PatchGap
Chrome · PageInfo

CVE-2025-12437

UAF in PageInfo
Medium chrome UAF 📄 Reporter bug report 🔧 Commit mapped

Overview

Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactUse after free in PageInfo
DescriptionUse after free in PageInfo
ComponentPageInfo
Bug ClassUAF
Tracker446294487
Fix commit90a4060a92d1 (chromium/src) +12/-17
CISA KEVNot listed
CreditedUmar Farooq
Disclosed2025-10-28

Changed Functions

FunctionChangeNotes
if
chrome/browser/ui/page_info/chrome_page_info_delegate.cc
 modified

Files Changed

  • chrome/browser/ui/page_info/chrome_page_info_delegate.cc
  • chrome/browser/ui/page_info/page_info_infobar_delegate.cc
  • chrome/browser/ui/page_info/page_info_infobar_delegate.h

Patch

view commit
From 90a4060a92d135f1789056c943cf7e535fa8603b Mon Sep 17 00:00:00 2001
From: Fiona Macintosh <[email protected]>
Date: Tue, 07 Oct 2025 09:57:32 -0700
Subject: [PATCH] [Page Info] Fix use-after-free in infobar delegate

Bug: 446294487
Change-Id: Ica9a2077b88c019664b498f03d162802d44c7049
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7008715
Auto-Submit: Fiona Macintosh <[email protected]>
Reviewed-by: Christian Dullweber <[email protected]>
Commit-Queue: Fiona Macintosh <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1526366}
---

diff --git a/chrome/browser/ui/page_info/chrome_page_info_delegate.cc b/chrome/browser/ui/page_info/chrome_page_info_delegate.cc
index ff61c81e..a8cbccb 100644
--- a/chrome/browser/ui/page_info/chrome_page_info_delegate.cc
+++ b/chrome/browser/ui/page_info/chrome_page_info_delegate.cc
@@ -225,8 +225,7 @@
   infobars::ContentInfoBarManager* infobar_manager =
       infobars::ContentInfoBarManager::FromWebContents(web_contents_);
   if (infobar_manager) {
-    auto* delegate = PageInfoInfoBarDelegate::Create(infobar_manager);
-    delegate->set_reload_type(reload_type);
+    PageInfoInfoBarDelegate::Create(infobar_manager, reload_type);
     return true;
   }
   return false;
diff --git a/chrome/browser/ui/page_info/page_info_infobar_delegate.cc b/chrome/browser/ui/page_info/page_info_infobar_delegate.cc
index 54deb3c5..f3abf4f 100644
--- a/chrome/browser/ui/page_info/page_info_infobar_delegate.cc
+++ b/chrome/browser/ui/page_info/page_info_infobar_delegate.cc
@@ -18,16 +18,14 @@
 #include "ui/base/l10n/l10n_util.h"
 
 // static
-PageInfoInfoBarDelegate* PageInfoInfoBarDelegate::Create(
-    infobars::ContentInfoBarManager* infobar_manager) {
-  auto* delegate = new PageInfoInfoBarDelegate();
+void PageInfoInfoBarDelegate::Create(
+    infobars::ContentInfoBarManager* infobar_manager,
+    content::ReloadType reload_type) {
   infobar_manager->AddInfoBar(
-      CreateConfirmInfoBar(std::unique_ptr<ConfirmInfoBarDelegate>(delegate)));
-  return delegate;
+      CreateConfirmInfoBar(std::unique_ptr<ConfirmInfoBarDelegate>(
+          new PageInfoInfoBarDelegate(reload_type))));
 }
 
-PageInfoInfoBarDelegate::PageInfoInfoBarDelegate() = default;
-
 PageInfoInfoBarDelegate::~PageInfoInfoBarDelegate() = default;
 
 infobars::InfoBarDelegate::InfoBarIdentifier
diff --git a/chrome/browser/ui/page_info/page_info_infobar_delegate.h b/chrome/browser/ui/page_info/page_info_infobar_delegate.h
index 0727256..ba95e10d 100644
--- a/chrome/browser/ui/page_info/page_info_infobar_delegate.h
+++ b/chrome/browser/ui/page_info/page_info_infobar_delegate.h
@@ -24,15 +24,13 @@
 
   // Creates a page info infobar and delegate and adds the infobar to
   // |infobar_manager|.
-  static PageInfoInfoBarDelegate* Create(
-      infobars::ContentInfoBarManager* infobar_manager);
-
-  void set_reload_type(content::ReloadType reload_type) {
-    reload_type_ = reload_type;
-  }
+  static void Create(
+      infobars::ContentInfoBarManager* infobar_manager,
+      content::ReloadType reload_type = content::ReloadType::NORMAL);
 
  private:
-  PageInfoInfoBarDelegate();
+  explicit PageInfoInfoBarDelegate(content::ReloadType reload_type)
+      : reload_type_(reload_type) {}
   ~PageInfoInfoBarDelegate() override;
 
   // ConfirmInfoBarDelegate:
@@ -44,7 +42,7 @@
   bool Accept() override;
 
   // The type of reload the info bar should trigger when closed.
-  content::ReloadType reload_type_ = content::ReloadType::NORMAL;
+  content::ReloadType reload_type_;
 };
 
 #endif  // CHROME_BROWSER_UI_PAGE_INFO_PAGE_INFO_INFOBAR_DELEGATE_H_
Loading diff…

Original Bug Report

reported by [email protected]

heap-use-after-free C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\page_info\page_info_infobar_dele

