Low chrome UAF 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactUse after free in Chrome for iOS
DescriptionUse after free in Chrome for iOS
ComponentChrome for iOS
Bug ClassUAF
Tracker513382161
Fix commit2cb93324a67e (chromium/src) +7/-6
CISA KEVNot listed
CreditedGoogle
Disclosed2026-06-30

Files Changed

  • ios/chrome/browser/home_customization/ui/home_customization_background_preset_gallery_picker_view_controller.mm
From 2cb93324a67eb7811a82f257cb341fbb185a9a9c Mon Sep 17 00:00:00 2001
From: Robbie Gibson <[email protected]>
Date: Tue, 19 May 2026 12:37:13 -0700
Subject: [PATCH] [iOS] Fix thread-safety race condition in home customization

`-prepareForDisplayWithCompletionHandler:`'s completion handler is
called on a private background queue. Thus, the modification to
_inProgressImageFetches should be done back on the main thread.

Also, there was an issue where the parameter for the handler was
omitted, so this CL fixes that too.

Bug: b:513382161
Change-Id: I53a865285e4c08b8576cc53eb6de5e3927e915ad
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7857310
Commit-Queue: Robbie Gibson <[email protected]>
Reviewed-by: Pier-Alexandre Bouchard <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1633059}
---

diff --git a/ios/chrome/browser/home_customization/ui/home_customization_background_preset_gallery_picker_view_controller.mm b/ios/chrome/browser/home_customization/ui/home_customization_background_preset_gallery_picker_view_controller.mm
index ea368970..9641dea 100644
--- a/ios/chrome/browser/home_customization/ui/home_customization_background_preset_gallery_picker_view_controller.mm
+++ b/ios/chrome/browser/home_customization/ui/home_customization_background_preset_gallery_picker_view_controller.mm
@@ -434,8 +434,12 @@
   }
 
   __weak __typeof(self) weakSelf = self;
-  [image prepareForDisplayWithCompletionHandler:^(UIImage*) {
-    [weakSelf imagePreparedForDisplay:image itemIdentifier:itemIdentifier];
+  [image prepareForDisplayWithCompletionHandler:^(UIImage* preparedImage) {
+    dispatch_async(dispatch_get_main_queue(), ^{
+      UIImage* finalImage = preparedImage ? preparedImage : image;
+      [weakSelf imagePreparedForDisplay:finalImage
+                         itemIdentifier:itemIdentifier];
+    });
   }];
 }
 
@@ -449,10 +453,7 @@
 
   [_preparedImageCache setObject:image forKey:itemIdentifier];
 
-  __weak __typeof(self) weakSelf = self;
-  dispatch_async(dispatch_get_main_queue(), ^{
-    [weakSelf setImage:image forCellWithItemIdentifier:itemIdentifier];
-  });
+  [self setImage:image forCellWithItemIdentifier:itemIdentifier];
 }
 
 // Updates the cell for the given identifier to the provided image.
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.