PatchGap
Chrome · Media

CVE-2026-10962

Type Confusion in Media
High chrome Type Confusion 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactType Confusion in Media
DescriptionType Confusion in Media
ComponentMedia
Bug ClassType Confusion
Tracker511006880
Fix commitf66bd3243b2c (chromium/src) +23/-12
CISA KEVNot listed
CreditedGoogle
Disclosed2026-06-02

Changed Functions

FunctionChangeNotes
MODULES_EXPORT
third_party/blink/renderer/modules/peerconnection/rtc_encoded_audio_frame_delegate.h
 modified

Files Changed

  • third_party/blink/renderer/modules/mediasource/media_source_handle_attachment.cc
  • third_party/blink/renderer/modules/mediasource/media_source_handle_transfer_list.cc
  • third_party/blink/renderer/modules/peerconnection/rtc_data_channel_attachment.cc
  • third_party/blink/renderer/modules/peerconnection/rtc_data_channel_transfer_list.cc
  • third_party/blink/renderer/modules/peerconnection/rtc_encoded_audio_frame_delegate.cc
  • third_party/blink/renderer/modules/peerconnection/rtc_encoded_audio_frame_delegate.h
  • third_party/blink/renderer/modules/peerconnection/rtc_encoded_video_frame_delegate.cc
  • third_party/blink/renderer/modules/webcodecs/audio_data_attachment.cc
  • third_party/blink/renderer/modules/webcodecs/audio_data_transfer_list.cc
  • third_party/blink/renderer/modules/webcodecs/decoder_buffer_attachment.cc
  • third_party/blink/renderer/modules/webcodecs/video_frame_attachment.cc
  • third_party/blink/renderer/modules/webcodecs/video_frame_transfer_list.cc

Patch

view commit
From f66bd3243b2c7963db52ad5863c74d9931cda686 Mon Sep 17 00:00:00 2001
From: Eugene Zemtsov <[email protected]>
Date: Wed, 13 May 2026 07:41:27 -0700
Subject: [PATCH] media: Fix TransferList and Attachment key value collapse

Blink uses `const void* const` keys initialized to `nullptr` for
TransferList and Attachment hash map lookups. In release builds,
Identical Code Folding (ICF) merges these keys into a single memory
address. During serialization, this causes a dictionary collision
leading to a type confusion where objects like `AudioData` are
incorrectly cast and stored in a `VideoFrameTransferList`.

This change fixes the issue by adopting the Chromium idiom of
initializing these static keys to their own memory addresses
(`&ClassName::kKey`). This guarantees globally unique addresses and
prevents the linker from merging them.

Bug: 511006880
Change-Id: Idbe69db7fca51437e0d510fe6602ba2a95a6e2d1
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7842089
Reviewed-by: Colin Blundell <[email protected]>
Commit-Queue: Eugene Zemtsov <[email protected]>
Reviewed-by: Dale Curtis <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1629958}
---

diff --git a/third_party/blink/renderer/modules/mediasource/media_source_handle_attachment.cc b/third_party/blink/renderer/modules/mediasource/media_source_handle_attachment.cc
index c2d955a6..3cd5fad 100644
--- a/third_party/blink/renderer/modules/mediasource/media_source_handle_attachment.cc
+++ b/third_party/blink/renderer/modules/mediasource/media_source_handle_attachment.cc
@@ -7,7 +7,8 @@
 namespace blink {
 
 // static
-const void* const MediaSourceHandleAttachment::kAttachmentKey = nullptr;
+const void* const MediaSourceHandleAttachment::kAttachmentKey =
+    &MediaSourceHandleAttachment::kAttachmentKey;
 
 MediaSourceHandleAttachment::MediaSourceHandleAttachment() = default;
 
diff --git a/third_party/blink/renderer/modules/mediasource/media_source_handle_transfer_list.cc b/third_party/blink/renderer/modules/mediasource/media_source_handle_transfer_list.cc
index eede9c59..991788a 100644
--- a/third_party/blink/renderer/modules/mediasource/media_source_handle_transfer_list.cc
+++ b/third_party/blink/renderer/modules/mediasource/media_source_handle_transfer_list.cc
@@ -10,7 +10,8 @@
 namespace blink {
 
