Chrome · ServiceWorker
CVE-2026-11201
UAF in ServiceWorker
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
forcontent/browser/service_worker/service_worker_context_core.cc |
modified |
Files Changed
content/browser/service_worker/service_worker_context_core.cc
Patch
From 5dbc814bf3657d2dd0d8ac766756639d6f7f7571 Mon Sep 17 00:00:00 2001 From: Andrea Orru <[email protected]> Date: Mon, 27 Apr 2026 13:37:26 -0700 Subject: [PATCH] Prevent potential UAF if Shutdown happens in OnRunningStateChanged We had already introduced `safe_sync_observer_list` in a previous CL (https://crrev.com/c/7740779) but its use was silently removed as part of another fix (https://crrev.com/c/7749842). This CL defensively restores it. Fixed: 505068950 Change-Id: I85b9a762021a3e9e6e20689755385cedcc1668b0 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7793527 Commit-Queue: Andrea Orru <[email protected]> Reviewed-by: Yoshisato Yanagisawa <[email protected]> Cr-Commit-Position: refs/heads/main@{#1621288} --- diff --git a/content/browser/service_worker/service_worker_context_core.cc b/content/browser/service_worker/service_worker_context_core.cc index e4625e4..f6b2445 100644 --- a/content/browser/service_worker/service_worker_context_core.cc +++ b/content/browser/service_worker/service_worker_context_core.cc @@ -1271,7 +1271,7 @@ // token, and the second call crashes when it tries to access it. // See https://crbug.com/496389117. if (start_worker_token.has_value()) { - for (auto& observer : sync_observer_list_->observers) { + for (auto& observer : safe_sync_observer_list->observers) { observer.OnStoppedSync(version->version_id(), version->scope(), *start_worker_token); } @@ -1294,7 +1294,7 @@ &ServiceWorkerContextCoreObserver::OnStopping, version->version_id()); if (start_worker_token.has_value()) { - for (auto& observer : sync_observer_list_->observers) { + for (auto& observer : safe_sync_observer_list->observers) { observer.OnStoppingSync(version->version_id(), version->scope(), *start_worker_token); }
Loading diff…
Original Bug Report
reported by [email protected]
Security: Heap-use-after-free regression in ServiceWorkerContextCore::OnRunningStateChanged
Steps to reproduce the problem
- Apply
trigger.patchto Chromium and compile with ASAN enabled - Put
background.jsandmanifest.jsonat ext_poc folder. Run Chrome:./out/asan/chrome --no-sandbox --no-first-run --load-extension=/path/to/ext_poc - ASAN heap-use-after-free fires automatically after 2 seconds.
The trigger.patch adds a single line (wrapper_->Shutdown()) to simulate the destruction of ServiceWorkerContextCore during OnRunningStateChanged. This is the exact destruction path that occurs in production (confirmed by production crash reports and LLDB analysis in the original bug) when ServiceWorkerContextWrapper::Shutdown() is called while a synchronous observer loop is iterating over sync_observer_list_->observers.
Problem Description
Introduction
This is a regression of Bug 496389117. The original UAF was fixed twice:
-
Fix #1 (d819b4683ad8d, 2026-03-30): Held
scoped_refptr<ServiceWorkerContextWrapper>to keep the wrapper alive. This was a red herring — holding the wrapper does not preventShutdown()from callingcontext_core_.reset(), which destroys the core and its members. -
Fix #2 (7e3665aeacc7c, 2026-04-09): Correctly fixed the issue by copying
sync_observer_list_into a localsafe_sync_observer_listand iterating over the local copy. This ensures the observer list survives even ifthisis destroyed during iteration. -
Regression (d28abec927384, 2026-04-13): A follow-up commit to fix a CHECK failure changed the sync observer loops back from
safe_sync_observer_list->observerstosync_observer_list_->observers, silently reverting Fix #2. The local variablesafe_sync_observer_listis now dead code — it is assigned at line 1257 but never used.
Analysis
Vulnerability Summary
The vulnerability is a Use-After-Free (UAF) in ServiceWorkerContextCore::OnRunningStateChanged. When a service worker stops, the method iterates over sync_observer_list_->observers — a member of this. If an asynchronous observer callback (dispatched via observer_list_->Notify) triggers ServiceWorkerContextWrapper::Shutdown(), the core is destroyed (context_core_.reset()), and the subsequent access to this->sync_observer_list_ reads freed memory.
Current code (after regression d28abec927384):
void ServiceWorkerContextCore::OnRunningStateChanged(
ServiceWorkerVersion* version) {
// ...
scoped_refptr<ServiceWorkerContextSynchronousObserverList>
safe_sync_observer_list = sync_observer_list_; // [1] DEAD CODE — never used below
// ...
switch (version->running_status()) {
case blink::EmbeddedWorkerStatus::kStopped:
observer_list_->Notify(FROM_HERE,
&ServiceWorkerContextCoreObserver::OnStopped,
version->version_id());
// Shutdown() may be called during async notification above,
// destroying `this` (context_core_.reset())
if (start_worker_token.has_value()) {
for (auto& observer : sync_observer_list_->observers) { // [2] UAF — reads freed this->sync_observer_list_
observer.OnStoppedSync(...);
}
}
break;
case blink::EmbeddedWorkerStatus::kStopping:
// ...
if (start_worker_token.has_value()) {
for (auto& observer : sync_observer_list_->observers) { // [3] Same UAF
observer.OnStoppingSync(...);
}
}
break;
}
}
[1] https://source.chromium.org/chromium/chromium/src/+/main:content/browser/service_worker/service_worker_context_core.cc;l=1257;bpv=1 [1] https://source.chromium.org/chromium/chromium/src/+/main:content/browser/service_worker/service_worker_context_core.cc;l=1274;bpv=1 [1] https://source.chromium.org/chromium/chromium/src/+/main:content/browser/service_worker/service_worker_context_core.cc;l=1297;bpv=1
Bisect
- Original bug: Bug 496389117 (production crashes)
- Fix #1: d819b4683ad8d (2026-03-30) — incomplete fix (wrapper refcount is a red herring)
- Fix #2: 7e3665aeacc7c (2026-04-09) — correct fix (local
scoped_refptrcopy of observer list) - Regression introduced by: d28abec927384 (2026-04-13) — reverted Fix #2 by changing loop variables back to member access
- Affects Chrome DEV 149.0.7795.2
Summary
Security: Heap-use-after-free regression in ServiceWorkerContextCore::OnRunningStateChanged
Custom Questions
Type of crash:
browser
Crash state:
=================================================================
==384536==ERROR: AddressSanitizer: heap-use-after-free on address 0x7cecb04346f8 at pc 0x7f6d17c1fe4b bp 0x7ffc73d3d010 sp 0x7ffc73d3d008
READ of size 8 at 0x7cecb04346f8 thread T0 (chrome)
#0 0x7f6d17c1fe4a in content::ServiceWorkerContextCore::OnRunningStateChanged(content::ServiceWorkerVersion*) base/memory/scoped_refptr.h:293:12
#1 0x7f6d17e359c5 in content::ServiceWorkerVersion::OnStoppedInternal(blink::EmbeddedWorkerStatus) content/browser/service_worker/service_worker_version.cc:3134:14
#2 0x7f6d17b80122 in content::EmbeddedWorkerInstance::Detach() content/browser/service_worker/embedded_worker_instance.cc:751:14
#3 0x7f6d17b904d2 in base::internal::Invoker<base::internal::FunctorTraits<void (content::EmbeddedWorkerInstance::*&&)(), content::EmbeddedWorkerInstance*>, base::internal::BindState<true, true, false, void (content::EmbeddedWorkerInstance::*)(), base::internal::UnretainedWrapper<content::EmbeddedWorkerInstance, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
#4 0x7f6d33665136 in mojo::InterfaceEndpointClient::NotifyError(std::__Cr::optional<mojo::DisconnectReason> const&) base/functional/callback.h:155:12
#5 0x7f6d33687e4a in mojo::internal::MultiplexRouter::ProcessNotifyErrorTask(mojo::internal::MultiplexRouter::Task*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1116:13
#6 0x7f6d3367e5d5 in mojo::internal::MultiplexRouter::ProcessTasks(mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1024:15
#7 0x7f6d33678d32 in mojo::internal::MultiplexRouter::OnPipeConnectionError(bool) mojo/public/cpp/bindings/lib/multiplex_router.cc:930:3
#8 0x7f6d3368b3eb in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::internal::MultiplexRouter::*&&)(bool), mojo::internal::MultiplexRouter*, bool&&>, base::internal::BindState<true, true, false, void (mojo::internal::MultiplexRouter::*)(bool), base::internal::UnretainedWrapper<mojo::internal::MultiplexRouter, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, bool>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
#9 0x7f6d33649f55 in mojo::Connector::HandleError(bool, bool) base/functional/callback.h:155:12
#10 0x7f6d3364bf89 in mojo::Connector::OnWatcherHandleReady(char const*, unsigned int) mojo/public/cpp/bindings/lib/connector.cc
#11 0x7f6d3364eb51 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::Connector::* const&)(char const*, unsigned int), mojo::Connector*, char const* const&>, base::internal::BindState<true, true, false, void (mojo::Connector::*)(char const*, unsigned int), base::internal::UnretainedWrapper<mojo::Connector, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<char const, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int) base/functional/bind_internal.h:740:12
#12 0x7f6d3364e1fe in base::RepeatingCallback<void (unsigned int)>::Run(unsigned int) const & base/functional/callback.h:346:12
#13 0x7f6d3364dfb4 in base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&>, base::internal::BindState<false, true, false, void (*)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)>>, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase*, unsigned int, mojo::HandleSignalsState const&) base/functional/bind_internal.h:673:12
#14 0x7f6d33571770 in base::RepeatingCallback<void (unsigned int, mojo::HandleSignalsState const&)>::Run(unsigned int, mojo::HandleSignalsState const&) const & base/functional/callback.h:346:12
#15 0x7f6d3357114b in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) mojo/public/cpp/system/simple_watcher.cc:286:14
#16 0x7f6d335721b4 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::SimpleWatcher::*&&)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>&&, int&&, unsigned int&&, mojo::HandleSignalsState&&>, base::internal::BindState<true, true, false, void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
#17 0x7f6d350f4679 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
#18 0x7f6d3516e900 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
#19 0x7f6d3516d8d6 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
#20 0x7f6d35346f59 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:782:48
#21 0x7f6d3516ff53 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
#22 0x7f6d3505f792 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
#23 0x7f6d163184b3 in content::BrowserMainLoop::RunMainMessageLoop() content/browser/browser_main_loop.cc:1103:18
#24 0x7f6d16320726 in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner_impl.cc:151:15
#25 0x7f6d1630f965 in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:32:28
#26 0x7f6d197cec35 in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:697:10
#27 0x7f6d197d256d in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1332:10
#28 0x7f6d197d1ac6 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1162:12
#29 0x7f6d197cbfd3 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36
#30 0x7f6d197cc35a in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10
#31 0x557c8a226855 in ChromeMain chrome/app/chrome_main.cc:194:12
#32 0x7f6cbfed1082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
0x7cecb04346f8 is located 632 bytes inside of 816-byte region [0x7cecb0434480,0x7cecb04347b0)
freed by thread T0 (chrome) here:
#0 0x557c8a225502 in operator delete(void*, unsigned long) (/home/krace/fuzz/chromium/src/out/ui/chrome+0x67ff502) (BuildId: c0321228bd1952d6)
#1 0x7f6d17c437fe in content::ServiceWorkerContextWrapper::Shutdown() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
#2 0x7f6d17c1ec8f in content::ServiceWorkerContextCore::OnRunningStateChanged(content::ServiceWorkerVersion*) content/browser/service_worker/service_worker_context_core.cc:1268:17
#3 0x7f6d17e359c5 in content::ServiceWorkerVersion::OnStoppedInternal(blink::EmbeddedWorkerStatus) content/browser/service_worker/service_worker_version.cc:3134:14
#4 0x7f6d17b80122 in content::EmbeddedWorkerInstance::Detach() content/browser/service_worker/embedded_worker_instance.cc:751:14
#5 0x7f6d17b904d2 in base::internal::Invoker<base::internal::FunctorTraits<void (content::EmbeddedWorkerInstance::*&&)(), content::EmbeddedWorkerInstance*>, base::internal::BindState<true, true, false, void (content::EmbeddedWorkerInstance::*)(), base::internal::UnretainedWrapper<content::EmbeddedWorkerInstance, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
#6 0x7f6d33665136 in mojo::InterfaceEndpointClient::NotifyError(std::__Cr::optional<mojo::DisconnectReason> const&) base/functional/callback.h:155:12
#7 0x7f6d33687e4a in mojo::internal::MultiplexRouter::ProcessNotifyErrorTask(mojo::internal::MultiplexRouter::Task*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1116:13
#8 0x7f6d3367e5d5 in mojo::internal::MultiplexRouter::ProcessTasks(mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1024:15
#9 0x7f6d33678d32 in mojo::internal::MultiplexRouter::OnPipeConnectionError(bool) mojo/public/cpp/bindings/lib/multiplex_router.cc:930:3
#10 0x7f6d3368b3eb in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::internal::MultiplexRouter::*&&)(bool), mojo::internal::MultiplexRouter*, bool&&>, base::internal::BindState<true, true, false, void (mojo::internal::MultiplexRouter::*)(bool), base::internal::UnretainedWrapper<mojo::internal::MultiplexRouter, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, bool>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
#11 0x7f6d33649f55 in mojo::Connector::HandleError(bool, bool) base/functional/callback.h:155:12
#12 0x7f6d3364bf89 in mojo::Connector::OnWatcherHandleReady(char const*, unsigned int) mojo/public/cpp/bindings/lib/connector.cc
#13 0x7f6d3364eb51 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::Connector::* const&)(char const*, unsigned int), mojo::Connector*, char const* const&>, base::internal::BindState<true, true, false, void (mojo::Connector::*)(char const*, unsigned int), base::internal::UnretainedWrapper<mojo::Connector, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<char const, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int) base/functional/bind_internal.h:740:12
#14 0x7f6d3364e1fe in base::RepeatingCallback<void (unsigned int)>::Run(unsigned int) const & base/functional/callback.h:346:12
#15 0x7f6d3364dfb4 in base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&>, base::internal::BindState<false, true, false, void (*)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)>>, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase*, unsigned int, mojo::HandleSignalsState const&) base/functional/bind_internal.h:673:12
#16 0x7f6d33571770 in base::RepeatingCallback<void (unsigned int, mojo::HandleSignalsState const&)>::Run(unsigned int, mojo::HandleSignalsState const&) const & base/functional/callback.h:346:12
#17 0x7f6d3357114b in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) mojo/public/cpp/system/simple_watcher.cc:286:14
#18 0x7f6d335721b4 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::SimpleWatcher::*&&)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>&&, int&&, unsigned int&&, mojo::HandleSignalsState&&>, base::internal::BindState<true, true, false, void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
#19 0x7f6d350f4679 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
#20 0x7f6d3516e900 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
#21 0x7f6d3516d8d6 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
#22 0x7f6d35346f59 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:782:48
