Security Bug

Important: Please do not change the component of this bug manually.

Please READ THIS FAQ before filing a bug: https://chromium.googlesource.com/chromium/src/+/HEAD/docs/security/faq.md

Please see the following link for instructions on filing security bugs: https://www.chromium.org/Home/chromium-security/reporting-security-bugs

Reports may be eligible for reward payments under the Chrome VRP: https://g.co/chrome/vrp

NOTE: Security bugs are normally made public once a fix has been widely deployed.

VULNERABILITY DETAILS

NOTE

The issue was discovered by a fuzzer running on ClusterFuzz.
It requires user interaction (pressing the Escape key) to trigger,
which prevented ClusterFuzz from reporting it automatically.
I have provided a minimal Proof of Concept (PoC) that can trigger the problem.
Locally, it results in a null pointer, while on ClusterFuzz, it triggers a container overflow.
The exact cause is still under analysis.

https://clusterfuzz.com/testcase-detail/5308799824887808

Reproduction Steps

• Run: chrome --no-sandbox --user-data-dir=test --enable-logging=stderr poc.html
• Press the Escape key to trigger the bug

Root Cause Analysis (RCA) & Bisect

Coming soon