 // static
-const void* const MediaSourceHandleTransferList::kTransferListKey = nullptr;
+const void* const MediaSourceHandleTransferList::kTransferListKey =
+    &MediaSourceHandleTransferList::kTransferListKey;
 
 MediaSourceHandleTransferList::MediaSourceHandleTransferList() = default;
 
diff --git a/third_party/blink/renderer/modules/peerconnection/rtc_data_channel_attachment.cc b/third_party/blink/renderer/modules/peerconnection/rtc_data_channel_attachment.cc
index 8b361f0..7ea1bfcf 100644
--- a/third_party/blink/renderer/modules/peerconnection/rtc_data_channel_attachment.cc
+++ b/third_party/blink/renderer/modules/peerconnection/rtc_data_channel_attachment.cc
@@ -6,6 +6,7 @@
 
 namespace blink {
 
-const void* const RTCDataChannelAttachment::kAttachmentKey = nullptr;
+const void* const RTCDataChannelAttachment::kAttachmentKey =
+    &RTCDataChannelAttachment::kAttachmentKey;
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/modules/peerconnection/rtc_data_channel_transfer_list.cc b/third_party/blink/renderer/modules/peerconnection/rtc_data_channel_transfer_list.cc
index 0727c5f..9910df47 100644
--- a/third_party/blink/renderer/modules/peerconnection/rtc_data_channel_transfer_list.cc
+++ b/third_party/blink/renderer/modules/peerconnection/rtc_data_channel_transfer_list.cc
@@ -8,7 +8,8 @@
 
 namespace blink {
 
-const void* const RTCDataChannelTransferList::kTransferListKey = nullptr;
+const void* const RTCDataChannelTransferList::kTransferListKey =
+    &RTCDataChannelTransferList::kTransferListKey;
 
 void RTCDataChannelTransferList::Trace(Visitor* visitor) const {
   visitor->Trace(data_channel_collection);
diff --git a/third_party/blink/renderer/modules/peerconnection/rtc_encoded_audio_frame_delegate.cc b/third_party/blink/renderer/modules/peerconnection/rtc_encoded_audio_frame_delegate.cc
index a4afde9..8a3dc9f 100644
--- a/third_party/blink/renderer/modules/peerconnection/rtc_encoded_audio_frame_delegate.cc
+++ b/third_party/blink/renderer/modules/peerconnection/rtc_encoded_audio_frame_delegate.cc
@@ -28,7 +28,8 @@
 static constexpr char kRTCEncodedAudioFrameDetachKey[] = "RTCEncodedAudioFrame";
 static constexpr int kAcceptableCaptureTimeDeltaMs = 1;
 
-const void* RTCEncodedAudioFramesAttachment::kAttachmentKey;
+const void* const RTCEncodedAudioFramesAttachment::kAttachmentKey =
+    &RTCEncodedAudioFramesAttachment::kAttachmentKey;
 
 RTCEncodedAudioFrameDelegate::RTCEncodedAudioFrameDelegate(
     std::unique_ptr<webrtc::TransformableAudioFrameInterface> webrtc_frame,
diff --git a/third_party/blink/renderer/modules/peerconnection/rtc_encoded_audio_frame_delegate.h b/third_party/blink/renderer/modules/peerconnection/rtc_encoded_audio_frame_delegate.h
index 3734a33..3322d30 100644
--- a/third_party/blink/renderer/modules/peerconnection/rtc_encoded_audio_frame_delegate.h
+++ b/third_party/blink/renderer/modules/peerconnection/rtc_encoded_audio_frame_delegate.h
@@ -93,7 +93,7 @@
 class MODULES_EXPORT RTCEncodedAudioFramesAttachment
     : public SerializedScriptValue::Attachment {
  public:
-  static const void* kAttachmentKey;
+  static const void* const kAttachmentKey;
   RTCEncodedAudioFramesAttachment() = default;
   ~RTCEncodedAudioFramesAttachment() override = default;
 
diff --git a/third_party/blink/renderer/modules/peerconnection/rtc_encoded_video_frame_delegate.cc b/third_party/blink/renderer/modules/peerconnection/rtc_encoded_video_frame_delegate.cc
index 3511f67..9525cba 100644
--- a/third_party/blink/renderer/modules/peerconnection/rtc_encoded_video_frame_delegate.cc
+++ b/third_party/blink/renderer/modules/peerconnection/rtc_encoded_video_frame_delegate.cc
@@ -23,7 +23,8 @@
 
 static constexpr char kRTCEncodedVideoFrameDetachKey[] = "RTCEncodedVideoFrame";
 
