PatchGap
Chrome · WebAppInstalls

CVE-2026-10005

UAF in WebAppInstalls
High chrome UAF 📄 Reporter bug report 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactUse after free in WebAppInstalls
DescriptionUse after free in WebAppInstalls
ComponentWebAppInstalls
Bug ClassUAF
Tracker513750089
Fix commit6c5b35aa5096 (chromium/src) +25/-0
CISA KEVNot listed
CreditedGoogle
Disclosed2026-05-27

Changed Functions

FunctionChangeNotes
for
chrome/app_shim/app_shim_application.mm
 modified
if
chrome/app_shim/app_shim_application.mm
 modified

Files Changed

  • chrome/app_shim/app_shim_application.mm

Patch

view commit
From 6c5b35aa509605188466f9d3a0472f345866be8b Mon Sep 17 00:00:00 2001
From: Marijn Kruisselbrink <[email protected]>
Date: Mon, 18 May 2026 13:06:42 -0700
Subject: [PATCH] Fix Use-After-Free in AppShimApplication via Dock Menu

When a window is closed while the Dock menu is open, selecting it from
the Dock menu triggers the '_selectWindow:' action on a freed window
pointer. Short-circuit this action by validating the target window
before forwarding it to super.

This duplicates logic from CrBrowserApplication, but this will be
refactored in a follow-up CL by adding a common base class.

Bug: 513750089
Change-Id: I8aaa24e1298ffef543f3fa4a2b09896e9d7bab2e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7855918
Reviewed-by: Avi Drissman <[email protected]>
Commit-Queue: Marijn Kruisselbrink <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1632360}
---

diff --git a/chrome/app_shim/app_shim_application.mm b/chrome/app_shim/app_shim_application.mm
index 319232f..055a589 100644
--- a/chrome/app_shim/app_shim_application.mm
+++ b/chrome/app_shim/app_shim_application.mm
@@ -57,6 +57,31 @@
   return [super accessibilitySetValue:value forAttribute:attribute];
 }
 
+- (BOOL)sendAction:(SEL)anAction to:(id)aTarget from:(id)sender {
+  // The Dock menu contains an automagic section where you can select
+  // amongst open windows.  If a window is closed via JavaScript while
+  // the menu is up, the menu item for that window continues to exist.
+  // When a window is selected this method is called with the
+  // now-freed window as |aTarget|.  Short-circuit the call if
+  // |aTarget| is not a valid window.
+  if (anAction == @selector(_selectWindow:)) {
+    // Not using -[NSArray containsObject:] because |aTarget| may be a
+    // freed object.
+    BOOL found = NO;
+    for (NSWindow* window in [self windows]) {
+      if (window == aTarget) {
+        found = YES;
+        break;
+      }
+    }
+    if (!found) {
+      return NO;
+    }
+  }
+
+  return [super sendAction:anAction to:aTarget from:sender];
+}
+
 - (NSAccessibilityRole)accessibilityRole {
   AppShimDelegate* delegate =
       base::apple::ObjCCastStrict<AppShimDelegate>(NSApp.delegate);
Loading diff…

Original Bug Report

reported by [email protected]

Potential Use-After-Free in unsandboxed AppShimApplication via Dock Menu

Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: AppShimApplication lacks a security guard in sendAction:to:from: that exists in BrowserCrApplication to prevent a Use-After-Free (UAF) condition. This allows a malicious Progressive Web App (PWA) to potentially trigger memory corruption and code execution in the unsandboxed app shim process. The vulnerability occurs when a window is closed while the macOS Dock menu is displaying it, leading to a stale pointer dispatch.

Affected files:

  • chrome/app_shim/app_shim_application.mm
  • chrome/app_shim/app_shim_application.h

Estimated timestamp from git blame: 2019-01-29

Description

In Chromium on macOS, BrowserCrApplication (the NSApplication subclass for the browser process) overrides -[NSApplication sendAction:to:from:] to implement a security guard against a known Use-After-Free (UAF) condition in AppKit’s auto-generated Dock-menu window list.

When a user right-clicks an application’s Dock icon, AppKit snapshots the window list to populate the menu. If a window is subsequently closed (e.g., via JavaScript) while the menu is still open, the menu continues to hold a raw pointer to the now-freed NSWindow. Selecting that window from the menu causes AppKit to call _selectWindow: on the freed object. BrowserCrApplication prevents this by verifying that the target window still exists in the application’s window list before dispatching the action.

AppShimApplication, the NSApplication subclass used by app shims (including Progressive Web Apps), lacks this override and the corresponding guard. Consequently, selecting a closed window from a PWA’s Dock menu results in a potential wild-pointer dispatch via objc_msgSend on the freed memory of a NativeWidgetMacNSWindow object.

Impact

The app shim process runs unsandboxed on macOS (Sandbox::kNoSandbox as defined in sandbox/policy/sandbox_type.cc). By reclaiming the memory of the freed NativeWidgetMacNSWindow with attacker-controlled data, an attacker could potentially gain control of the Objective-C isa pointer. This leads to a potential Remote Code Execution (RCE) primitive within the unsandboxed process, effectively allowing a compromise of the user environment from a PWA.

Potential Reproduction Steps

Note: These steps are based on source code analysis as our tooling does not yet have the ability to run functional exploits.

  1. Install a PWA in Chrome on macOS.
  2. In the PWA, open a popup window using let p = window.open(...).
  3. Right-click the PWA’s Dock icon to display the window list.
  4. While the menu is open, execute p.close() in the PWA. This causes the browser to send a Mojo message to the shim, which results in the destruction of the NativeWidgetNSWindowBridge and the deallocation of the corresponding NativeWidgetMacNSWindow object.
  5. Reclaim the freed memory in the shim process (e.g., by setting document.title on remaining windows to trigger allocations that may occupy the freed object’s memory slot).
  6. Select the stale popup window entry from the Dock menu.
  7. AppShimApplication will attempt to dispatch the _selectWindow: action to the freed/reclaimed object.

Recommendation

Implement the same sendAction:to:from: override in AppShimApplication (located in chrome/app_shim/app_shim_application.mm) as exists in BrowserCrApplication (chrome/browser/chrome_browser_application_mac.mm) to validate that the target of a _selectWindow: action is a valid window in the application’s window list.

Evaluated with Chrome root at commit: 1a8d40fc44df2088d5945c0bf53584038aa1614a

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

  • If you are familiar with the severity guidelines, you may adjust the severity.
  • If this is a false positive, and there’s no work to be done, please close as WAI.
  • If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.

View on issue tracker
On This Page