1 files changed, 28 insertions, 0 deletions
diff --git a/chromium/content/browser/accessibility/browser_accessibility_manager_win.cc b/chromium/content/browser/accessibility/browser_accessibility_manager_win.cc
index 2251fd1696d..f6179284bb4 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_manager_win.cc
+++ b/chromium/content/browser/accessibility/browser_accessibility_manager_win.cc
@@ -19,6 +19,10 @@
 
 namespace content {
 
+// See OnScreenReaderHoneyPotQueried, below.
+bool g_screen_reader_honeypot_queried = false;
+bool g_acc_name_called = false;
+
 // static
 BrowserAccessibilityManager* BrowserAccessibilityManager::Create(
     const ui::AXTreeUpdate& initial_tree,
@@ -80,6 +84,30 @@ void BrowserAccessibilityManagerWin::OnIAccessible2Used() {
       ui::AXMode::kNativeAPIs | ui::AXMode::kWebContents);
 }
 
+void BrowserAccessibilityManagerWin::OnScreenReaderHoneyPotQueried() {
+  // We used to trust this as a signal that a screen reader is running,
+  // but it's been abused. Now only enable accessibility if we also
+  // detect a call to get_accName.
+  if (g_screen_reader_honeypot_queried)
+    return;
+  g_screen_reader_honeypot_queried = true;
+  if (g_acc_name_called) {
+    BrowserAccessibilityStateImpl::GetInstance()->AddAccessibilityModeFlags(
+        ui::AXMode::kNativeAPIs | ui::AXMode::kWebContents);
+  }
+}
+
+void BrowserAccessibilityManagerWin::OnAccNameCalled() {
+  // See OnScreenReaderHoneyPotQueried, above.
+  if (g_acc_name_called)
+    return;
+  g_acc_name_called = true;
+  if (g_screen_reader_honeypot_queried) {
+    BrowserAccessibilityStateImpl::GetInstance()->AddAccessibilityModeFlags(
+        ui::AXMode::kNativeAPIs | ui::AXMode::kWebContents);
+  }
+}
+
 void BrowserAccessibilityManagerWin::UserIsReloading() {
   if (GetRoot())
     FireWinAccessibilityEvent(IA2_EVENT_DOCUMENT_RELOAD, GetRoot());