#23 0x7f6d3516ff53 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
#24 0x7f6d3505f792 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
#25 0x7f6d163184b3 in content::BrowserMainLoop::RunMainMessageLoop() content/browser/browser_main_loop.cc:1103:18
#26 0x7f6d16320726 in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner_impl.cc:151:15
#27 0x7f6d1630f965 in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:32:28
#28 0x7f6d197cec35 in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:697:10
#29 0x7f6d197d256d in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1332:10
previously allocated by thread T0 (chrome) here:
#0 0x557c8a2248fd in operator new(unsigned long) (/home/krace/fuzz/chromium/src/out/ui/chrome+0x67fe8fd) (BuildId: c0321228bd1952d6)
#1 0x7f6d17c432b0 in content::ServiceWorkerContextWrapper::InitInternal(storage::QuotaManagerProxy*, storage::SpecialStoragePolicy*, content::ChromeBlobStorageContext*, content::BrowserContext*) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26
#2 0x7f6d17f6e7d7 in content::StoragePartitionImpl::Initialize(content::StoragePartitionImpl*) content/browser/storage_partition_impl.cc:1439:28
#3 0x7f6d17fd35a4 in content::StoragePartitionImplMap::Get(content::StoragePartitionConfig const&, bool) content/browser/storage_partition_impl_map.cc:355:14
#4 0x7f6d1625d4ea in content::BrowserContext::GetDefaultStoragePartition() content/browser/browser_context.cc:151:52
#5 0x557c8ac86986 in extensions::CWSInfoService::CWSInfoService(content::BrowserContext*) extensions/browser/cws_info_service.cc:243:44
#6 0x557c8df7df89 in extensions::CWSInfoServiceFactory::BuildServiceInstanceForBrowserContext(content::BrowserContext*) const gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:30
#7 0x7f6d2a480d4c in KeyedServiceTemplatedFactory<KeyedService>::GetServiceForContext(void*, bool) components/keyed_service/core/keyed_service_templated_factory.cc:149:22
#8 0x7f6d2a478ddb in DependencyManager::CreateContextServices(void*, bool) components/keyed_service/core/dependency_manager.cc:125:16
#9 0x7f6d1ccda855 in BrowserContextDependencyManager::DoCreateBrowserContextServices(content::BrowserContext*, bool) components/keyed_service/content/browser_context_dependency_manager.cc:36:22
#10 0x557c925180bd in ProfileImpl::OnLocaleReady(Profile::CreateMode) chrome/browser/profiles/profile_impl.cc:1139:51
#11 0x557c92513191 in ProfileImpl::OnPrefsLoaded(Profile::CreateMode, bool) chrome/browser/profiles/profile_impl.cc:1179:3
#12 0x557c925115ca in ProfileImpl::ProfileImpl(base::FilePath const&, Profile::Delegate*, Profile::CreateMode, base::Time, scoped_refptr<base::SequencedTaskRunner>) chrome/browser/profiles/profile_impl.cc:545:5
#13 0x557c92510194 in Profile::CreateProfile(base::FilePath const&, Profile::Delegate*, Profile::CreateMode) chrome/browser/profiles/profile_impl.cc:378:59
#14 0x557c91183afe in ProfileManager::CreateProfileHelper(base::FilePath const&) chrome/browser/profiles/profile_manager.cc:1327:10
#15 0x557c91193e87 in base::internal::Invoker<base::internal::FunctorTraits<std::__Cr::unique_ptr<Profile, std::__Cr::default_delete<Profile>> (ProfileManager::*&&)(base::FilePath const&), ProfileManager*>, base::internal::BindState<true, true, false, std::__Cr::unique_ptr<Profile, std::__Cr::default_delete<Profile>> (ProfileManager::*)(base::FilePath const&), base::internal::UnretainedWrapper<ProfileManager, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, std::__Cr::unique_ptr<Profile, std::__Cr::default_delete<Profile>> (base::FilePath const&)>::RunOnce(base::internal::BindStateBase*, base::FilePath const&) base/functional/bind_internal.h:740:12
#16 0x557c9117bbfb in ProfileManager::CreateAndInitializeProfile(base::FilePath const&, base::OnceCallback<std::__Cr::unique_ptr<Profile, std::__Cr::default_delete<Profile>> (base::FilePath const&)>) base/functional/callback.h:155:12
