Chrome · Glic
CVE-2026-10990
UAF in Glic
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
chrome/browser/ui/webui/skills/skills_dialog_handler.cc
Patch
From 140f34b1d05dcf207b694be6f44f47147810d284 Mon Sep 17 00:00:00 2001 From: marissa shen <[email protected]> Date: Wed, 29 Apr 2026 13:41:12 -0700 Subject: [PATCH] record metrics before closing/deleting dialog to avoid heap-use-after-free Bug: b:506311914 Change-Id: I5e55470683ff130d974bbd70a2b29a53cf82f7a3 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7804170 Reviewed-by: Howard Chang <[email protected]> Commit-Queue: marissa shen <[email protected]> Cr-Commit-Position: refs/heads/main@{#1622693} --- diff --git a/chrome/browser/ui/webui/skills/skills_dialog_handler.cc b/chrome/browser/ui/webui/skills/skills_dialog_handler.cc index b56bdd59..64396cf 100644 --- a/chrome/browser/ui/webui/skills/skills_dialog_handler.cc +++ b/chrome/browser/ui/webui/skills/skills_dialog_handler.cc @@ -118,8 +118,8 @@ /*is_edit_mode=*/IsEditMode(&initial_skill_)); // Triggers toast delegate_->OnSkillSaved(response->id); - delegate_->CloseDialog(); RecordSkillsSaveResult(SkillsSaveResult::kSuccess); + delegate_->CloseDialog(); std::move(wrapped_callback).Run(true); } @@ -129,9 +129,9 @@ } // Triggers toast delegate_->OnSkillDeleted(skill_id); - delegate_->CloseDialog(); RecordSkillsDialogAction(SkillsDialogAction::kDeleted, entrypoint_, /*is_edit_mode=*/true); + delegate_->CloseDialog(); } void SkillsDialogHandler::CloseDialog() {
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page