Skip to content

fix: honor tabs permission for url and title in tabs.query results - #53354

Merged
MarshallOfSound merged 1 commit into
44-x-yfrom
trop/44-x-y-bp-fix-honor-tabs-permission-for-url-and-title-in-tabs-query-results-1788224369407
Sep 1, 2026
Merged

MarshallOfSound merged 1 commit into
44-x-yfrom
trop/44-x-y-bp-fix-honor-tabs-permission-for-url-and-title-in-tabs-query-results-1788224369407

Conversation

@trop

@trop trop Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

Backport of #52597

See that PR for details.

Notes: Fixed chrome.tabs.query() returning tab url and title to extensions without the tabs permission or host access, aligning with tabs.get.

tabs.get and tabs.update only expose the privileged url and title
properties when the extension has the tabs permission or host access,
matching Chrome and our own tabs schema docs, but tabs.query populated
them unconditionally. Share one CanAccessPrivilegedTabFields check across
query, get and update, and evaluate it against the last committed URL.

Co-authored-by: Samuel Attard <sattard@anthropic.com>
@trop
trop Bot requested a review from MarshallOfSound September 1, 2026 00:59
@trop trop Bot added 44-x-y backport This is a backport PR semver/patch backwards-compatible bug fixes labels Sep 1, 2026
@MarshallOfSound
MarshallOfSound enabled auto-merge (squash) September 1, 2026 01:02
@MarshallOfSound
MarshallOfSound merged commit f3ae30f into 44-x-y Sep 1, 2026
91 checks passed
@MarshallOfSound
MarshallOfSound deleted the trop/44-x-y-bp-fix-honor-tabs-permission-for-url-and-title-in-tabs-query-results-1788224369407 branch September 1, 2026 02:09
@release-clerk

release-clerk Bot commented Sep 1, 2026

Copy link
Copy Markdown

Release Notes Persisted

Fixed chrome.tabs.query() returning tab url and title to extensions without the tabs permission or host access, aligning with tabs.get.

renovate Bot added a commit to cigaleapp/cigale that referenced this pull request Sep 13, 2026
##### [v44.2.0](https://github.com/electron/electron/releases/tag/v44.2.0)

### Release Notes for v44.2.0

#### Fixes

- Fixed a pending read on a `net.request` chunked upload stream inside a protocol handler never settling when the request failed or was aborted. [#53373](electron/electron#53373) <sup>(Also in [43](electron/electron#53374), [45](https://github.com/electron/electron/pull/53368))</sup>
- Fixed a potential crash when using `menu.popup` with a frame from an offscreen rendered window. [#53362](electron/electron#53362) <sup>(Also in [43](https://github.com/electron/electron/pull/53432))</sup>
- Fixed an intermittent crash (access violation) on Windows when an ASAR integrity violation is detected, so the process now exits with code 1 as intended. [#53455](electron/electron#53455) <sup>(Also in [43](electron/electron#53456), [45](https://github.com/electron/electron/pull/53438))</sup>
- Fixed application crash after a large number of IPC messages from renderers. [#53417](electron/electron#53417) <sup>(Also in [42](electron/electron#53419), [43](electron/electron#53420), [45](https://github.com/electron/electron/pull/53418))</sup>
- Fixed native addons deriving from `node::ObjectWrap` aborting during garbage collection on Node.js 24.19.0 and later. [#53392](electron/electron#53392) <sup>(Also in [42](electron/electron#53394), [43](electron/electron#53393), [45](https://github.com/electron/electron/pull/53391))</sup>

#### Other Changes

- Backported fixes from upstream ANGLE, Chromium, Skia and V8. [#53479](electron/electron#53479)
- Improved throughput of responses that `protocol.handle` handlers return straight from `net.fetch`. [#53378](electron/electron#53378)
- Updated Chromium to 152.0.7977.76. [#53382](electron/electron#53382)
- Updated Node.js to v24.20.0. [#53250](electron/electron#53250)
##### [v44.1.1](https://github.com/electron/electron/releases/tag/v44.1.1)