Steps to reproduce the problem

  1. i will be updating soon

Problem Description

================================================================= ==11072==ERROR: AddressSanitizer: heap-use-after-free on address 0x11f90ac4a4f0 at pc 0x7ffdc8b6a9fc bp 0x0021f1ffab70 sp 0x0021f1ffabb8 WRITE of size 4 at 0x11f90ac4a4f0 thread T0 #0 0x7ffdc8b6a9fb in PageInfoInfoBarDelegate::set_reload_type C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\page_info\page_info_infobar_delegate.h:31 #1 0x7ffdc8b6a9fb in ChromePageInfoDelegate::CreateInfoBarDelegate(enum content::ReloadType) C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\page_info\chrome_page_info_delegate.cc:226:15 #2 0x7ffde101ffb0 in PageInfo::OnUIClosing(bool ) C:\b\s\w\ir\cache\builder\src\components\page_info\page_info.cc:796:20 #3 0x7ffdc94f5841 in PageInfoBubbleView::OnWidgetDestroying(class views::Widget ) C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\views\page_info\page_info_bubble_view.cc:352:17 #4 0x7ffdcaecbb91 in std::__Cr::__invoke C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include__type_traits\invoke.h:203 #5 0x7ffdcaecbb91 in std::__Cr::invoke C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include__functional\invoke.h:29 #6 0x7ffdcaecbb91 in base::ObserverList<class views::WidgetObserver, 0, 1, class base::internal::CheckedObserverAdapter>::Notify<void (__cdecl views::WidgetObserver::)(class views::Widget ), class views::Widget >(void (__cdecl views::WidgetObserver::)(class views::Widget ), class views::Widget const &) C:\b\s\w\ir\cache\builder\src\base\observer_list.h:398:7 #7 0x7ffdcaec04ab in views::Widget::HandleWidgetDestroying(void) C:\b\s\w\ir\cache\builder\src\ui\views\widget\widget.cc:2719:14 #8 0x7ffdcadeff52 in views::DesktopWindowTreeHostWin::HandleDestroying(void) C:\b\s\w\ir\cache\builder\src\ui\views\widget\desktop_aura\desktop_window_tree_host_win.cc:1052:30 #9 0x7ffdcae80324 in views::HWNDMessageHandler::OnDestroy(void) C:\b\s\w\ir\cache\builder\src\ui\views\win\hwnd_message_handler.cc:1891:14 #10 0x7ffdcae74182 in views::HWNDMessageHandler::ProcessWindowMessage(struct HWND_, unsigned int, unsigned __int64, __int64, __int64 &, unsigned long) C:\b\s\w\ir\cache\builder\src\ui\views\win\hwnd_message_handler.h:468:5 #11 0x7ffdcae7151d in views::HWNDMessageHandler::OnWndProc(unsigned int, unsigned __int64, int64) C:\b\s\w\ir\cache\builder\src\ui\views\win\hwnd_message_handler.cc:1178:7 #12 0x7ffdcf592d7c in gfx::WindowImpl::WndProc(struct HWND, unsigned int, unsigned __int64, int64) C:\b\s\w\ir\cache\builder\src\ui\gfx\win\window_impl.cc:313:18 #13 0x7ffdcf59185e in base::win::WrappedWindowProc<&gfx::WindowImpl::WndProc(struct HWND, unsigned int, unsigned __int64, int64)>(struct HWND, unsigned int, unsigned __int64, __int64) C:\b\s\w\ir\cache\builder\src\base\win\wrapped_window_proc.h:74:10 #14 0x7ffedc787cf5 (C:\WINDOWS\System32\USER32.dll+0x180017cf5) #15 0x7ffedc78757b (C:\WINDOWS\System32\USER32.dll+0x18001757b) #16 0x7ffedc7b8562 (C:\WINDOWS\System32\USER32.dll+0x180048562) #17 0x7ffeddb47253 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x180167253) #18 0x7ffedb182543 (C:\WINDOWS\System32\win32u.dll+0x180002543) #19 0x7ffdcae8c07f in base::internal::DecayedFunctorTraits<void (HWNDMessageHandler::)(),base::WeakPtrviews::HWNDMessageHandler &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731 #20 0x7ffdcae8c07f in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (HWNDMessageHandler::&&)(),base::WeakPtrviews::HWNDMessageHandler &&>,void,0>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:947 #21 0x7ffdcae8c07f in base::internal::Invoker<base::internal::FunctorTraits<void (HWNDMessageHandler::&&)(),base::WeakPtrviews::HWNDMessageHandler &&>,base::internal::BindState<1,1,0,void (HWNDMessageHandler::)(),base::WeakPtrviews::HWNDMessageHandler >,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060 #22 0x7ffdcae8c07f in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl views::HWNDMessageHandler::&&)(void), class base::WeakPtr<class views::HWNDMessageHandler> &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl views::HWNDMessageHandler::)(void), class base::WeakPtr<class views::HWNDMessageHandler>>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12 #23 0x7ffdcc859cb3 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156 #24 0x7ffdcc859cb3 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:207:34 #25 0x7ffdcc82ceb9 in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:104 #26 0x7ffdcc82ceb9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(class base::LazyNow *) C:\b\s\

Summary

heap-use-after-free C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\page_info\page_info_infobar_dele

Custom Questions

Reporter credit:

Puf

Additional Data

Category: Security
Chrome Channel: Not sure
Regression: N/A \

View on issue tracker
On This Page