fix(chromium): refuse WebUI navigations that crash the browser - #41986
Open
krishpranav wants to merge 3 commits into
Open
fix(chromium): refuse WebUI navigations that crash the browser#41986krishpranav wants to merge 3 commits into
krishpranav wants to merge 3 commits into
Conversation
Author
|
@microsoft-github-policy-service agree |
| // "chrome:" is not a special scheme, so the URL parser leaves the host case alone | ||
| // while Chromium resolves it case-insensitively. | ||
| const { protocol, hostname } = new URL(url); | ||
| if (protocol === 'chrome:' && kWebUIHostsUnavailableOffTheRecord.has(hostname.toLowerCase())) |
Member
There was a problem hiding this comment.
what about edge://? others?
|
|
||
| export type WindowBounds = { top?: number, left?: number, width?: number, height?: number }; | ||
|
|
||
| // Chromium does not allow these WebUI hosts in off-the-record profiles, and instead redirects them |
Member
There was a problem hiding this comment.
We discourage heavy useless comments, make it brief.
Author
|
@pavelfeldman tested edge 150 it only crashes on history, everything else works in private, so the list is now per-browser instead of shared. chrome 150 matches chromium 151. kindly re-review |
pavelfeldman
approved these changes
Jul 28, 2026
Member
|
@copilot resolve the merge conflicts in this pull request |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Author
|
@pavelfeldman docs & lint failed on stale generated files from the webkit, roll landed after this run. A re-run should be green. |
Member
|
This PR needs rebase ^^ |
Chromium does not allow a handful of WebUI hosts in off-the-record profiles and redirects them to a normal window in the original profile. That redirect segfaults the browser process when the profile was created over CDP, which is the case for every non-persistent context. Refuse the navigation instead. Fixes: microsoft#41935
Author
|
@pavelfeldman rebased onto main |
pavelfeldman
approved these changes
Jul 30, 2026
Contributor
Test results for "MCP"7808 passed, 1266 skipped Merge workflow run. |
Contributor
Test results for "tests 1"6 flaky50823 passed, 1206 skipped Merge workflow run. |
Member
|
Forgot to discuss this yesterday: Let's not merge it before discussing first, Dima and me have doubts around whether this should be fixed in Chromium instead. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
page.goto('chrome://extensions')segfaults the Chromium browser process. The trigger is navigating inside a CDP-created off-the-record browser context — every non-persistent context — to one of the WebUIs Chromium disallows in incognito (IsURLAllowedInIncognito). Those redirect to a normal window in the original profile, and that path null-derefs.connectOverCDP, and inlaunchPersistentContext.apps,extensions,help,history,password-manager,settings) in non-persistent contexts with an error pointing atlaunchPersistentContext(). Hosts that do work (version,gpu,bookmarks,downloads,flags,policy, …) are untouched, as ischrome://crash.page.gotopath only — a click orwindow.locationstill reaches Chromium directly. Measurements and the raw-CDP repro are in [Bug]:page.goto(chrome://extensions)crashes browser #41935 (comment).Fixes #41935