#17 0x557c911790f3 in ProfileManager::GetProfile(base::FilePath const&) chrome/browser/profiles/profile_manager.cc:807:10
#18 0x557c8f626ca4 in GetStartupProfile(base::FilePath const&, base::CommandLine const&) chrome/browser/ui/startup/startup_browser_creator.cc:1705:39
#19 0x557c923e2eb3 in ChromeBrowserMainParts::PreMainMessageLoopRunImpl() chrome/browser/chrome_browser_main.cc:459:7
#20 0x557c923e22f4 in ChromeBrowserMainParts::PreMainMessageLoopRun() chrome/browser/chrome_browser_main.cc:1463:18
#21 0x7f6d16315c7a in content::BrowserMainLoop::PreMainMessageLoopRun() content/browser/browser_main_loop.cc:1003:28
#22 0x7f6d1631cfb2 in base::internal::Invoker<base::internal::FunctorTraits<int (content::BrowserMainLoop::*&&)(), content::BrowserMainLoop*>, base::internal::BindState<true, true, false, int (content::BrowserMainLoop::*)(), base::internal::UnretainedWrapper<content::BrowserMainLoop, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
#23 0x7f6d17f5e36d in content::StartupTaskRunner::RunAllTasksNow(bool) base/functional/callback.h:155:12
#24 0x7f6d16314b6b in content::BrowserMainLoop::CreateStartupTasks() content/browser/browser_main_loop.cc:909:25
#25 0x7f6d1631fe97 in content::BrowserMainRunnerImpl::Initialize(content::MainFunctionParams) content/browser/browser_main_runner_impl.cc:138:15
#26 0x7f6d1630f90c in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:28:32
#27 0x7f6d197cec35 in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:697:10
#28 0x7f6d197d256d in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1332:10
#29 0x7f6d197d1ac6 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1162:12
SUMMARY: AddressSanitizer: heap-use-after-free base/memory/scoped_refptr.h:293:12 in content::ServiceWorkerContextCore::OnRunningStateChanged(content::ServiceWorkerVersion*)
Shadow bytes around the buggy address:
0x7cecb0434400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
0x7cecb0434480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x7cecb0434500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x7cecb0434580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x7cecb0434600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7cecb0434680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]
0x7cecb0434700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x7cecb0434780: fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa
0x7cecb0434800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
0x7cecb0434880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7cecb0434900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==384536==ADDITIONAL INFO
==384536==Note: Please include this section with the ASan report.
Task trace:
#0 0x7f6d33570100 in mojo::SimpleWatcher::ArmOrNotify() mojo/public/cpp/system/simple_watcher.cc:245:28
#1 0x7f6d3364cf96 in mojo::Connector::ScheduleDispatchOfPendingMessagesOrWaitForMore(unsigned long) mojo/public/cpp/bindings/lib/connector.cc:588:7
#2 0x7f6d33571b6a in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) mojo/public/cpp/system/simple_watcher.cc:103:13
Command line: `./out/ui/chrome --user-data-dir=/tmp/noexist2 --trigger-sw-context-uaf --load-extension=webnn_tmp/service_worker/ext_poc --ozone-platform=x11 --flag-switches-begin --flag-switches-end`
MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.
==384536==END OF ADDITIONAL INFO
==384536==ABORTING
Additional Data
Category: Security
Chrome Channel: Not sure
Regression: N/A \
- https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md
- https://issuetracker.google.com/issues/496389117
- https://source.chromium.org/chromium/chromium/src/+/main:content/browser/service_worker/service_worker_context_core.cc;l=1257;bpv=1
- https://source.chromium.org/chromium/chromium/src/+/main:content/browser/service_worker/service_worker_context_core.cc;l=1274;bpv=1
- https://source.chromium.org/chromium/chromium/src/+/main:content/browser/service_worker/service_worker_context_core.cc;l=1297;bpv=1
References
On This Page