3 files changed, 36 insertions, 11 deletions

diff --git a/chrome_frame/chrome_active_document.cc b/chrome_frame/chrome_active_document.cc
index 7cb1661..6d350f8 100644
--- a/chrome_frame/chrome_active_document.cc
+++ b/chrome_frame/chrome_active_document.cc
@@ -46,9 +46,6 @@
 DEFINE_GUID(CGID_DocHostCmdPriv, 0x000214D4L, 0, 0, 0xC0, 0, 0, 0, 0, 0, 0,
             0x46);
 
-static const wchar_t kHandleTopLevelRequests[] = L"HandleTopLevelRequests";
-static const wchar_t kUseChromeNetworking[] = L"UseChromeNetworking";
-
 base::ThreadLocalPointer<ChromeActiveDocument> g_active_doc_cache;
 
 bool g_first_launch_by_process_ = true;
@@ -96,12 +93,7 @@ HRESULT ChromeActiveDocument::FinalConstruct() {
       return hr;
   }
 
-  // Query and assign the top-level-request routing, and host networking
-  // settings from the registry.
-  bool top_level_requests = GetConfigBool(true, kHandleTopLevelRequests);
-  bool chrome_network = GetConfigBool(false, kUseChromeNetworking);
-  automation_client_->set_handle_top_level_requests(top_level_requests);
-  automation_client_->set_use_chrome_network(chrome_network);
+  InitializeAutomationSettings();
 
   find_dialog_.Init(automation_client_.get());
 
diff --git a/chrome_frame/chrome_frame_activex.cc b/chrome_frame/chrome_frame_activex.cc
index 0401298..e2d9b3a 100644
--- a/chrome_frame/chrome_frame_activex.cc
+++ b/chrome_frame/chrome_frame_activex.cc
@@ -459,6 +459,12 @@ HRESULT ChromeFrameActivex::IOleObject_SetClientSite(
       WideToUTF8(url_, url_.Length(), &utf8_url);
     }
 
+    // Only privileged instances of ActiveX Chrome Frame controls may read
+    // the chrome-network, and top-level-navigation settings from the registry.
+    // See issue: 54920
+    if (is_privileged_)
+      InitializeAutomationSettings();
+
     url_fetcher_->set_frame_busting(!is_privileged_);
     automation_client_->SetUrlFetcher(url_fetcher_.get());
     if (!InitializeAutomation(profile_name, chrome_extra_arguments,
diff --git a/chrome_frame/chrome_frame_activex_base.h b/chrome_frame/chrome_frame_activex_base.h
index 10ad0d9..dae53df 100644
--- a/chrome_frame/chrome_frame_activex_base.h
+++ b/chrome_frame/chrome_frame_activex_base.h
@@ -511,10 +511,25 @@ END_MSG_MAP()
     std::wstring wide_url = url_;
     GURL parsed_url(WideToUTF8(wide_url));
 
+    std::string scheme(parsed_url.scheme());
+    std::string host(parsed_url.host());
+
+    // If Chrome-Frame is presently navigated to an extension page, navigating
+    // the host to a url with scheme chrome-extension will fail, so we
+    // point the host at http:local_host.  Note that this is NOT the URL
+    // to which the host is directed.  It is only used as a temporary message
+    // passing mechanism between this CF instance, and the BHO that will
+    // be constructed in the new IE tab.
+    if (parsed_url.SchemeIs("chrome-extension") &&
+        is_privileged_) {
+      scheme = "http";
+      host = "local_host";
+    }
+
     std::string url =
         StringPrintf("%hs:%hs?attach_external_tab&%I64u&%d&%d&%d&%d&%d&%hs",
-                     parsed_url.scheme().c_str(),
-                     parsed_url.host().c_str(),
+                     scheme.c_str(),
+                     host.c_str(),
                      params.cookie,
                      params.disposition,
                      params.dimensions.x(),
@@ -1221,6 +1236,18 @@ END_MSG_MAP()
                             http_headers.AsInput());
   }
 
+  void InitializeAutomationSettings() {
+    static const wchar_t kHandleTopLevelRequests[] = L"HandleTopLevelRequests";
+    static const wchar_t kUseChromeNetworking[] = L"UseChromeNetworking";
+
+    // Query and assign the top-level-request routing, and host networking
+    // settings from the registry.
+    bool top_level_requests = GetConfigBool(true, kHandleTopLevelRequests);
+    bool chrome_network = GetConfigBool(false, kUseChromeNetworking);
+    automation_client_->set_handle_top_level_requests(top_level_requests);
+    automation_client_->set_use_chrome_network(chrome_network);
+  }
+
   ScopedBstr url_;
   ScopedComPtr<IOleDocumentSite> doc_site_;