_quality/validation.h b/components/autofill/core/browser/data_quality/validation.h
index 1eac53acf..963ad3c 100644
--- a/components/autofill/core/browser/data_quality/validation.h
+++ b/components/autofill/core/browser/data_quality/validation.h
@@ -82,10 +82,6 @@
 // https://upipayments.co.in/virtual-payment-address-vpa/
 bool IsUPIVirtualPaymentAddress(std::u16string_view value);
 
-// Returns true if `value` appears to be an International Bank Account Number
-// (IBAN). See https://en.wikipedia.org/wiki/International_Bank_Account_Number
-bool IsInternationalBankAccountNumber(std::u16string_view value);
-
 // Returns true if `value` appears to be a valid ABA Routing Transit Number,
 // generally used in the United States for ACH bank transfers.
 bool IsAchRoutingTransitNumber(std::u16string_view value);
diff --git a/components/autofill/core/browser/foundations/browser_autofill_manager.cc b/components/autofill/core/browser/foundations/browser_autofill_manager.cc
index ac5b750..aff56d2a 100644
--- a/components/autofill/core/browser/foundations/browser_autofill_manager.cc
+++ b/components/autofill/core/browser/foundations/browser_autofill_manager.cc
@@ -63,6 +63,7 @@
 #include "components/autofill/core/browser/data_model/addresses/autofill_profile.h"
 #include "components/autofill/core/browser/data_model/addresses/phone_number.h"
 #include "components/autofill/core/browser/data_model/payments/credit_card.h"
+#include "components/autofill/core/browser/data_model/payments/iban.h"
 #include "components/autofill/core/browser/data_quality/addresses/profile_token_quality.h"
 #include "components/autofill/core/browser/data_quality/autofill_data_util.h"
 #include "components/autofill/core/browser/data_quality/validation.h"
@@ -181,7 +182,7 @@
   if (IsUPIVirtualPaymentAddress(value)) {
     return ValuePatternsMetric::kUpiVpa;
   }
-  if (IsInternationalBankAccountNumber(value)) {
+  if (Iban::IsValid(value)) {
     return ValuePatternsMetric::kIban;
   }
   if (IsAchRoutingTransitNumber(value)) {
diff --git a/components/autofill/core/browser/single_field_fillers/autocomplete/autocomplete_history_manager.cc b/components/autofill/core/browser/single_field_fillers/autocomplete/autocomplete_history_manager.cc
index e849bf2..85647eb0 100644
--- a/components/autofill/core/browser/single_field_fillers/autocomplete/autocomplete_history_manager.cc
+++ b/components/autofill/core/browser/single_field_fillers/autocomplete/autocomplete_history_manager.cc
@@ -23,6 +23,7 @@
 #include "base/time/time.h"
 #include "base/version_info/version_info.h"
 #include "components/autofill/core/browser/at_memory/at_memory_enablement_utils.h"
+#include "components/autofill/core/browser/data_model/payments/iban.h"
... (file diff truncated)

Loading diff…

Regression Test / PoC

shipped with the fix

diff --git a/components/autofill/core/browser/data_model/payments/iban_unittest.cc b/components/autofill/core/browser/data_model/payments/iban_unittest.cc
index 9715e1e3..c42944f 100644
--- a/components/autofill/core/browser/data_model/payments/iban_unittest.cc
+++ b/components/autofill/core/browser/data_model/payments/iban_unittest.cc
@@ -338,6 +338,19 @@
   // KW16 will be converted into 203216, and the remainder on 97 is 1.
   EXPECT_FALSE(Iban::IsValid(u"KW1600000000000000000"));
 
+  // Valid IBANs for several other countries.
+  EXPECT_TRUE(Iban::IsValid(u"KZ58125KZT1234567890"));
+  EXPECT_TRUE(Iban::IsValid(u"RO49AAAA1B31007593840000"));
+  EXPECT_TRUE(Iban::IsValid(u"LC09HEMM000000000000000123456789"));
+  EXPECT_TRUE(Iban::IsValid(u"MT84MALT011000012345MTLCAST001S"));
+  EXPECT_TRUE(Iban::IsValid(u"SC18SSCB11010000000000001497USD"));
+  EXPECT_TRUE(Iban::IsValid(u"MD24AG000225100013104168"));
+  EXPECT_TRUE(Iban::IsValid(u"BH67BMAG00001299123456"));
+  EXPECT_TRUE(Iban::IsValid(u"LI21088100002324013AA"));
+  EXPECT_TRUE(Iban::IsValid(u"FR1420041010050500013M02606"));
+  EXPECT_TRUE(Iban::IsValid(u"LB62099900000001001901229114"));
+  EXPECT_TRUE(Iban::IsValid(u"NO9386011117947"));
+
   // The IBAN value country code is invalid.
   EXPECT_FALSE(Iban::IsValid(u"XXA1CBKU0000000000001234560101"));
 }
diff --git a/components/autofill/core/browser/data_quality/validation_unittest.cc b/components/autofill/core/browser/data_quality/validation_unittest.cc
index 578decb3..73a6c62a2 100644
--- a/components/autofill/core/browser/data_quality/validation_unittest.cc
+++ b/components/autofill/core/browser/data_quality/validation_unittest.cc
@@ -257,30 +257,6 @@
   EXPECT_TRUE(IsUPIVirtualPaymentAddress(u"[email protected]"));
 }
 
-class AutofillIsInternationalBankAccountNumber
-    : public testing::TestWithParam<std::u16string> {};
-
-INSTANTIATE_TEST_SUITE_P(InternationalBankAccountNumber,
-                         AutofillIsInternationalBankAccountNumber,
-                         testing::Values(u"MT84MALT011000012345MTLCAST001S",
-                                         u"SC18SSCB11010000000000001497USD",
-                                         u"MD24AG000225100013104168",
-                                         u"BH67BMAG00001299123456",
-                                         u"LI21088100002324013AA",
-                                         u"NO9386011117947",
-                                         u"FR1420041010050500013M02606",
-                                         u"LB62099900000001001901229114"));
-
-TEST_P(AutofillIsInternationalBankAccountNumber,
-       IsInternationalBankAccountNumber) {
-  EXPECT_TRUE(IsInternationalBankAccountNumber(GetParam())) << GetParam();
-  EXPECT_TRUE(IsInternationalBankAccountNumber(u" " + GetParam() + u" "));
-  EXPECT_FALSE(IsInternationalBankAccountNumber(u"DE" + GetParam()));
-  EXPECT_FALSE(IsInternationalBankAccountNumber(GetParam() + u"."));
-  EXPECT_FALSE(IsInternationalBankAccountNumber(
-      GetParam() + u"0000000000000000000000000000000000000"));
-}
-
 TEST(AutofillValidation, IsValidAchRoutingTransitNumber) {
   // Must be 9 digits, cannot have text:
   EXPECT_FALSE(IsAchRoutingTransitNumber(u"12345678"));

Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.

References

Vendor advisory Fix commit Bug tracker NVD

On This Page