Screenshot.

Deleted: alert-wrong-title.png 170 KB

	alert-wrong-title.png 170 KB View Download

The title of the alert is interesting. It should normally say "inbox.google.com says:". Is it possible that an extension called "Inbox by Gmail" is overriding the alert function and providing its own?

Yeah I noticed that. I do have this extension installed:
https://chrome.google.com/webstore/detail/inbox-by-gmail/pkclgpgponpjmpfokoepglboejdobkpl

But I believe it's a Hosted App, not an Extension.

Hosted App, extension, same thing for these purposes.

JavaScriptDialogManager::GetTitle returns the name of the extension as the dialog title, but only if the origin url matches. In any case, this is disturbing because it seems like the extension system is mixing up WebContentses, perhaps?

rdevlin.cronin, benwells, thoughts here?

This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Devlin, I'm pretty flat out, could you look after this?

I'm at an all-day workshop for today, but should be able to circle back tomorrow more fully - but a few quick thoughts:

The fact that we're maybe mixing up web contents (or somehow getting this very wrong) is a little terrifying - and rather surprising.  Maybe somehow with using processes when we shouldn't?  But I don't think we group web/extension processes...hmmm.

I think a stack trace here would be very useful in seeing which flow this is all going through to open the alert and tracking down where it goes wrong - avi/mguica, and chance of uploading one?  Or is this only reproable on a real chrome?

#11 This isn't reproable at all. It just happened once. It remained in a consistent state until I closed the tab. I wish I'dve logged the process IDs for those tabs (to see if the renderers were shared) but they're long gone. Sorry. We might just have to leave this bug to see if it shows up again.

avi: Uh oh! This issue still open and hasn't been updated in the last 14 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

avi: Uh oh! This issue still open and hasn't been updated in the last 28 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Moving to ReleaseBlock-Stable so this still gets tracked in the milestone

avi@ - are you best placed to take a look at this?

We have no repro, no hints as to what happened, no idea what's going on here. If it'll help I can close this as WontFix.

Thanks avi@.  Closing as WontFix.
mgiuca@ - please file a new issue if you can find a way to reproduce this.  Cheers!

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot