CVE-2026-6297

Critical chrome UAF 📄 Reporter bug report 🔧 Commit mapped

Overview

Critical

Severity

—

CVSS

Exploited ITW

Fixed

Fix Status

ImpactUse after free in Proxy

DescriptionUse after free in Proxy

ComponentProxy

Bug ClassUAF

Tracker493628982

Fix commit4073d491fb55 (chromium/src) +101/-5

CISA KEVNot listed

Creditedheapracer

Disclosed2026-04-15

Changed Functions

Function	Change	Notes
`BindOnce` net/spdy/spdy_session_unittest.cc	modified

Files Changed

net/socket/socket_test_util.cc
net/socket/socket_test_util.h
net/spdy/spdy_session.cc
net/spdy/spdy_session.h
net/spdy/spdy_session_unittest.cc

Patch

view commit

From 4073d491fb559e9efe56759b92dfe387f490ed5a Mon Sep 17 00:00:00 2001
From: Matt Menke <[email protected]>
Date: Fri, 27 Mar 2026 09:19:35 -0700
Subject: [PATCH] Make SpdySession::CreateStream() call DoDrainSession() asynchronously.

Calling it synchronously would tear down all SpdyStreams immediately,
informing their consumers of the error. This could have side effects
that affect the caller trying to create the stream, so was unsafe.

This does introduce a state where a SpdySession is going away, but
neither DoDrainSession() nor StartGoingAway() was invoked. The
SpdySession never reached such a state before this CL, but this state
was used before - when there was a network change, we used to move
SpdySessions into such a state. This behavior was removed because we
ended up never actually closing those sockets, which could effectively
blackhole a destination. Since this CL posts a task to drain the
session, that shouldn't happen here.

The code is robust against extra DoDrainSession() calls, so it should
be fine if the session discovers through another path it should start
draining or otherwise going away,

Bug: 493628982
Change-Id: I23f1517b67fb55edd50d6e8fc8f1b4d8328e8ec5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7701714
Reviewed-by: Kenichi Ishibashi <[email protected]>
Commit-Queue: mmenke <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1606281}
---

diff --git a/net/socket/socket_test_util.cc b/net/socket/socket_test_util.cc
index aee8b6b..b3aedad 100644
--- a/net/socket/socket_test_util.cc
+++ b/net/socket/socket_test_util.cc
@@ -1258,7 +1258,7 @@
 bool MockTCPClientSocket::IsConnected() const {
   if (!data_)
     return false;
-  return connected_ && !peer_closed_connection_;
+  return connected_ && !peer_closed_connection_ && !data_->silently_closed();
 }
 
 bool MockTCPClientSocket::IsConnectedAndIdle() const {
diff --git a/net/socket/socket_test_util.h b/net/socket/socket_test_util.h
index 4c342ac8..b16e08dc 100644
--- a/net/socket/socket_test_util.h
+++ b/net/socket/socket_test_util.h
@@ -451,6 +451,12 @@
   MockConnect connect_data() const { return connect_; }
   void set_connect_data(const MockConnect& connect) { connect_ = connect; }
 
+  // Makes IsConnected() start returning false for any socket using `this`,
+  // without any read or write error. Useful for simulating cases where an
+  // IsConnected() call is the first time a socket is revealed to be closed.
+  void set_silently_closed() { silently_closed_ = true; }
+  bool silently_closed() const { return silently_closed_; }
+
  private:
   // Called to inform subclasses of initialization.
   virtual void Reset() = 0;
@@ -463,6 +469,8 @@
   // This reflects the default state of TCPClientSockets.
   bool no_delay_ = true;
 
+  bool silently_closed_ = false;
+
   KeepAliveState keep_alive_state_ = KeepAliveState::kDefault;
   int keep_alive_delay_ = 0;
 
diff --git a/net/spdy/spdy_session.cc b/net/spdy/spdy_session.cc
index a02c75e..8be9156 100644
--- a/net/spdy/spdy_session.cc
+++ b/net/spdy/spdy_session.cc
@@ -1720,7 +1720,9 @@
   UMA_HISTOGRAM_BOOLEAN("Net.SpdySession.CreateStreamWithSocketConnected",
                         socket_->IsConnected());
   if (!socket_->IsConnected()) {
-    DoDrainSession(
+    // Since there may be a consumer of the session on the stack, can't call
+    // DoDrainSession() synchronously, as it may result in reentrancy.
+    DoDrainSessionAsync(
         ERR_CONNECTION_CLOSED,
         "Tried to create SPDY stream for a closed socket connection.");
     return ERR_CONNECTION_CLOSED;
@@ -2725,6 +2727,23 @@
   MaybePostWriteLoop();
 }
 
+void SpdySession::DoDrainSessionAsync(Error err,
+                                      std::string description,
+                                      bool force_send_go_away) {
+  // Make this unavailable to prevent consumers from pulling it from the session
+  // pool again, which could result in an infinite loop, or otherwise running
+  // into this error again rather than trying a new connection.
+  MakeUnavailable(err);
+
+  // This will close the socket and inform consumers asynchronously. If
+  // something happens before this task runs (like a read error), that should
+  // not cause issues, since DoDrainSession() does nothing if already draining.
+  base::SingleThreadTaskRunner::GetCurrentDefault()->PostTask(
+      FROM_HERE,
+      base::BindOnce(&SpdySession::DoDrainSession, weak_factory_.GetWeakPtr(),
+                     err, std::move(description), force_send_go_away));
+}
+
 void SpdySession::LogAbandonedStream(SpdyStream* stream, Error status) {
   DCHECK(stream);
   stream->LogStreamError(status, "Abandoned.");
diff --git a/net/spdy/spdy_session.h b/net/spdy/spdy_session.h
index c211f813..baad481 100644
--- a/net/spdy/spdy_session.h
+++ b/net/spdy/spdy_session.h
@@ -876,6 +876,15 @@
                       const std::string& description,
                       bool force_send_go_away = false);
 
+  // Immediately marks a session as unavailable, to prevent reuse, and posts a
+  // task to call DoDrainSession (if the session is drained for some other
+  // reason in the meantime, that is fine). This should be used instead of
+  // DoDrainSession when there may be a consumer of the SpdySession on the
+  // stack, so as to avoid reentrancy.
+  void DoDrainSessionAsync(Error err,
+                           std::string description,
+                           bool force_send_go_away = false);
+
   // Called right before closing a (possibly-inactive) stream for a
   // reason other than being requested to by the stream.
   void LogAbandonedStream(SpdyStream* stream, Error status);
diff --git a/net/spdy/spdy_session_unittest.cc b/net/spdy/spdy_session_unittest.cc
index 8882c20..2e00c65 100644
--- a/net/spdy/spdy_session_unittest.cc
+++ b/net/spdy/spdy_session_unittest.cc
@@ -980,10 +980,14 @@
   EXPECT_TRUE(session_->IsStreamActive(1));
 
   SpdyStreamRequest stream_request;
+  // Note that `can_send_early` is needed to bypass confirming the handshake. If
+  // this regresses, may need to do what other tests to, and use
+  // CreateStreamSynchronously() to create an initial SpdyStream and set up the
+  // socket.
   int rv = stream_request.StartRequest(
-      SPDY_REQUEST_RESPONSE_STREAM, session_, test_url_, false, MEDIUM,
-      SocketTag(), NetLogWithSource(), CompletionOnceCallback(),
-      TRAFFIC_ANNOTATION_FOR_TESTS);
+      SPDY_REQUEST_RESPONSE_STREAM, session_, test_url_,
+      /*can_send_early=*/true, MEDIUM, SocketTag(), NetLogWithSource(),
+      CompletionOnceCallback(), TRAFFIC_ANNOTATION_FOR_TESTS);
   EXPECT_THAT(rv, IsError(ERR_FAILED));
 
   EXPECT_TRUE(session_);
@@ -2930,6 +2934,62 @@
   EXPECT_EQ(0u, pending_create_stream_queue_size(LOWEST));
 }
 
+// Check that SpdyStreamRequest::StartRequest() does not synchronously notify
+// live streams of their destruction when it notices the socket has been closed.
+// This can racily happen when a new request occurs before a read error from the
+// socket is processed. This synchronously informing other streams of their
+// destruction could result in modifying objects that are on the top of the
+// callstack due to shared state, which can lead to bugs.
+TEST_F(SpdySessionTest,
+       SpdyStreamRequestStartRequestAsynchronouslyNotifiesOtherStreams) {
+  StaticSocketDataProvider data;
+  session_deps_.socket_factory->AddSocketDataProvider(&data);
+  AddSSLSocketData();
+
+  CreateNetworkSession();
+  CreateSpdySession();
+
+  // Create a stream on the session, and set up a delegate to watch it.
+  base::WeakPtr<SpdyStream> spdy_stream =
+      CreateStreamSynchronously(SPDY_REQUEST_RESPONSE_STREAM, session_,
+                                test_url_, MEDIUM, NetLogWithSource());
+  test::StreamDelegateDoNothing delegate(spdy_stream);
+  spdy_stream->SetDelegate(&delegate);
+
+  // Close the socket, without a read/write event, to simulate the
+  // StartRequest() being the first call to notice the socket is closed.
+  data.set_silently_closed();
+
+  // Start a StreamRequest request. Note that `can_send_early` must be true to
+  // avoid calling MockSSLClientSocket::ConfirmHandshake(), will cause the
+  // request not to check the state of the connection, while it waits for the
+  // SSL handshake to be confirmed (that handshake confirmation check will also
+  // cause the MockSSLClientSocket to CHECK, if it happens, as the socket is
+  // closed).
+  SpdyStreamRequest request;
+  int rv = request.StartRequest(
+      SPDY_REQUEST_RESPONSE_STREAM, session_, test_url_,
+      /*can_send_early=*/true, LOWEST, SocketTag(), NetLogWithSource(),
+      base::BindOnce([](int result) {
+        ADD_FAILURE()
+            << "Callback should not be invoked on synchronous completion";
+      }),
+      TRAFFIC_ANNOTATION_FOR_TESTS);
+  // The request should synchronously fail.
+  EXPECT_THAT(rv, IsError(ERR_CONNECTION_CLOSED));
+
+  // The session should be flagged as going away, and should no longer be
+  // available but should still exist.

Loading diff…

Regression Test / PoC

shipped with the fix

diff --git a/net/spdy/spdy_session_unittest.cc b/net/spdy/spdy_session_unittest.cc
index 8882c20..2e00c65 100644
--- a/net/spdy/spdy_session_unittest.cc
+++ b/net/spdy/spdy_session_unittest.cc
@@ -980,10 +980,14 @@
   EXPECT_TRUE(session_->IsStreamActive(1));
 
   SpdyStreamRequest stream_request;
+  // Note that `can_send_early` is needed to bypass confirming the handshake. If
+  // this regresses, may need to do what other tests to, and use
+  // CreateStreamSynchronously() to create an initial SpdyStream and set up the
+  // socket.
   int rv = stream_request.StartRequest(
-      SPDY_REQUEST_RESPONSE_STREAM, session_, test_url_, false, MEDIUM,
-      SocketTag(), NetLogWithSource(), CompletionOnceCallback(),
-      TRAFFIC_ANNOTATION_FOR_TESTS);
+      SPDY_REQUEST_RESPONSE_STREAM, session_, test_url_,
+      /*can_send_early=*/true, MEDIUM, SocketTag(), NetLogWithSource(),
+      CompletionOnceCallback(), TRAFFIC_ANNOTATION_FOR_TESTS);
   EXPECT_THAT(rv, IsError(ERR_FAILED));
 
   EXPECT_TRUE(session_);
@@ -2930,6 +2934,62 @@
   EXPECT_EQ(0u, pending_create_stream_queue_size(LOWEST));
 }
 
+// Check that SpdyStreamRequest::StartRequest() does not synchronously notify
+// live streams of their destruction when it notices the socket has been closed.
+// This can racily happen when a new request occurs before a read error from the
+// socket is processed. This synchronously informing other streams of their
+// destruction could result in modifying objects that are on the top of the
+// callstack due to shared state, which can lead to bugs.
+TEST_F(SpdySessionTest,
+       SpdyStreamRequestStartRequestAsynchronouslyNotifiesOtherStreams) {
+  StaticSocketDataProvider data;
+  session_deps_.socket_factory->AddSocketDataProvider(&data);
+  AddSSLSocketData();
+
+  CreateNetworkSession();
+  CreateSpdySession();
+
+  // Create a stream on the session, and set up a delegate to watch it.
+  base::WeakPtr<SpdyStream> spdy_stream =
+      CreateStreamSynchronously(SPDY_REQUEST_RESPONSE_STREAM, session_,
+                                test_url_, MEDIUM, NetLogWithSource());
+  test::StreamDelegateDoNothing delegate(spdy_stream);
+  spdy_stream->SetDelegate(&delegate);
+
+  // Close the socket, without a read/write event, to simulate the
+  // StartRequest() being the first call to notice the socket is closed.
+  data.set_silently_closed();
+
+  // Start a StreamRequest request. Note that `can_send_early` must be true to
+  // avoid calling MockSSLClientSocket::ConfirmHandshake(), will cause the
+  // request not to check the state of the connection, while it waits for the
+  // SSL handshake to be confirmed (that handshake confirmation check will also
+  // cause the MockSSLClientSocket to CHECK, if it happens, as the socket is
+  // closed).
+  SpdyStreamRequest request;
+  int rv = request.StartRequest(
+      SPDY_REQUEST_RESPONSE_STREAM, session_, test_url_,
+      /*can_send_early=*/true, LOWEST, SocketTag(), NetLogWithSource(),
+      base::BindOnce([](int result) {
+        ADD_FAILURE()
+            << "Callback should not be invoked on synchronous completion";
+      }),
+      TRAFFIC_ANNOTATION_FOR_TESTS);
+  // The request should synchronously fail.
+  EXPECT_THAT(rv, IsError(ERR_CONNECTION_CLOSED));
+
+  // The session should be flagged as going away, and should no longer be
+  // available but should still exist.
+  EXPECT_TRUE(session_->IsGoingAway());
+  EXPECT_FALSE(HasSpdySession(spdy_session_pool_, key_));
+  // The first stream should not have been closed synchronously. Instead, a task
+  // should have been posted to close it.
+  EXPECT_FALSE(delegate.StreamIsClosed());
+
+  // Wait for the stream to be closed.
+  EXPECT_THAT(delegate.WaitForClose(), IsError(ERR_CONNECTION_CLOSED));
+}
+
 // Test that SpdySession::DoReadLoop reads data from the socket
 // without yielding.  This test makes 32k - 1 bytes of data available
 // on the socket for reading. It then verifies that it has read all

Loading diff…

Original Bug Report

reported by [email protected]

Heap UAF in HTTPS HTTP/2 proxy authentication flow

VULNERABILITY DETAILS

This issue is a heap-use-after-free in Chrome’s HTTPS HTTP/2 proxy authentication flow, in the net/socket/transport_client_socket_pool + net/http/ http_proxy_connect_job + net/spdy/spdy_proxy_client_socket path, with the recorded crashing family at net::TransportClientSocketPool::Group::IsEmpty() const.

The most likely root cause is a lifetime bug during proxy-auth challenge handling and connection teardown, where a socket-pool group or closely related state is destroyed or invalidated while another path still retains and later dereferences it.

=================================================================
==3183368==ERROR: AddressSanitizer: heap-use-after-free on address 0x7cf38a35bad0 at pc 0x7f94e5a76274 bp 0x7b937c7ad4a0 sp 0x7b937c7ad498
READ of size 8 at 0x7cf38a35bad0 thread T5 (Chrome_ChildIOT)
[3183402:3183402:0315/043531.508658:ERROR:content/renderer/render_process_impl.cc:216] WebFrame LEAKED 1 TIMES
    #0 0x7f94e5a76273 in net::TransportClientSocketPool::Group::IsEmpty() const net/socket/transport_client_socket_pool.h:350:14
    #1 0x7f94e5a55d89 in net::TransportClientSocketPool::RequestSocketInternal(net::ClientSocketPool::GroupId const&, net::TransportClientSocketPool::Request const&, base::OnceCallback<void ()>) net/socket/transport_client_socket_pool.cc:495:14
    #2 0x7f94e5a5471d in net::TransportClientSocketPool::RequestSocket(net::ClientSocketPool::GroupId const&, scoped_refptr<net::ClientSocketPool::SocketParams>, std::__Cr::optional<net::NetworkTrafficAnnotationTag> const&, net::RequestPriority, net::SocketTag const&, net::ClientSocketPool::RespectLimits, net::ClientSocketHandle*, base::OnceCallback<void (int)>, base::RepeatingCallback<void (net::HttpResponseInfo const&, net::HttpAuthController*, base::OnceCallback<void ()>)> const&, net::NetLogWithSource const&) net/socket/transport_client_socket_pool.cc:274:7
    #3 0x7f94e593149b in net::ClientSocketHandle::Init(net::ClientSocketPool::GroupId const&, scoped_refptr<net::ClientSocketPool::SocketParams>, std::__Cr::optional<net::NetworkTrafficAnnotationTag> const&, net::RequestPriority, net::SocketTag const&, net::ClientSocketPool::RespectLimits, base::OnceCallback<void (int)>, base::RepeatingCallback<void (net::HttpResponseInfo const&, net::HttpAuthController*, base::OnceCallback<void ()>)> const&, net::ClientSocketPool*, net::NetLogWithSource const&) net/socket/client_socket_handle.cc:51:19
    #4 0x7f94e5940a1e in net::(anonymous namespace)::InitSocketPoolHelper(url::SchemeHostPort, int, net::RequestPriority, net::HttpNetworkSession*, net::ProxyInfo const&, std::__Cr::vector<net::SSLConfig::CertAndStatus, std::__Cr::allocator<net::SSLConfig::CertAndStatus>> const&, net::PrivacyMode, net::NetworkAnonymizationKey, net::SecureDnsPolicy, net::SocketTag const&, net::NetLogWithSource const&, int, net::ClientSocketHandle*, net::HttpNetworkSession::SocketPoolType, base::OnceCallback<void (int)>, base::RepeatingCallback<void (net::HttpResponseInfo const&, net::HttpAuthController*, base::OnceCallback<void ()>)> const&) net/socket/client_socket_pool_manager.cc:131:25
    #5 0x7f94e594009d in net::InitSocketHandleForHttpRequest(url::SchemeHostPort, int, net::RequestPriority, net::HttpNetworkSession*, net::ProxyInfo const&, std::__Cr::vector<net::SSLConfig::CertAndStatus, std::__Cr::allocator<net::SSLConfig::CertAndStatus>> const&, net::PrivacyMode, net::NetworkAnonymizationKey, net::SecureDnsPolicy, net::SocketTag const&, net::NetLogWithSource const&, net::ClientSocketHandle*, base::OnceCallback<void (int)>, base::RepeatingCallback<void (net::HttpResponseInfo const&, net::HttpAuthController*, base::OnceCallback<void ()>)> const&) net/socket/client_socket_pool_manager.cc:226:10
    #6 0x7f94e52d9296 in net::HttpStreamFactory::Job::DoInitConnectionImpl() net/http/http_stream_factory_job.cc:823:10
    #7 0x7f94e52d43dd in net::HttpStreamFactory::Job::DoInitConnection() net/http/http_stream_factory_job.cc:702:16
    #8 0x7f94e52d289b in net::HttpStreamFactory::Job::DoLoop(int) net/http/http_stream_factory_job.cc:630:14
    #9 0x7f94e52d14a5 in net::HttpStreamFactory::Job::RunLoop(int) net/http/http_stream_factory_job.cc:531:12
    #10 0x7f94e52c877e in net::HttpStreamFactory::Job::StartInternal() net/http/http_stream_factory_job.cc:655:3
    #11 0x7f94e52c8553 in net::HttpStreamFactory::Job::Start(net::HttpStreamRequest::StreamType) net/http/http_stream_factory_job.cc:246:3
    #12 0x7f94e5307007 in net::HttpStreamFactory::JobController::DoCreateJobs() net/http/http_stream_factory_job_controller.cc:1026:16
    #13 0x7f94e53027b0 in net::HttpStreamFactory::JobController::DoLoop(int) net/http/http_stream_factory_job_controller.cc:807:14
    #14 0x7f94e52f4629 in net::HttpStreamFactory::JobController::RunLoop(int) net/http/http_stream_factory_job_controller.cc:765:12
    #15 0x7f94e52f41aa in net::HttpStreamFactory::JobController::Start(net::HttpStreamRequest::Delegate*, net::WebSocketHandshakeStreamBase::CreateHelper*, net::NetLogWithSource const&, net::HttpStreamRequest::StreamType, net::RequestPriority) net/http/http_stream_factory_job_controller.cc:232:3
    #16 0x7f94e52bec72 in net::HttpStreamFactory::RequestStreamInternal(net::HttpRequestInfo const&, net::RequestPriority, std::__Cr::vector<net::SSLConfig::CertAndStatus, std::__Cr::allocator<net::SSLConfig::CertAndStatus>> const&, net::HttpStreamRequest::Delegate*, net::WebSocketHandshakeStreamBase::CreateHelper*, net::HttpStreamRequest::StreamType, bool, bool, bool, net::NetLogWithSource const&) net/http/http_stream_factory.cc:232:34
    #17 0x7f94e52be8a7 in net::HttpStreamFactory::RequestStream(net::HttpRequestInfo const&, net::RequestPriority, std::__Cr::vector<net::SSLConfig::CertAndStatus, std::__Cr::allocator<net::SSLConfig::CertAndStatus>> const&, net::HttpStreamRequest::Delegate*, bool, bool, net::NetLogWithSource const&) net/http/http_stream_factory.cc:163:10
    #18 0x7f94e517a039 in net::HttpNetworkTransaction::DoCreateStream() net/http/http_network_transaction.cc:1136:56
    #19 0x7f94e516bc40 in net::HttpNetworkTransaction::DoLoop(int) net/http/http_network_transaction.cc:1009:14
    #20 0x7f94e516add0 in net::HttpNetworkTransaction::Start(net::HttpRequestInfo const*, base::OnceCallback<void (int)>, net::NetLogWithSource const&) net/http/http_network_transaction.cc:426:12
    #21 0x7f94a0e21307 in network::ThrottlingNetworkTransaction::Start(net::HttpRequestInfo const*, base::OnceCallback<void (int)>, net::NetLogWithSource const&) services/network/throttling/throttling_network_transaction.cc:137:34
    #22 0x7f94e5920665 in net::SharedDictionaryNetworkTransaction::Start(net::HttpRequestInfo const*, base::OnceCallback<void (int)>, net::NetLogWithSource const&) net/shared_dictionary/shared_dictionary_network_transaction.cc:114:34
    #23 0x7f94e50c5eeb in net::HttpCache::Transaction::DoSendRequest() net/http/http_cache_transaction.cc:1921:28
    #24 0x7f94e50af243 in net::HttpCache::Transaction::DoLoop(int) net/http/http_cache_transaction.cc:910:14
    #25 0x7f94e50abf1c in net::HttpCache::Transaction::Start(net::HttpRequestInfo const*, base::OnceCallback<void (int)>, net::NetLogWithSource const&) net/http/http_cache_transaction.cc:213:12
    #26 0x7f94e5d00264 in net::URLRequestHttpJob::StartTransactionInternal() net/url_request/url_request_http_job.cc:782:26
    #27 0x7f94e5cff301 in net::URLRequestHttpJob::MaybeStartTransactionInternal(int) net/url_request/url_request_http_job.cc:713:5
    #28 0x7f94e5cfc976 in net::URLRequestHttpJob::StartTransaction() net/url_request/url_request_http_job.cc:692:5
    #29 0x7f94e5cfb3e7 in net::URLRequestHttpJob::OnGotFirstPartySetMetadata(net::FirstPartySetMetadata, net::FirstPartySetsCacheFilter::MatchInfo) net/url_request/url_request_http_job.cc:557:5
    #30 0x7f94e5cfaa48 in net::URLRequestHttpJob::Start() net/url_request/url_request_http_job.cc:493:5
    #31 0x7f94e5cb1a30 in net::URLRequest::StartJob(std::__Cr::unique_ptr<net::URLRequestJob, std::__Cr::default_delete<net::URLRequestJob>>) net/url_request/url_request.cc:761:9
    #32 0x7f94e5cb0910 in net::URLRequest::BeforeRequestComplete(int) net/url_request/url_request.cc:682:5
    #33 0x7f94e5caf6f4 in net::URLRequest::Start() net/url_request/url_request.cc:621:7
    #34 0x7f94a0e60fe1 in network::URLLoader::ScheduleStart() services/network/url_loader.cc:761:19
    #35 0x7f94a0e6041b in network::URLLoader::ProcessOutboundSharedStorageInterceptor() services/network/url_loader.cc:743:3
    #36 0x7f94a0e5cdc2 in network::URLLoader::ProcessOutboundTrustTokenInterceptor(network::ResourceRequest const&) services/network/url_loader.cc:671:5
    #37 0x7f94a0e5ae2c in network::URLLoader::URLLoader(network::URLLoaderContext&, base::OnceCallback<void (network::URLLoader*)>, mojo::PendingReceiver<network::mojom::URLLoader>, int, network::ResourceRequest const&, mojo::PendingRemote<network::mojom::URLLoaderClient>, base::WeakPtr<network::mojom::URLLoaderClient>, net::NetworkTrafficAnnotationTag const&, base::numerics_internal::StrictNumeric<int>, int, base::WeakPtr<network::KeepaliveStatisticsRecorder>, std::__Cr::unique_ptr<network::TrustTokenRequestHelperFactory, std::__Cr::default_delete<network::TrustTokenRequestHelperFactory>>, network::SharedDictionaryManager*, std::__Cr::unique_ptr<network::SharedDictionaryAccessChecker, std::__Cr::default_delete<network::SharedDictionaryAccessChecker>>, network::ObserverWrapper<network::mojom::CookieAccessObserver>, network::ObserverWrapper<network::mojom::TrustTokenAccessObserver>, network::ObserverWrapper<network::mojom::URLLoaderNetworkServiceObserver>, network::ObserverWrapper<network::mojom::DevToolsObserver>, network::ObserverWrapper<network::mojom::DeviceBoundSessionAccessObserver>, mojo::PendingRemote<network::mojom::AcceptCHFrameObserver>, bool, network::SharedResourceChecker&, std::__Cr::unique_ptr<network::DevtoolsDurableMessageWriter, std::__Cr::default_delete<network::DevtoolsDurableMessageWriter>>, mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>) services/network/url_loader.cc:561:3
    #38 0x7f94a0f13b07 in std::__Cr::unique_ptr<network::URLLoader, std::__Cr::default_delete<network::URLLoader>> std::__Cr::make_unique<network::URLLoader, network::URLLoaderFactory&, base::OnceCallback<void (network::URLLoader*)>, mojo::PendingReceiver<network::mojom::URLLoader>, unsigned int&, network::ResourceRequest const&, mojo::PendingRemote<network::mojom::URLLoaderClient>, base::WeakPtr<network::mojom::URLLoaderClient>, net::NetworkTrafficAnnotationTag, int&, int&, base::WeakPtr<network::KeepaliveStatisticsRecorder>, std::__Cr::unique_ptr<network::TrustTokenRequestHelperFactory, std::__Cr::default_delete<network::TrustTokenRequestHelperFactory>>, network::SharedDictionaryManager*, std::__Cr::unique_ptr<network::SharedDictionaryAccessChecker, std::__Cr::default_delete<network::SharedDictionaryAccessChecker>>, network::ObserverWrapper<network::mojom::CookieAccessObserver>, network::ObserverWrapper<network::mojom::TrustTokenAccessObserver>, network::ObserverWrapper<network::mojom::URLLoaderNetworkServiceObserver>, network::ObserverWrapper<network::mojom::DevToolsObserver>, network::ObserverWrapper<network::mojom::DeviceBoundSessionAccessObserver>, mojo::PendingRemote<network::mojom::AcceptCHFrameObserver>, bool const&, network::SharedResourceChecker&, std::__Cr::unique_ptr<network::DevtoolsDurableMessageWriter, std::__Cr::default_delete<network::DevtoolsDurableMessageWriter>>, mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, 0>(network::URLLoaderFactory&, base::OnceCallback<void (network::URLLoader*)>&&, mojo::PendingReceiver<network::mojom::URLLoader>&&, unsigned int&, network::ResourceRequest const&, mojo::PendingRemote<network::mojom::URLLoaderClient>&&, base::WeakPtr<network::mojom::URLLoaderClient>&&, net::NetworkTrafficAnnotationTag&&, int&, int&, base::WeakPtr<network::KeepaliveStatisticsRecorder>&&, std::__Cr::unique_ptr<network::TrustTokenRequestHelperFactory, std::__Cr::default_delete<network::TrustTokenRequestHelperFactory>>&&, network::SharedDictionaryManager*&&, std::__Cr::unique_ptr<network::SharedDictionaryAccessChecker, std::__Cr::default_delete<network::SharedDictionaryAccessChecker>>&&, network::ObserverWrapper<network::mojom::CookieAccessObserver>&&, network::ObserverWrapper<network::mojom::TrustTokenAccessObserver>&&, network::ObserverWrapper<network::mojom::URLLoaderNetworkServiceObserver>&&, network::ObserverWrapper<network::mojom::DevToolsObserver>&&, network::ObserverWrapper<network::mojom::DeviceBoundSessionAccessObserver>&&, mojo::PendingRemote<network::mojom::AcceptCHFrameObserver>&&, bool const&, network::SharedResourceChecker&, std::__Cr::unique_ptr<network::DevtoolsDurableMessageWriter, std::__Cr::default_delete<network::DevtoolsDurableMessageWriter>>&&, mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>&&) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:30
    #39 0x7f94a0f0f778 in network::URLLoaderFactory::CreateLoaderAndStartWithSyncClient(mojo::PendingReceiver<network::mojom::URLLoader>, int, unsigned int, network::ResourceRequest const&, mojo::PendingRemote<network::mojom::URLLoaderClient>, base::WeakPtr<network::mojom::URLLoaderClient>, net::MutableNetworkTrafficAnnotationTag const&) services/network/url_loader_factory.cc:393:17
    #40 0x7f94a073a05c in network::cors::CorsURLLoader::StartNetworkRequest() services/network/cors/cors_url_loader.cc:1044:35
    #41 0x7f94a072eefe in network::cors::CorsURLLoader::StartRequest() services/network/cors/cors_url_loader.cc:932:5
    #42 0x7f94a072de66 in network::cors::CorsURLLoader::Start() services/network/cors/cors_url_loader.cc:404:3
    #43 0x7f94a076e054 in network::cors::CorsURLLoaderFactory::CreateLoaderAndStart(mojo::PendingReceiver<network::mojom::URLLoader>, int, unsigned int, network::ResourceRequest&, mojo::PendingRemote<network::mojom::URLLoaderClient>, net::MutableNetworkTrafficAnnotationTag const&) services/network/cors/cors_url_loader_factory.cc:492:17
    #44 0x7f94a0b62d52 in network::PrefetchMatchingURLLoaderFactory::CreateLoaderAndStart(mojo::PendingReceiver<network::mojom::URLLoader>, int, unsigned int, network::ResourceRequest&, mojo::PendingRemote<network::mojom::URLLoaderClient>, net::MutableNetworkTrafficAnnotationTag const&) services/network/prefetch_matching_url_loader_factory.cc:105:10
    #45 0x7f94a1960cba in network::mojom::URLLoaderFactoryStubDispatch::Accept(network::mojom::URLLoaderFactory*, mojo::Message*) gen/services/network/public/mojom/url_loader_factory.mojom.cc:352:13
    #46 0x7f94a077c406 in network::mojom::URLLoaderFactoryStub<mojo::RawPtrImplRefTraits<network::mojom::URLLoaderFactory>>::Accept(mojo::Message*) gen/services/network/public/mojom/url_loader_factory.mojom.h:139:12
    #47 0x7f94f6100b5e in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
    #48 0x7f94f60ff941 in mojo::InterfaceEndpointClient::HandleIncomingMessageThunk::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:383:18
    #49 0x7f94f613e183 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:51:24
    #50 0x7f94f6106900 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #51 0x7f94f6147de2 in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1204:42
    #52 0x7f94f6146b26 in mojo::internal::MultiplexRouter::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/multiplex_router.cc:790:7
    #53 0x7f94f613e038 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #54 0x7f94f60bd463 in mojo::Connector::DispatchMessage(mojo::ScopedHandleBase<mojo::MessageHandle>) mojo/public/cpp/bindings/lib/connector.cc:568:49
    #55 0x7f94f60bf03a in mojo::Connector::ReadAllAvailableMessages() mojo/public/cpp/bindings/lib/connector.cc:629:14
    #56 0x7f94f60be9d2 in mojo::Connector::OnHandleReadyInternal(unsigned int) mojo/public/cpp/bindings/lib/connector.cc:454:3
    #57 0x7f94f60be845 in mojo::Connector::OnWatcherHandleReady(char const*, unsigned int) mojo/public/cpp/bindings/lib/connector.cc:420:3
    #58 0x7f94f60cba65 in void base::internal::DecayedFunctorTraits<void (mojo::Connector::*)(char const*, unsigned int), mojo::Connector*, char const* const&>::Invoke<void (mojo::Connector::*)(char const*, unsigned int), mojo::Connector*, char const*, unsigned int>(void (mojo::Connector::*)(char const*, unsigned int), mojo::Connector*&&, char const*&&, unsigned int&&) base/functional/bind_internal.h:740:12
    #59 0x7f94f60cb73e in void base::internal::InvokeHelper<false, base::internal::FunctorTraits<void (mojo::Connector::* const&)(char const*, unsigned int), mojo::Connector*, char const* const&>, void, 0ul, 1ul>::MakeItSo<void (mojo::Connector::* const&)(char const*, unsigned int), std::__Cr::tuple<base::internal::UnretainedWrapper<mojo::Connector, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<char const, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>> const&, unsigned int>(void (mojo::Connector::* const&)(char const*, unsigned int), std::__Cr::tuple<base::internal::UnretainedWrapper<mojo::Connector, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<char const, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>> const&, unsigned int&&) base/functional/bind_internal.h:932:12
    #60 0x7f94f60cb461 in void base::internal::Invoker<base::internal::FunctorTraits<void (mojo::Connector::* const&)(char const*, unsigned int), mojo::Connector*, char const* const&>, base::internal::BindState<true, true, false, void (mojo::Connector::*)(char const*, unsigned int), base::internal::UnretainedWrapper<mojo::Connector, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<char const, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (unsigned int)>::RunImpl<void (mojo::Connector::* const&)(char const*, unsigned int), std::__Cr::tuple<base::internal::UnretainedWrapper<mojo::Connector, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<char const, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>> const&, 0ul, 1ul>(void (mojo::Connector::* const&)(char const*, unsigned int), std::__Cr::tuple<base::internal::UnretainedWrapper<mojo::Connector, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<char const, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>> const&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul>, unsigned int&&) base/functional/bind_internal.h:1069:14
    #61 0x7f94f60cb243 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::Connector::* const&)(char const*, unsigned int), mojo::Connector*, char const* const&>, base::internal::BindState<true, true, false, void (mojo::Connector::*)(char const*, unsigned int), base::internal::UnretainedWrapper<mojo::Connector, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<char const, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int) base/functional/bind_internal.h:989:12
    #62 0x7f94f60c9e38 in base::RepeatingCallback<void (unsigned int)>::Run(unsigned int) const & base/functional/callback.h:346:12
    #63 0x7f94f60c8fee in mojo::SimpleWatcher::DiscardReadyState(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&) mojo/public/cpp/system/simple_watcher.h:192:14
    #64 0x7f94f60c96d1 in void base::internal::DecayedFunctorTraits<void (*)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&>::Invoke<void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&>(void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&, unsigned int&&, mojo::HandleSignalsState const&) base/functional/bind_internal.h:673:12
    #65 0x7f94f60c9609 in void base::internal::InvokeHelper<false, base::internal::FunctorTraits<void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&>, void, 0ul>::MakeItSo<void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), std::__Cr::tuple<base::RepeatingCallback<void (unsigned int)>> const&, unsigned int, mojo::HandleSignalsState const&>(void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), std::__Cr::tuple<base::RepeatingCallback<void (unsigned int)>> const&, unsigned int&&, mojo::HandleSignalsState const&) base/functional/bind_internal.h:932:12
    #66 0x7f94f60c947c in void base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&>, base::internal::BindState<false, true, false, void (*)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)>>, void (unsigned int, mojo::HandleSignalsState const&)>::RunImpl<void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), std::__Cr::tuple<base::RepeatingCallback<void (unsigned int)>> const&, 0ul>(void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), std::__Cr::tuple<base::RepeatingCallback<void (unsigned int)>> const&, std::__Cr::integer_sequence<unsigned long, 0ul>, unsigned int&&, mojo::HandleSignalsState const&) base/functional/bind_internal.h:1069:14
    #67 0x7f94f60c927b in base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&>, base::internal::BindState<false, true, false, void (*)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)>>, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase*, unsigned int, mojo::HandleSignalsState const&) base/functional/bind_internal.h:989:12
    #68 0x7f94f1def340 in base::RepeatingCallback<void (unsigned int, mojo::HandleSignalsState const&)>::Run(unsigned int, mojo::HandleSignalsState const&) const & base/functional/callback.h:346:12
    #69 0x7f94f1debbfa in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) mojo/public/cpp/system/simple_watcher.cc:286:14
    #70 0x7f94f1def72f in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) mojo/public/cpp/system/simple_watcher.cc:97:22
    #71 0x7f94f1dee017 in mojo::SimpleWatcher::Context::CallNotify(MojoTrapEvent const*) mojo/public/cpp/system/simple_watcher.cc:61:14
    #72 0x7f94f1869305 in mojo::core::ipcz_driver::MojoTrap::DispatchEvent(MojoTrapEvent const&) mojo/core/ipcz_driver/mojo_trap.cc:605:3
    #73 0x7f94f18666c0 in mojo::core::ipcz_driver::MojoTrap::DispatchOrQueueEvent(mojo::core::ipcz_driver::MojoTrap::Trigger&, MojoTrapEvent const&) mojo/core/ipcz_driver/mojo_trap.cc:577:5
    #74 0x7f94f186878e in mojo::core::ipcz_driver::MojoTrap::HandleEvent(IpczTrapEvent const&) mojo/core/ipcz_driver/mojo_trap.cc:459:3
    #75 0x7f94f186814c in mojo::core::ipcz_driver::MojoTrap::TrapEventHandler(IpczTrapEvent const*) mojo/core/ipcz_driver/mojo_trap.cc:393:41
    #76 0x7f94f1a74c79 in ipcz::TrapEventDispatcher::DispatchAll() third_party/ipcz/src/ipcz/trap_event_dispatcher.cc:30:5
    #77 0x7f94f1a74a68 in ipcz::TrapEventDispatcher::~TrapEventDispatcher() third_party/ipcz/src/ipcz/trap_event_dispatcher.cc:12:3
    #78 0x7f94f1a44b56 in ipcz::Router::AcceptInboundParcel(std::__Cr::unique_ptr<ipcz::Parcel, std::__Cr::default_delete<ipcz::Parcel>>) third_party/ipcz/src/ipcz/router.cc:272:1
    #79 0x7f94f19a685b in ipcz::NodeLink::AcceptCompleteParcel(ipcz::StrongAlias<ipcz::SublinkIdTag, unsigned long>, std::__Cr::unique_ptr<ipcz::Parcel, std::__Cr::default_delete<ipcz::Parcel>>) third_party/ipcz/src/ipcz/node_link.cc:1082:31
    #80 0x7f94f19aa140 in ipcz::NodeLink::OnAcceptParcel(ipcz::msg::AcceptParcel&) third_party/ipcz/src/ipcz/node_link.cc:666:10
    #81 0x7f94f1a1e7e2 in ipcz::msg::NodeMessageListener::DispatchMessage(ipcz::Message&) third_party/ipcz/src/ipcz/node_messages.cc:914:14
    #82 0x7f94f1a188cd in ipcz::msg::NodeMessageListener::OnMessage(ipcz::Message&) third_party/ipcz/src/ipcz/node_messages.cc:611:10
    #83 0x7f94f1a1b552 in ipcz::msg::NodeMessageListener::OnTransportMessage(ipcz::DriverTransport::RawMessage const&, ipcz::DriverTransport const&, unsigned long) third_party/ipcz/src/ipcz/node_messages.cc:746:16
    #84 0x7f94f192150e in ipcz::DriverTransport::Notify(ipcz::DriverTransport::RawMessage const&, unsigned long) third_party/ipcz/src/ipcz/driver_transport.cc:129:20
    #85 0x7f94f1920e40 in ipcz::(anonymous namespace)::NotifyTransport(unsigned long, void const*, unsigned long, unsigned long const*, unsigned long, unsigned int, IpczTransportActivityOptions const*) third_party/ipcz/src/ipcz/driver_transport.cc:47:11
    #86 0x7f94f188d709 in mojo::core::ipcz_driver::Transport::OnChannelMessage(void const*, unsigned long, std::__Cr::vector<mojo::PlatformHandle, std::__Cr::allocator<mojo::PlatformHandle>>, scoped_refptr<mojo::core::ipcz_driver::Envelope>) mojo/core/ipcz_driver/transport.cc:744:29
    #87 0x7f94f17d3695 in mojo::core::Channel::TryDispatchMessage(base::span<char const, 18446744073709551615ul, char const*>, std::__Cr::optional<std::__Cr::vector<mojo::PlatformHandle, std::__Cr::allocator<mojo::PlatformHandle>>>, scoped_refptr<mojo::core::ipcz_driver::Envelope>, unsigned long*) mojo/core/channel.cc:1210:18
    #88 0x7f94f17d17c4 in mojo::core::Channel::TryDispatchMessage(base::span<char const, 18446744073709551615ul, char const*>, unsigned long*) mojo/core/channel.cc:1122:10
    #89 0x7f94f17d12ba in mojo::core::Channel::OnReadComplete(unsigned long, unsigned long*) mojo/core/channel.cc:1094:29
    #90 0x7f94f18a9d49 in mojo::core::ChannelPosix::OnFdReadable(int) mojo/core/channel_posix.cc:301:12
    #91 0x7f94f47d3949 in base::(anonymous namespace)::MessagePumpForIOFdWatchImpl::OnFileCanReadWithoutBlocking(int) base/message_loop/message_pump.cc:62:18
    #92 0x7f94f50f281d in base::MessagePumpEpoll::FdWatchController::OnFdReadable() base/message_loop/message_pump_epoll.cc:760:13
    #93 0x7f94f50f1dd1 in base::MessagePumpEpoll::HandleEvent(int, bool, bool, base::MessagePumpEpoll::FdWatchController*) base/message_loop/message_pump_epoll.cc:668:17
    #94 0x7f94f50f0e03 in base::MessagePumpEpoll::OnEpollEvent(base::MessagePumpEpoll::EpollEventEntry&, unsigned int) base/message_loop/message_pump_epoll.cc:614:7
    #95 0x7f94f50ed5a8 in base::MessagePumpEpoll::WaitForEpollEvents(base::TimeDelta) base/message_loop/message_pump_epoll.cc:506:7
    #96 0x7f94f50ec36a in base::MessagePumpEpoll::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_epoll.cc:248:12
    #97 0x7f94f4cb86c2 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:650:12
    #98 0x7f94f4a0f0e7 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #99 0x7f94f4e33591 in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:361:13
    #100 0x7f94cfd13a12 in content::(anonymous namespace)::ChildIOThread::Run(base::RunLoop*) content/child/child_process.cc:69:19
    #101 0x7f94f4e34241 in base::Thread::ThreadMain() base/threading/thread.cc:436:3
    #102 0x7f94f4f3406c in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13
    #103 0x555f98508896 in asan_thread_start(void*) asan_interceptors.cpp

0x7cf38a35bad0 is located 336 bytes inside of 576-byte region [0x7cf38a35b980,0x7cf38a35bbc0)
freed by thread T5 (Chrome_ChildIOT) here:
    #0 0x555f9854e7c2 in operator delete(void*, unsigned long) (/mnt/lvm_data/chromium/src/out/asan_dbg_symbols/chrome+0xf3a07c2) (BuildId: 3afd3fb7d064a1b6)
    #1 0x7f94e5a691b6 in net::TransportClientSocketPool::Group::~Group() net/socket/transport_client_socket_pool.cc:1499:44
    #2 0x7f94e5a5c8fd in net::TransportClientSocketPool::RemoveGroup(std::__Cr::__map_iterator<std::__Cr::__tree_iterator<std::__Cr::__value_type<net::ClientSocketPool::GroupId, base::raw_ptr<net::TransportClientSocketPool::Group, (partition_alloc::internal::RawPtrTraits)1>>, std::__Cr::__tree_node<std::__Cr::__value_type<net::ClientSocketPool::GroupId, base::raw_ptr<net::TransportClientSocketPool::Group, (partition_alloc::internal::RawPtrTraits)1>>, void*>*, long>>) net/socket/transport_client_socket_pool.cc:995:3
    #3 0x7f94e5a5749a in net::TransportClientSocketPool::RemoveGroup(net::ClientSocketPool::GroupId const&) net/socket/transport_client_socket_pool.cc:990:3
    #4 0x7f94e5a5b13c in net::TransportClientSocketPool::OnAvailableSocketSlot(net::ClientSocketPool::GroupId const&, net::TransportClientSocketPool::Group*) net/socket/transport_client_socket_pool.cc:1172:5
    #5 0x7f94e5a66240 in net::TransportClientSocketPool::OnConnectJobComplete(net::TransportClientSocketPool::Group*, int, net::ConnectJob*) net/socket/transport_client_socket_pool.cc:1401:5
    #6 0x7f94e5a69323 in net::TransportClientSocketPool::Group::OnConnectJobComplete(int, net::ConnectJob*) net/socket/transport_client_socket_pool.cc:1510:24
    #7 0x7f94e594be00 in net::ConnectJob::NotifyDelegateOfCompletion(int) net/socket/connect_job.cc:181:13
    #8 0x7f94e59eea53 in net::SSLConnectJob::OnIOComplete(int) net/socket/ssl_connect_job.cc:187:5
    #9 0x7f94e59ef198 in net::SSLConnectJob::OnConnectJobComplete(int, net::ConnectJob*) net/socket/ssl_connect_job.cc:144:3
    #10 0x7f94e594be00 in net::ConnectJob::NotifyDelegateOfCompletion(int) net/socket/connect_job.cc:181:13
    #11 0x7f94e51e8c63 in net::HttpProxyConnectJob::OnIOComplete(int) net/http/http_proxy_connect_job.cc:400:5
    #12 0x7f94e51feb21 in void base::internal::DecayedFunctorTraits<void (net::HttpProxyConnectJob::*)(int), net::HttpProxyConnectJob*>::Invoke<void (net::HttpProxyConnectJob::*)(int), net::HttpProxyConnectJob*, int>(void (net::HttpProxyConnectJob::*)(int), net::HttpProxyConnectJob*&&, int&&) base/functional/bind_internal.h:740:12
    #13 0x7f94e51fe864 in void base::internal::InvokeHelper<false, base::internal::FunctorTraits<void (net::HttpProxyConnectJob::*&&)(int), net::HttpProxyConnectJob*>, void, 0ul>::MakeItSo<void (net::HttpProxyConnectJob::*)(int), std::__Cr::tuple<base::internal::UnretainedWrapper<net::HttpProxyConnectJob, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int>(void (net::HttpProxyConnectJob::*&&)(int), std::__Cr::tuple<base::internal::UnretainedWrapper<net::HttpProxyConnectJob, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, int&&) base/functional/bind_internal.h:932:12
    #14 0x7f94e51fe5fc in void base::internal::Invoker<base::internal::FunctorTraits<void (net::HttpProxyConnectJob::*&&)(int), net::HttpProxyConnectJob*>, base::internal::BindState<true, true, false, void (net::HttpProxyConnectJob::*)(int), base::internal::UnretainedWrapper<net::HttpProxyConnectJob, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (int)>::RunImpl<void (net::HttpProxyConnectJob::*)(int), std::__Cr::tuple<base::internal::UnretainedWrapper<net::HttpProxyConnectJob, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, 0ul>(void (net::HttpProxyConnectJob::*&&)(int), std::__Cr::tuple<base::internal::UnretainedWrapper<net::HttpProxyConnectJob, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, std::__Cr::integer_sequence<unsigned long, 0ul>, int&&) base/functional/bind_internal.h:1069:14
    #15 0x7f94e51fe433 in base::internal::Invoker<base::internal::FunctorTraits<void (net::HttpProxyConnectJob::*&&)(int), net::HttpProxyConnectJob*>, base::internal::BindState<true, true, false, void (net::HttpProxyConnectJob::*)(int), base::internal::UnretainedWrapper<net::HttpProxyConnectJob, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:982:12
    #16 0x7f94e4808b38 in base::OnceCallback<void (int)>::Run(int) && base/functional/callback.h:155:12
    #17 0x7f94e5b3ffe6 in net::SpdyProxyClientSocket::OnClose(int) net/spdy/spdy_proxy_client_socket.cc:634:31
    #18 0x7f94e5c25bfb in net::SpdyStream::OnClose(int) net/spdy/spdy_stream.cc:585:15
    #19 0x7f94e5b7290d in net::SpdySession::DeleteStream(std::__Cr::unique_ptr<net::SpdyStream, std::__Cr::default_delete<net::SpdyStream>>, int) net/spdy/spdy_session.cc:2581:11
    #20 0x7f94e5b65455 in net::SpdySession::CloseActiveStreamIterator(std::__Cr::__map_iterator<std::__Cr::__tree_iterator<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, void*>*, long>>, int) net/spdy/spdy_session.cc:1804:3
    #21 0x7f94e5b68281 in net::SpdySession::StartGoingAway(unsigned int, net::Error) net/spdy/spdy_session.cc:1362:5
    #22 0x7f94e5b5ee7c in net::SpdySession::DoDrainSession(net::Error, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, bool) net/spdy/spdy_session.cc:2680:5
    #23 0x7f94e5b70369 in net::SpdySession::CreateStream(net::SpdyStreamRequest const&, base::WeakPtr<net::SpdyStream>*) net/spdy/spdy_session.cc:1694:5
    #24 0x7f94e5b552c1 in net::SpdySession::TryCreateStream(base::WeakPtr<net::SpdyStreamRequest> const&, base::WeakPtr<net::SpdyStream>*) net/spdy/spdy_session.cc:1663:12
    #25 0x7f94e5b53e98 in net::SpdyStreamRequest::StartRequest(net::SpdyStreamType, base::WeakPtr<net::SpdySession> const&, GURL const&, bool, net::RequestPriority, net::SocketTag const&, net::NetLogWithSource const&, base::OnceCallback<void (int)>, net::NetworkTrafficAnnotationTag const&, bool, base::TimeDelta) net/spdy/spdy_session.cc:617:17
    #26 0x7f94e51ee252 in net::HttpProxyConnectJob::DoSpdyProxyCreateStream() net/http/http_proxy_connect_job.cc:696:32
    #27 0x7f94e51ea44d in net::HttpProxyConnectJob::DoLoop(int) net/http/http_proxy_connect_job.cc:443:14
    #28 0x7f94e51e9c39 in net::HttpProxyConnectJob::ConnectInternal() net/http/http_proxy_connect_job.cc:389:10
    #29 0x7f94e594b2ea in net::ConnectJob::Connect() net/socket/connect_job.cc:130:12

