Low chrome UAF 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactUse after free in Chrome for iOS
DescriptionUse after free in Chrome for iOS
ComponentChrome for iOS
Bug ClassUAF
Tracker504069465
Fix commitf0f9e117d567 (chromium/src) +12/-3
CISA KEVNot listed
CreditedGoogle
Disclosed2026-06-30

Files Changed

  • ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.h
  • ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.mm
From f0f9e117d5679d96bba3ee4441af01cc442192a2 Mon Sep 17 00:00:00 2001
From: Matt Reichhoff <[email protected]>
Date: Tue, 05 May 2026 08:27:59 -0700
Subject: [PATCH] [iOS] Add weak pointer in cobrowse

Bug: 504069465
Change-Id: I6673efc8bbd93ac491f6641749dca7a6cbb3624c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7810694
Reviewed-by: Stepan Khapugin <[email protected]>
Commit-Queue: Matt Reichhoff <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1625447}
---

diff --git a/ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.h b/ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.h
index 02cfe2f..99d5f2e 100644
--- a/ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.h
+++ b/ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.h
@@ -6,6 +6,7 @@
 #define IOS_CHROME_BROWSER_COBROWSE_MODEL_COBROWSE_TAB_HELPER_H_
 
 #import "base/memory/raw_ptr.h"
+#import "base/memory/weak_ptr.h"
 #import "base/scoped_observation.h"
 #import "ios/web/public/web_state_observer.h"
 #import "ios/web/public/web_state_user_data.h"
@@ -58,6 +59,9 @@
   // Returns whether the assistant should be hidden for `url`.
   bool ShouldHideAssistantForURL(const GURL& url);
 
+  // Triggers the showing of the assistant.
+  void ShowAssistant();
+
   // The delegate for this tab helper.
   raw_ptr<Delegate> delegate_ = nullptr;
 
@@ -70,6 +74,8 @@
   // Scoped observation for the WebState.
   base::ScopedObservation<web::WebState, web::WebStateObserver> observation_{
       this};
+
+  base::WeakPtrFactory<CobrowseTabHelper> weak_ptr_factory_{this};
 };
 
 #endif  // IOS_CHROME_BROWSER_COBROWSE_MODEL_COBROWSE_TAB_HELPER_H_
diff --git a/ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.mm b/ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.mm
index 464f6617..4ed41d4 100644
--- a/ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.mm
+++ b/ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.mm
@@ -51,9 +51,8 @@
     // established before showing the assistant. This avoids crashes during
     // transitions (e.g., from Tab Grid to Browser).
     base::SequencedTaskRunner::GetCurrentDefault()->PostTask(
-        FROM_HERE, base::BindOnce(^{
-          [scene_handler_ showAssistant];
-        }));
+        FROM_HERE, base::BindOnce(&CobrowseTabHelper::ShowAssistant,
+                                  weak_ptr_factory_.GetWeakPtr()));
   }
 }
 
@@ -100,3 +99,7 @@
 
   return false;
 }
+
+void CobrowseTabHelper::ShowAssistant() {
+  [scene_handler_ showAssistant];
+}
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.