High chrome UAF 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactUse after free in PDF
DescriptionUse after free in PDF
ComponentPDF
Sub-componentPDF
Bug ClassUAF
Tracker570050928
Fix commite0c230bb1860 (chromium/src) +1/-9
CISA KEVNot listed
CreditedXinyang Ge
Disclosed2026-10-13

Files Changed

  • components/pdf/renderer/pdf_view_web_plugin_client.cc
From e0c230bb186080c81c9e6b36a08deea184d15c59 Mon Sep 17 00:00:00 2001
From: Lei Zhang <[email protected]>
Date: Tue, 06 Oct 2026 14:48:37 -0700
Subject: [PATCH] [PDF] Simplify PdfViewWebPluginClient::TextSelectionChanged()

This reverts crrev.com/906945, which added a focus frame call. The
motivation in that CL is to make PDFExtensionJSTest.BasicPlugin pass,
but the test still passes now without it. In the meanwhile, the focus
event is being abused, so just get rid of it.

Bug: 40192026, 570050928
Change-Id: Iadfc44ae381b42e9e29f2c83f2291bff3f9704c9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8524410
Reviewed-by: April Kallmeyer <[email protected]>
Commit-Queue: Lei Zhang <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1712741}
---
diff --git a/components/pdf/renderer/pdf_view_web_plugin_client.cc b/components/pdf/renderer/pdf_view_web_plugin_client.cc
index 1939bc0..685bea6 100644
--- a/components/pdf/renderer/pdf_view_web_plugin_client.cc
+++ b/components/pdf/renderer/pdf_view_web_plugin_client.cc
@@ -32,7 +32,6 @@
 #include "third_party/blink/public/web/web_plugin_container.h"
 #include "third_party/blink/public/web/web_script_forbidden_scope.h"
 #include "third_party/blink/public/web/web_serialized_script_value.h"
-#include "third_party/blink/public/web/web_view.h"
 #include "third_party/blink/public/web/web_widget.h"
 #include "ui/accessibility/ax_features.mojom-features.h"
 #include "ui/display/screen_info.h"
@@ -193,14 +192,7 @@
     const blink::WebString& selection_text,
     uint32_t offset,
     const gfx::Range& range) {
-  // Focus the plugin's containing frame before changing the text selection.
-  // TODO(crbug.com/40192026): Would it make more sense not to change the text
-  // selection at all in this case? Maybe we only have this problem because we
-  // support a "selectAll" message.
-  blink::WebLocalFrame* frame = GetFrame();
-  frame->View()->SetFocusedFrame(frame);
-
-  frame->TextSelectionChanged(selection_text, offset, range);
+  GetFrame()->TextSelectionChanged(selection_text, offset, range);
 }
 
 std::unique_ptr<blink::WebAssociatedURLLoader>
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.