commit 4c9cc9de3bcd1c0919975384ea0ee97f994777a0
author Alex Moshchuk <alexmos@chromium.org> Tue Sep 30 19:21:49 2025
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> Tue Sep 30 19:21:49 2025
tree 61b499f2fbaf33d66d243ae48124b45901854d57
parent 81a154c4d08b5205bb010d84046a28716c9fec86

Enable `kCommittedOriginEnforcements` by default.

This enables committed origin enforcements by default. These
enforcements will now be used instead of jail/citadel enforcements for
performing all ChildProcessSecurityPolicy::CanAccessOrigin checks,
except those that check whether a new origin can be committed into a
process (which still requires the old-style checks). The feature is kept
around as a kill switch.

Note that some known discrepancies between old and new checks were
investigated in https://crbug.com/441327472 and ultimately determined
not to be blockers for launching this feature. Most of them are
suspected to be caused by bugs in jail/citadel enforcements, where the
new enforcements will likely prevent renderer kills on legitimate sites.
One case (https://crbug.com/447555061, involving push messaging in
certain same-site cross-origin cases) might be introducing new renderer
kills, where it's not yet clear whether it's a bug or a security
improvement, but its volume is very small, much much smaller than
the renderer kills we're fixing, resulting in a good trade-off.

Mismatches between the new and old checks will continue to generate
DumpWithoutCrashing reports even with kCommittedOriginEnforcements
enabled. This will allow us to continue tracking and investigating the
remaining mismatches between the two checks.

Enabled-by-default-reason: launching
Bug: 40148776
Change-Id: I89f888c54fd187bf78057607866be31e100cc1ef
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6975176
Commit-Queue: Alex Moshchuk <alexmos@chromium.org>
Reviewed-by: Charlie Reis <creis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1523056}