diff --git a/chrome/browser/media/webrtc/display_media_access_handler.cc b/chrome/browser/media/webrtc/display_media_access_handler.cc index e01688c08958c..4dff3d175a80d 100644 --- a/chrome/browser/media/webrtc/display_media_access_handler.cc +++ b/chrome/browser/media/webrtc/display_media_access_handler.cc @@ -456,6 +456,23 @@ void DisplayMediaAccessHandler::ProcessQueuedAccessRequest( const PendingAccessRequest& pending_request = *queue.front(); UpdateTrusted(pending_request.request, false /* is_trusted */); + // Re-check that the requesting frame is still active. The request was + // validated at enqueue time in HandleRequest(), but the primary main frame + // may have navigated cross-origin while this request was queued behind + // another picker. Showing the picker now would attribute it (via + // GetApplicationTitle(web_contents)) to the post-navigation origin. + { + RenderFrameHost* const rfh = + RenderFrameHost::FromID(pending_request.request.render_process_id, + pending_request.request.render_frame_id); + if (!rfh || !rfh->IsActive()) { + RejectRequest( + web_contents, + MediaStreamRequestResult::FAILED_DUE_TO_SHUTDOWN_NO_RFH_IN_HANDLER); + return; + } + } + const GURL& request_origin = pending_request.request.security_origin; AllowedScreenCaptureLevel capture_level = capture_policy::GetAllowedCaptureLevel(request_origin, web_contents);