Members show the same shape across many surfaces: HTTPS-upgrade enforced only at response time and skipped on intermediate redirect hops (CVE-2026-87482, CVE-2026-87534); a check sitting after an early-return branch that some callers take (CVE-2026-87561, CVE-2026-87569); an extension-gated window type defaulting to allowed on builds that compile out the permission logic (CVE-2026-87483); a second service-worker code path that never routes through the webRequest proxy the primary path used (CVE-2026-87556); and a missing gate entirely such as getAsFileSystemHandle reaching handle resolution without CanShowFilePicker (CVE-2026-87513) or renderer-invocable Mojo commands lacking a user-gesture check (CVE-2026-87498). In each, the resource is reachable by a path that never runs the check the intended path runs.

Hoist the authorization check to a common choke point (function entry, a shared redirect override, or the single URL-resolution helper) so every caller and every hop is gated, and close default-allow gaps in compiled-out or alternate branches.