Custom NTP internal URL detection may incorrectly match chrome:// in URL contents

OS/Platform

Windows

Installed

Compiled from source

Version

151.0.7922.137

Have you tested that this is not an upstream issue or an issue with your configuration?

• I have tried reproducing this issue in Chrome and it could not be reproduced there
• I have tried reproducing this issue in vanilla Chromium and it could not be reproduced there
• I have tried reproducing this issue in ungoogled-chromium with a new and empty profile using --user-data-dir command line argument and it could not be reproduced there

Description

Custom NTP internal URL detection may incorrectly match chrome:// in URL contents

How to Reproduce?

The incognito NTP handling logic currently uses string matching:

ntp_location.find("chrome://")

This checks whether the string contains "chrome://" rather than whether the URL scheme is "chrome".

Actual behaviour

The current implementation uses string matching (find("chrome://")) to detect internal Chrome URLs.

As a result, URLs that only contain chrome:// in their query string or path may be incorrectly treated as internal Chrome pages.

Example:

https://example.com/?x=chrome://foo is incorrectly detected as a chrome:// internal page.

Expected behaviour

Only URLs with the chrome scheme should be treated as internal Chrome pages.

Proposed fix

Use GURL::SchemeIs("chrome") to perform scheme-based detection.

Additional context

No response