-const void* const RTCEncodedVideoFramesAttachment::kAttachmentKey = nullptr;
+const void* const RTCEncodedVideoFramesAttachment::kAttachmentKey =
+    &RTCEncodedVideoFramesAttachment::kAttachmentKey;
 
 RTCEncodedVideoFrameDelegate::RTCEncodedVideoFrameDelegate(
     std::unique_ptr<webrtc::TransformableVideoFrameInterface> webrtc_frame)
diff --git a/third_party/blink/renderer/modules/webcodecs/audio_data_attachment.cc b/third_party/blink/renderer/modules/webcodecs/audio_data_attachment.cc
index f6f43fc..ece9b95 100644
--- a/third_party/blink/renderer/modules/webcodecs/audio_data_attachment.cc
+++ b/third_party/blink/renderer/modules/webcodecs/audio_data_attachment.cc
@@ -6,6 +6,7 @@
 
 namespace blink {
 
-const void* const AudioDataAttachment::kAttachmentKey = nullptr;
+const void* const AudioDataAttachment::kAttachmentKey =
+    &AudioDataAttachment::kAttachmentKey;
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/modules/webcodecs/audio_data_transfer_list.cc b/third_party/blink/renderer/modules/webcodecs/audio_data_transfer_list.cc
index ec6fa7fc..6a430f4a 100644
--- a/third_party/blink/renderer/modules/webcodecs/audio_data_transfer_list.cc
+++ b/third_party/blink/renderer/modules/webcodecs/audio_data_transfer_list.cc
@@ -8,7 +8,8 @@
 
 namespace blink {
 
-const void* const AudioDataTransferList::kTransferListKey = nullptr;
+const void* const AudioDataTransferList::kTransferListKey =
+    &AudioDataTransferList::kTransferListKey;
 
 void AudioDataTransferList::FinalizeTransfer(ExceptionState& exception_state) {
   for (AudioData* audio_data : audio_data_collection)
diff --git a/third_party/blink/renderer/modules/webcodecs/decoder_buffer_attachment.cc b/third_party/blink/renderer/modules/webcodecs/decoder_buffer_attachment.cc
index ca20185..4c7151e4 100644
--- a/third_party/blink/renderer/modules/webcodecs/decoder_buffer_attachment.cc
+++ b/third_party/blink/renderer/modules/webcodecs/decoder_buffer_attachment.cc
@@ -6,6 +6,7 @@
 
 namespace blink {
 
-const void* const DecoderBufferAttachment::kAttachmentKey = nullptr;
+const void* const DecoderBufferAttachment::kAttachmentKey =
+    &DecoderBufferAttachment::kAttachmentKey;
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/modules/webcodecs/video_frame_attachment.cc b/third_party/blink/renderer/modules/webcodecs/video_frame_attachment.cc
index f21fa682..1206b01 100644
--- a/third_party/blink/renderer/modules/webcodecs/video_frame_attachment.cc
+++ b/third_party/blink/renderer/modules/webcodecs/video_frame_attachment.cc
@@ -6,6 +6,7 @@
 
 namespace blink {
 
-const void* const VideoFrameAttachment::kAttachmentKey = nullptr;
+const void* const VideoFrameAttachment::kAttachmentKey =
+    &VideoFrameAttachment::kAttachmentKey;
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/modules/webcodecs/video_frame_transfer_list.cc b/third_party/blink/renderer/modules/webcodecs/video_frame_transfer_list.cc
index cfa3fa03..a1db4149 100644
--- a/third_party/blink/renderer/modules/webcodecs/video_frame_transfer_list.cc
+++ b/third_party/blink/renderer/modules/webcodecs/video_frame_transfer_list.cc
@@ -8,7 +8,8 @@
 
 namespace blink {
 
-const void* const VideoFrameTransferList::kTransferListKey = nullptr;
+const void* const VideoFrameTransferList::kTransferListKey =
+    &VideoFrameTransferList::kTransferListKey;
 
 void VideoFrameTransferList::FinalizeTransfer(ExceptionState& exception_state) {
   for (VideoFrame* frame : video_frames)
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
On This Page