From c1b361f469d29daac4b4062daeb3ee01ba3aa81c Mon Sep 17 00:00:00 2001
From: Stepan Khapugin <[email protected]>
Date: Tue, 28 Jul 2026 04:30:19 -0700
Subject: [PATCH] [iOS][omnibox] Limit favicon downloads to HTTP(s) and <5Mb.

Fixed: 513726466
Change-Id: Idcca8a9717368bbc1b52ce13b8f0ef76776d8856
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8073746
Commit-Queue: Stepan Khapugin <[email protected]>
Reviewed-by: Radu Nitescu <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1669358}
---

diff --git a/ios/chrome/browser/omnibox/coordinator/popup/omnibox_popup_coordinator.mm b/ios/chrome/browser/omnibox/coordinator/popup/omnibox_popup_coordinator.mm
index aa31021e..7493f817 100644
--- a/ios/chrome/browser/omnibox/coordinator/popup/omnibox_popup_coordinator.mm
+++ b/ios/chrome/browser/omnibox/coordinator/popup/omnibox_popup_coordinator.mm
@@ -50,6 +50,12 @@
 #import "services/network/public/cpp/shared_url_loader_factory.h"
 #import "ui/base/device_form_factor.h"
 
+namespace {
+
+const int64_t kMaxFaviconDownloadBytes = 1024 * 1024 * 5;
+
+}  // namespace
+
 @interface OmniboxPopupCoordinator () <OmniboxPopupMediatorProtocolProvider,
                                        OmniboxPopupMediatorSharingDelegate>
 
@@ -100,6 +106,7 @@
   std::unique_ptr<image_fetcher::ImageDataFetcher> imageFetcher =
       std::make_unique<image_fetcher::ImageDataFetcher>(
           self.profile->GetSharedURLLoaderFactory());
+  imageFetcher->SetImageDownloadLimit(kMaxFaviconDownloadBytes);
 
   _omniboxImageFetcher = [[OmniboxImageFetcher alloc]
       initWithFaviconLoader:IOSChromeFaviconLoaderFactory::GetForProfile(
diff --git a/ios/chrome/browser/omnibox/model/omnibox_image_fetcher.mm b/ios/chrome/browser/omnibox/model/omnibox_image_fetcher.mm
index 133d961d..099a642 100644
--- a/ios/chrome/browser/omnibox/model/omnibox_image_fetcher.mm
+++ b/ios/chrome/browser/omnibox/model/omnibox_image_fetcher.mm
@@ -45,6 +45,11 @@
 }
 
 - (void)fetchImage:(GURL)imageURL completion:(void (^)(UIImage*))completion {
+  // As a precaution, don't fetch images from nonstandard schemes.
+  if (!imageURL.SchemeIsHTTPOrHTTPS()) {
+    completion(nil);
+  }
+
   NSString* URL = [NSString cr_fromString:imageURL.spec()];
   UIImage* cachedImage = [_cachedImages objectForKey:URL];
   if (cachedImage) {