trop[bot] be53e0a470 fix: propagate requesting frame through sync permission checks (#50686) ...

WebContentsPermissionHelper::CheckPermission was hardcoding
GetPrimaryMainFrame() and deriving the requesting origin from
web_contents_->GetLastCommittedURL(), so the setPermissionCheckHandler
callback always received the top frame's origin and
details.isMainFrame/details.requestingUrl always reflected the main
frame, even when a cross-origin subframe with allow="serial" or
allow="camera; microphone" triggered the check.

Thread the requesting RenderFrameHost through CheckPermission,
CheckSerialAccessPermission, and CheckMediaAccessPermission so the
permission manager receives the real requesting frame. Update the
serial delegate and WebContents::CheckMediaAccessPermission callers to
pass the frame they already have.

Adds a regression test that loads a cross-origin iframe with
allow="camera; microphone", calls enumerateDevices() from within the
iframe, and asserts the permission check handler receives the iframe
origin for requestingOrigin, isMainFrame, and requestingUrl.

Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com>
Co-authored-by: Sam Attard <sattard@anthropic.com>

2026-04-05 00:43:42 +00:00

..

app

fix: correct linux zygote process titles (#50533)

2026-03-27 12:24:01 -04:00

browser

fix: propagate requesting frame through sync permission checks (#50686)

2026-04-05 00:43:42 +00:00

common

refactor: remove never-used JS API (#50673)

2026-04-03 15:47:46 -05:00

renderer

feat: make Chrome extensions work on custom protocols (#50530)

2026-04-02 20:09:59 -07:00

services/node

fix: recover network requests after Network Service restart (#49887)

2026-02-25 12:53:06 -05:00

utility

fix: broken OOP window.print() on macOS/Linux (#45214)

2025-01-20 10:23:44 +01:00