From ae4f685af9b9030f101a4deab88fb453485a5c10 Mon Sep 17 00:00:00 2001
From: Kim-Anh Tran <[email protected]>
Date: Mon, 08 Jun 2026 11:00:19 +0200
Subject: [PATCH] [inspector] Fix Session UAF by hoisting KeepSessionAliveScope into forEachSession

This fixes a Use-After-Free (UAF) vulnerability where the V8 inspector
session is synchronously disconnected/destroyed mid-execution.

By instantiating KeepSessionAliveScope inside
V8InspectorImpl::forEachSession, we ensure that a strong reference to
any active session is kept on the C++ stack during agent callbacks.

Bug: 516763884
Change-Id: Ibe04e6a000a93633fdf8052a0f453a02c55af74f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7878304
Reviewed-by: Simon Zünd <[email protected]>
Commit-Queue: Kim-Anh Tran <[email protected]>
Cr-Commit-Position: refs/heads/main@{#108306}
---

diff --git a/src/inspector/v8-inspector-impl.cc b/src/inspector/v8-inspector-impl.cc
index dbca2be..4fd23c1 100644
--- a/src/inspector/v8-inspector-impl.cc
+++ b/src/inspector/v8-inspector-impl.cc
@@ -519,7 +519,11 @@
     it = m_sessions.find(contextGroupId);
     if (it == m_sessions.end()) continue;
     auto sessionIt = it->second.find(sessionId);
-    if (sessionIt != it->second.end()) callback(sessionIt->second);
+    if (sessionIt != it->second.end()) {
+      V8InspectorSessionImpl::KeepSessionAliveScope keepAlive(
+          *sessionIt->second);
+      callback(sessionIt->second);
+    }
   }
 }
 
diff --git a/src/inspector/v8-inspector-session-impl.h b/src/inspector/v8-inspector-session-impl.h
index cd80878..15bf420 100644
--- a/src/inspector/v8-inspector-session-impl.h
+++ b/src/inspector/v8-inspector-session-impl.h
@@ -77,6 +77,21 @@
                         v8::Local<v8::Context>*, String16* objectGroup);
   void releaseObjectGroup(const String16& objectGroup);
 
+  // Turns the weakThis reference into a strong one so nested run loops or
+  // synchronous session detachment (e.g., during JS re-entrancy) cannot fully
+  // deconstruct the V8 session until any active call (such as
+  // dispatchProtocolMessage or forEachSession) fully unwinds from the stack.
+  class KeepSessionAliveScope {
+    CPPGC_STACK_ALLOCATED();
+
+   public:
+    explicit KeepSessionAliveScope(const V8InspectorSessionImpl& session)
+        : m_this(session.m_weakThis.lock()) {}
+
+   private:
+    std::shared_ptr<V8InspectorSessionImpl> m_this;
+  };
+
   // V8InspectorSession implementation.
   void dispatchProtocolMessage(StringView message,
                                StringView associated_data) override;
@@ -155,20 +170,7 @@
   bool use_binary_protocol_ = false;
   V8Inspector::ClientTrustLevel m_clientTrustLevel = V8Inspector::kUntrusted;
 
-  // On each call to "dispatchProtocolMessage", the session turns the weakThis
-  // reference into a strong one, so nested run loops are not able to fully
-  // deconstruct the V8 session until we return from the
-  // "dispatchProtocolMessage" call (i.e. no freed "this" remains on the stack).
-  class KeepSessionAliveScope {
-    CPPGC_STACK_ALLOCATED();
 
-   public:
-    explicit KeepSessionAliveScope(const V8InspectorSessionImpl& session)
-        : m_this(session.m_weakThis.lock()) {}
-
-   private:
-    std::shared_ptr<V8InspectorSessionImpl> m_this;
-  };
   std::weak_ptr<V8InspectorSessionImpl> m_weakThis;
 };
 
diff --git a/test/inspector/inspector-test.cc b/test/inspector/inspector-test.cc
index 1c033e4..dde746a 100644
--- a/test/inspector/inspector-test.cc
+++ b/test/inspector/inspector-test.cc
@@ -673,6 +673,9 @@
     inspector->Set(isolate, "runNestedMessageLoop",
                    v8::FunctionTemplate::New(
                        isolate, &InspectorExtension::RunNestedMessageLoop));
+    inspector->Set(isolate, "disconnectSession",
+                   v8::FunctionTemplate::New(
+                       isolate, &InspectorExtension::DisconnectSession));
     global->Set(isolate, "inspector", inspector);
   }
 
@@ -961,6 +964,17 @@
 
     data->task_runner()->RunMessageLoop(true);
   }
+
+  static void DisconnectSession(
+      const v8::FunctionCallbackInfo<v8::Value>& info) {
+    if (info.Length() != 1 || !info[0]->IsInt32()) {
+      FATAL("Internal error: disconnectSession(session_id).");
+    }
+    v8::Local<v8::Context> context = info.GetIsolate()->GetCurrentContext();
+    InspectorIsolateData* data = InspectorIsolateData::FromContext(context);
+    data->DisconnectSession(info[0].As<v8::Int32>()->Value(),
+                            data->task_runner());
+  }
 };
 
 int InspectorTestMain(int argc, char* argv[]) {
diff --git a/test/inspector/runtime/session-disconnect-uaf-expected.txt b/test/inspector/runtime/session-disconnect-uaf-expected.txt
new file mode 100644
index 0000000..6521d63
--- /dev/null
+++ b/test/inspector/runtime/session-disconnect-uaf-expected.txt
@@ -0,0 +1,3 @@
+Tests that disconnecting session synchronously during argument wrapping does not cause UAF
+prepareStackTrace called
+Did not crash
diff --git a/test/inspector/runtime/session-disconnect-uaf.js b/test/inspector/runtime/session-disconnect-uaf.js
new file mode 100644
index 0000000..ada930d
--- /dev/null
+++ b/test/inspector/runtime/session-disconnect-uaf.js
@@ -0,0 +1,36 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} = InspectorTest.start(
+    'Tests that disconnecting session synchronously during argument wrapping does not cause UAF');
+
+let session2 = contextGroup.connect();
+
+session2.Protocol.Runtime.enable();
+session2.Protocol.Runtime.onConsoleAPICalled(function(result) {
+  if (result.params.args[0].value == "prepareStackTrace called") {
+    InspectorTest.log("prepareStackTrace called");
+    session2.Protocol.Runtime.evaluate({ expression: 'console.log("End of test")' });
+  }
+  if (result.params.args[0].value == "End of test") {
+    InspectorTest.log("Did not crash");
+    InspectorTest._sessions.delete(session);
+    InspectorTest.completeTest();
+  }
+});
+
+Protocol.Runtime.enable();
+Protocol.Runtime.evaluate({
+  expression: `
+    Error.prepareStackTrace = function(error, stack) {
+      console.log("prepareStackTrace called");
+      inspector.disconnectSession(${session.id});
+      return stack;
+    };
+    setTimeout(function() {
+      const err = new Error("Trigger UAF");
+      console.log(err);
+    }, 0);
+  `
+});