Chrome · Chrome for iOS
CVE-2026-14099
UAF in Chrome for iOS
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
ios/chrome/browser/home_customization/ui/home_customization_background_preset_gallery_picker_view_controller.mm
Patch
From 2cb93324a67eb7811a82f257cb341fbb185a9a9c Mon Sep 17 00:00:00 2001 From: Robbie Gibson <[email protected]> Date: Tue, 19 May 2026 12:37:13 -0700 Subject: [PATCH] [iOS] Fix thread-safety race condition in home customization `-prepareForDisplayWithCompletionHandler:`'s completion handler is called on a private background queue. Thus, the modification to _inProgressImageFetches should be done back on the main thread. Also, there was an issue where the parameter for the handler was omitted, so this CL fixes that too. Bug: b:513382161 Change-Id: I53a865285e4c08b8576cc53eb6de5e3927e915ad Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7857310 Commit-Queue: Robbie Gibson <[email protected]> Reviewed-by: Pier-Alexandre Bouchard <[email protected]> Cr-Commit-Position: refs/heads/main@{#1633059} --- diff --git a/ios/chrome/browser/home_customization/ui/home_customization_background_preset_gallery_picker_view_controller.mm b/ios/chrome/browser/home_customization/ui/home_customization_background_preset_gallery_picker_view_controller.mm index ea368970..9641dea 100644 --- a/ios/chrome/browser/home_customization/ui/home_customization_background_preset_gallery_picker_view_controller.mm +++ b/ios/chrome/browser/home_customization/ui/home_customization_background_preset_gallery_picker_view_controller.mm @@ -434,8 +434,12 @@ } __weak __typeof(self) weakSelf = self; - [image prepareForDisplayWithCompletionHandler:^(UIImage*) { - [weakSelf imagePreparedForDisplay:image itemIdentifier:itemIdentifier]; + [image prepareForDisplayWithCompletionHandler:^(UIImage* preparedImage) { + dispatch_async(dispatch_get_main_queue(), ^{ + UIImage* finalImage = preparedImage ? preparedImage : image; + [weakSelf imagePreparedForDisplay:finalImage + itemIdentifier:itemIdentifier]; + }); }]; } @@ -449,10 +453,7 @@ [_preparedImageCache setObject:image forKey:itemIdentifier]; - __weak __typeof(self) weakSelf = self; - dispatch_async(dispatch_get_main_queue(), ^{ - [weakSelf setImage:image forCellWithItemIdentifier:itemIdentifier]; - }); + [self setImage:image forCellWithItemIdentifier:itemIdentifier]; } // Updates the cell for the given identifier to the provided image.
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page