PatchGap
Chrome · HTML › Blink>HTML, IO>Keyboard

CVE-2025-4096

OOB in HTML (Blink>HTML, IO>Keyboard)
High CVSS 8.8 chrome OOB 📄 Reporter bug report

Overview

High
Severity
8.8
CVSS
No
Exploited ITW
Embargoed
Fix Status
ImpactHeap buffer overflow in HTML
DescriptionHeap buffer overflow in HTML
ComponentHTML
Sub-componentBlink>HTML, IO>Keyboard
Bug ClassOOB
Tracker409911705
CWECWE-122 (Heap buffer overflow)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA KEVNot listed
CreditedAnonymous
Reported2025-04-11 · bounty $5000 (per vendor advisory)
Disclosed2025-04-29

Fix not yet public

No public source fix for this bug has been identified on the main branch yet — it is embargoed or not yet disclosed. Root-cause analysis is withheld until the fix commit is available.

Original Bug Report

reported by [email protected]

container-overflow in blink::CloseWatcher::WatcherStack::Signal() close_watcher.cc:170:10

Security Bug

Important: Please do not change the component of this bug manually.

Please READ THIS FAQ before filing a bug: https://chromium.googlesource.com/chromium/src/+/HEAD/docs/security/faq.md

Please see the following link for instructions on filing security bugs: https://www.chromium.org/Home/chromium-security/reporting-security-bugs

Reports may be eligible for reward payments under the Chrome VRP: https://g.co/chrome/vrp

NOTE: Security bugs are normally made public once a fix has been widely deployed.

VULNERABILITY DETAILS

NOTE

The issue was discovered by a fuzzer running on ClusterFuzz.
It requires user interaction (pressing the Escape key) to trigger,
which prevented ClusterFuzz from reporting it automatically.
I have provided a minimal Proof of Concept (PoC) that can trigger the problem.
Locally, it results in a null pointer, while on ClusterFuzz, it triggers a container overflow.
The exact cause is still under analysis.

https://clusterfuzz.com/testcase-detail/5308799824887808

Reproduction Steps

  • Run: chrome --no-sandbox --user-data-dir=test --enable-logging=stderr poc.html
  • Press the Escape key to trigger the bug

Root Cause Analysis (RCA) & Bisect

Coming soon

View on issue tracker
Uploaded PoC files
Links in the report
On This Page