Prevent non-extension origins from navigating to chrome-extension://

fix #14772
brave · Jul 18, 2018 · c5ab0ea · c5ab0ea
1 parent d603250
commit c5ab0ea
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/app/browser/tabs.js b/app/browser/tabs.js
@@ -615,6 +615,13 @@ const api = {
       }
 
       tab.on('did-start-navigation', (e, navigationHandle) => {
+        if (navigationHandle.isRendererInitiated() &&
+          navigationHandle.getURL().startsWith('chrome-extension://') &&
+          !tab.getURL().startsWith('chrome-extension://')) {
+          // XXX: tab.stop and tab.loadURL cause a crash here
+          appActions.loadURLRequested(tabId, 'about:blank')
+          return
+        }
         if (!tab.isDestroyed() && navigationHandle.isValid() && navigationHandle.isInMainFrame()) {
           const controller = tab.controller()
           if (!controller.isValid()) {