### Release Notes for v44.1.1

#### Fixes

- Fixed `chrome.tabs.query()` returning tab `url` and `title` to extensions without the `tabs` permission or host access, aligning with `tabs.get`. [#53354](electron/electron#53354) <sup>(Also in [42](electron/electron#53355), [43](electron/electron#53356), [45](https://github.com/electron/electron/pull/53353))</sup>
- Fixed a renderer crash when an array with a throwing property getter is passed across `contextBridge`, and several main/utility-process crashes when option objects passed to Electron APIs contain throwing accessors or Proxy traps. [#53331](electron/electron#53331) <sup>(Also in [42](electron/electron#53329), [43](https://github.com/electron/electron/pull/53330))</sup>
- Fixed an intermittent crash at startup on Linux caused by a race between Pango and the main thread initializing fontconfig. [#53340](electron/electron#53340) <sup>(Also in [43](electron/electron#53339), [45](https://github.com/electron/electron/pull/53338))</sup>
- Fixed an issue where an exception thrown by a property getter on an object passed through `contextBridge` was swallowed instead of being thrown back to the caller. [#53335](electron/electron#53335) <sup>(Also in [43](electron/electron#53334), [45](https://github.com/electron/electron/pull/53297))</sup>
- Fixed main process crashes when navigating to `http://accessibility/` or `http://devtools/`, when an extension background page used `navigator.mediaDevices`, and when calling `SerialPort.forget()` for a disconnected device. [#53333](electron/electron#53333) <sup>(Also in [43](electron/electron#53332), [45](https://github.com/electron/electron/pull/53325))</sup>
- Fixed the PDF viewer failing to save an edited PDF with `NotAllowedError: Third party iframes are not allowed to show a file picker`. [#53328](electron/electron#53328) <sup>(Also in [43](electron/electron#53327), [45](https://github.com/electron/electron/pull/53326))</sup>
gwennlbh pushed a commit to cigaleapp/cigale that referenced this pull request Sep 14, 2026
##### [v44.2.0](https://github.com/electron/electron/releases/tag/v44.2.0)

### Release Notes for v44.2.0

#### Fixes

- Fixed a pending read on a `net.request` chunked upload stream inside a protocol handler never settling when the request failed or was aborted. [#53373](electron/electron#53373) <sup>(Also in [43](electron/electron#53374), [45](https://github.com/electron/electron/pull/53368))</sup>
- Fixed a potential crash when using `menu.popup` with a frame from an offscreen rendered window. [#53362](electron/electron#53362) <sup>(Also in [43](https://github.com/electron/electron/pull/53432))</sup>
- Fixed an intermittent crash (access violation) on Windows when an ASAR integrity violation is detected, so the process now exits with code 1 as intended. [#53455](electron/electron#53455) <sup>(Also in [43](electron/electron#53456), [45](https://github.com/electron/electron/pull/53438))</sup>
- Fixed application crash after a large number of IPC messages from renderers. [#53417](electron/electron#53417) <sup>(Also in [42](electron/electron#53419), [43](electron/electron#53420), [45](https://github.com/electron/electron/pull/53418))</sup>
- Fixed native addons deriving from `node::ObjectWrap` aborting during garbage collection on Node.js 24.19.0 and later. [#53392](electron/electron#53392) <sup>(Also in [42](electron/electron#53394), [43](electron/electron#53393), [45](https://github.com/electron/electron/pull/53391))</sup>

#### Other Changes

- Backported fixes from upstream ANGLE, Chromium, Skia and V8. [#53479](electron/electron#53479)
- Improved throughput of responses that `protocol.handle` handlers return straight from `net.fetch`. [#53378](electron/electron#53378)
- Updated Chromium to 152.0.7977.76. [#53382](electron/electron#53382)
- Updated Node.js to v24.20.0. [#53250](electron/electron#53250)
##### [v44.1.1](https://github.com/electron/electron/releases/tag/v44.1.1)

### Release Notes for v44.1.1

#### Fixes

- Fixed `chrome.tabs.query()` returning tab `url` and `title` to extensions without the `tabs` permission or host access, aligning with `tabs.get`. [#53354](electron/electron#53354) <sup>(Also in [42](electron/electron#53355), [43](electron/electron#53356), [45](https://github.com/electron/electron/pull/53353))</sup>
- Fixed a renderer crash when an array with a throwing property getter is passed across `contextBridge`, and several main/utility-process crashes when option objects passed to Electron APIs contain throwing accessors or Proxy traps. [#53331](electron/electron#53331) <sup>(Also in [42](electron/electron#53329), [43](https://github.com/electron/electron/pull/53330))</sup>
- Fixed an intermittent crash at startup on Linux caused by a race between Pango and the main thread initializing fontconfig. [#53340](electron/electron#53340) <sup>(Also in [43](electron/electron#53339), [45](https://github.com/electron/electron/pull/53338))</sup>
- Fixed an issue where an exception thrown by a property getter on an object passed through `contextBridge` was swallowed instead of being thrown back to the caller. [#53335](electron/electron#53335) <sup>(Also in [43](electron/electron#53334), [45](https://github.com/electron/electron/pull/53297))</sup>
- Fixed main process crashes when navigating to `http://accessibility/` or `http://devtools/`, when an extension background page used `navigator.mediaDevices`, and when calling `SerialPort.forget()` for a disconnected device. [#53333](electron/electron#53333) <sup>(Also in [43](electron/electron#53332), [45](https://github.com/electron/electron/pull/53325))</sup>
- Fixed the PDF viewer failing to save an edited PDF with `NotAllowedError: Third party iframes are not allowed to show a file picker`. [#53328](electron/electron#53328) <sup>(Also in [43](electron/electron#53327), [45](https://github.com/electron/electron/pull/53326))</sup>

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

44-x-y backport This is a backport PR semver/patch backwards-compatible bug fixes

Projects

Status: No status

Development

Successfully merging this pull request may close these issues.

1 participant

Sponsor
SponsoredKunjungi sekarang
Promo