Max Karolinskiy
edd588d9b2
Chromium change: https://source.chromium.org/chromium/chromium/src/+/1917c17d0ad2fdc3e994a9aefd254b8db7bbe457 commit 1917c17d0ad2fdc3e994a9aefd254b8db7bbe457 Author: Takashi Toyoshima <toyoshim@chromium.org> Date: Wed Apr 22 19:42:38 2026 -0700 OOR-CORS: Enforce extra forbidden Sec- header checks This CL adds a new function ContainsForbiddenSecurityHeader in header_util to check for unauthorized Sec- headers from renderer. This function is used in both CorsURLLoaderFactory::IsValidRequest and CorsURLLoader::FollowRedirect to prevent renderer from injecting or modifying these headers, while permitting Client Hints and Sec-Purpose. Change-Id: Ia2923ccbddddba2657d72916a03e657c1785cd85 Bug: 494800494