Chrome · Chrome for iOS
CVE-2026-14067
UAF in Chrome for iOS
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.hios/chrome/browser/cobrowse/model/cobrowse_tab_helper.mm
Patch
From f0f9e117d5679d96bba3ee4441af01cc442192a2 Mon Sep 17 00:00:00 2001 From: Matt Reichhoff <[email protected]> Date: Tue, 05 May 2026 08:27:59 -0700 Subject: [PATCH] [iOS] Add weak pointer in cobrowse Bug: 504069465 Change-Id: I6673efc8bbd93ac491f6641749dca7a6cbb3624c Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7810694 Reviewed-by: Stepan Khapugin <[email protected]> Commit-Queue: Matt Reichhoff <[email protected]> Cr-Commit-Position: refs/heads/main@{#1625447} --- diff --git a/ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.h b/ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.h index 02cfe2f..99d5f2e 100644 --- a/ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.h +++ b/ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.h @@ -6,6 +6,7 @@ #define IOS_CHROME_BROWSER_COBROWSE_MODEL_COBROWSE_TAB_HELPER_H_ #import "base/memory/raw_ptr.h" +#import "base/memory/weak_ptr.h" #import "base/scoped_observation.h" #import "ios/web/public/web_state_observer.h" #import "ios/web/public/web_state_user_data.h" @@ -58,6 +59,9 @@ // Returns whether the assistant should be hidden for `url`. bool ShouldHideAssistantForURL(const GURL& url); + // Triggers the showing of the assistant. + void ShowAssistant(); + // The delegate for this tab helper. raw_ptr<Delegate> delegate_ = nullptr; @@ -70,6 +74,8 @@ // Scoped observation for the WebState. base::ScopedObservation<web::WebState, web::WebStateObserver> observation_{ this}; + + base::WeakPtrFactory<CobrowseTabHelper> weak_ptr_factory_{this}; }; #endif // IOS_CHROME_BROWSER_COBROWSE_MODEL_COBROWSE_TAB_HELPER_H_ diff --git a/ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.mm b/ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.mm index 464f6617..4ed41d4 100644 --- a/ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.mm +++ b/ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.mm @@ -51,9 +51,8 @@ // established before showing the assistant. This avoids crashes during // transitions (e.g., from Tab Grid to Browser). base::SequencedTaskRunner::GetCurrentDefault()->PostTask( - FROM_HERE, base::BindOnce(^{ - [scene_handler_ showAssistant]; - })); + FROM_HERE, base::BindOnce(&CobrowseTabHelper::ShowAssistant, + weak_ptr_factory_.GetWeakPtr())); } } @@ -100,3 +99,7 @@ return false; } + +void CobrowseTabHelper::ShowAssistant() { + [scene_handler_ showAssistant]; +}
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page