previously allocated by thread T5 (Chrome_ChildIOT) here:
    #0 0x555f9854dbbd in operator new(unsigned long) (/mnt/lvm_data/chromium/src/out/asan_dbg_symbols/chrome+0xf39fbbd) (BuildId: 3afd3fb7d064a1b6)
    #1 0x7f94e5a561ea in net::TransportClientSocketPool::GetOrCreateGroup(net::ClientSocketPool::GroupId const&) net/socket/transport_client_socket_pool.cc:981:18
    #2 0x7f94e5a558df in net::TransportClientSocketPool::RequestSocketInternal(net::ClientSocketPool::GroupId const&, net::TransportClientSocketPool::Request const&, base::OnceCallback<void ()>) net/socket/transport_client_socket_pool.cc:454:11
    #3 0x7f94e5a5471d in net::TransportClientSocketPool::RequestSocket(net::ClientSocketPool::GroupId const&, scoped_refptr<net::ClientSocketPool::SocketParams>, std::__Cr::optional<net::NetworkTrafficAnnotationTag> const&, net::RequestPriority, net::SocketTag const&, net::ClientSocketPool::RespectLimits, net::ClientSocketHandle*, base::OnceCallback<void (int)>, base::RepeatingCallback<void (net::HttpResponseInfo const&, net::HttpAuthController*, base::OnceCallback<void ()>)> const&, net::NetLogWithSource const&) net/socket/transport_client_socket_pool.cc:274:7
    #4 0x7f94e593149b in net::ClientSocketHandle::Init(net::ClientSocketPool::GroupId const&, scoped_refptr<net::ClientSocketPool::SocketParams>, std::__Cr::optional<net::NetworkTrafficAnnotationTag> const&, net::RequestPriority, net::SocketTag const&, net::ClientSocketPool::RespectLimits, base::OnceCallback<void (int)>, base::RepeatingCallback<void (net::HttpResponseInfo const&, net::HttpAuthController*, base::OnceCallback<void ()>)> const&, net::ClientSocketPool*, net::NetLogWithSource const&) net/socket/client_socket_handle.cc:51:19
    #5 0x7f94e5940a1e in net::(anonymous namespace)::InitSocketPoolHelper(url::SchemeHostPort, int, net::RequestPriority, net::HttpNetworkSession*, net::ProxyInfo const&, std::__Cr::vector<net::SSLConfig::CertAndStatus, std::__Cr::allocator<net::SSLConfig::CertAndStatus>> const&, net::PrivacyMode, net::NetworkAnonymizationKey, net::SecureDnsPolicy, net::SocketTag const&, net::NetLogWithSource const&, int, net::ClientSocketHandle*, net::HttpNetworkSession::SocketPoolType, base::OnceCallback<void (int)>, base::RepeatingCallback<void (net::HttpResponseInfo const&, net::HttpAuthController*, base::OnceCallback<void ()>)> const&) net/socket/client_socket_pool_manager.cc:131:25
    #6 0x7f94e594009d in net::InitSocketHandleForHttpRequest(url::SchemeHostPort, int, net::RequestPriority, net::HttpNetworkSession*, net::ProxyInfo const&, std::__Cr::vector<net::SSLConfig::CertAndStatus, std::__Cr::allocator<net::SSLConfig::CertAndStatus>> const&, net::PrivacyMode, net::NetworkAnonymizationKey, net::SecureDnsPolicy, net::SocketTag const&, net::NetLogWithSource const&, net::ClientSocketHandle*, base::OnceCallback<void (int)>, base::RepeatingCallback<void (net::HttpResponseInfo const&, net::HttpAuthController*, base::OnceCallback<void ()>)> const&) net/socket/client_socket_pool_manager.cc:226:10
    #7 0x7f94e52d9296 in net::HttpStreamFactory::Job::DoInitConnectionImpl() net/http/http_stream_factory_job.cc:823:10
    #8 0x7f94e52d43dd in net::HttpStreamFactory::Job::DoInitConnection() net/http/http_stream_factory_job.cc:702:16
    #9 0x7f94e52d289b in net::HttpStreamFactory::Job::DoLoop(int) net/http/http_stream_factory_job.cc:630:14
    #10 0x7f94e52d14a5 in net::HttpStreamFactory::Job::RunLoop(int) net/http/http_stream_factory_job.cc:531:12
    #11 0x7f94e52c877e in net::HttpStreamFactory::Job::StartInternal() net/http/http_stream_factory_job.cc:655:3
    #12 0x7f94e52c8553 in net::HttpStreamFactory::Job::Start(net::HttpStreamRequest::StreamType) net/http/http_stream_factory_job.cc:246:3
    #13 0x7f94e5307007 in net::HttpStreamFactory::JobController::DoCreateJobs() net/http/http_stream_factory_job_controller.cc:1026:16
    #14 0x7f94e53027b0 in net::HttpStreamFactory::JobController::DoLoop(int) net/http/http_stream_factory_job_controller.cc:807:14
    #15 0x7f94e52f4629 in net::HttpStreamFactory::JobController::RunLoop(int) net/http/http_stream_factory_job_controller.cc:765:12
    #16 0x7f94e52f41aa in net::HttpStreamFactory::JobController::Start(net::HttpStreamRequest::Delegate*, net::WebSocketHandshakeStreamBase::CreateHelper*, net::NetLogWithSource const&, net::HttpStreamRequest::StreamType, net::RequestPriority) net/http/http_stream_factory_job_controller.cc:232:3
    #17 0x7f94e52bec72 in net::HttpStreamFactory::RequestStreamInternal(net::HttpRequestInfo const&, net::RequestPriority, std::__Cr::vector<net::SSLConfig::CertAndStatus, std::__Cr::allocator<net::SSLConfig::CertAndStatus>> const&, net::HttpStreamRequest::Delegate*, net::WebSocketHandshakeStreamBase::CreateHelper*, net::HttpStreamRequest::StreamType, bool, bool, bool, net::NetLogWithSource const&) net/http/http_stream_factory.cc:232:34
    #18 0x7f94e52be8a7 in net::HttpStreamFactory::RequestStream(net::HttpRequestInfo const&, net::RequestPriority, std::__Cr::vector<net::SSLConfig::CertAndStatus, std::__Cr::allocator<net::SSLConfig::CertAndStatus>> const&, net::HttpStreamRequest::Delegate*, bool, bool, net::NetLogWithSource const&) net/http/http_stream_factory.cc:163:10
    #19 0x7f94e517a039 in net::HttpNetworkTransaction::DoCreateStream() net/http/http_network_transaction.cc:1136:56
    #20 0x7f94e516bc40 in net::HttpNetworkTransaction::DoLoop(int) net/http/http_network_transaction.cc:1009:14
    #21 0x7f94e516add0 in net::HttpNetworkTransaction::Start(net::HttpRequestInfo const*, base::OnceCallback<void (int)>, net::NetLogWithSource const&) net/http/http_network_transaction.cc:426:12
    #22 0x7f94a0e21307 in network::ThrottlingNetworkTransaction::Start(net::HttpRequestInfo const*, base::OnceCallback<void (int)>, net::NetLogWithSource const&) services/network/throttling/throttling_network_transaction.cc:137:34
    #23 0x7f94e5920665 in net::SharedDictionaryNetworkTransaction::Start(net::HttpRequestInfo const*, base::OnceCallback<void (int)>, net::NetLogWithSource const&) net/shared_dictionary/shared_dictionary_network_transaction.cc:114:34
    #24 0x7f94e50c5eeb in net::HttpCache::Transaction::DoSendRequest() net/http/http_cache_transaction.cc:1921:28
    #25 0x7f94e50af243 in net::HttpCache::Transaction::DoLoop(int) net/http/http_cache_transaction.cc:910:14
    #26 0x7f94e50abf1c in net::HttpCache::Transaction::Start(net::HttpRequestInfo const*, base::OnceCallback<void (int)>, net::NetLogWithSource const&) net/http/http_cache_transaction.cc:213:12
    #27 0x7f94e5d00264 in net::URLRequestHttpJob::StartTransactionInternal() net/url_request/url_request_http_job.cc:782:26
    #28 0x7f94e5cff301 in net::URLRequestHttpJob::MaybeStartTransactionInternal(int) net/url_request/url_request_http_job.cc:713:5
    #29 0x7f94e5cfc976 in net::URLRequestHttpJob::StartTransaction() net/url_request/url_request_http_job.cc:692:5

Thread T5 (Chrome_ChildIOT) created by T0 (chrome) here:
    #0 0x555f984ee6c1 in pthread_create (/mnt/lvm_data/chromium/src/out/asan_dbg_symbols/chrome+0xf3406c1) (BuildId: 3afd3fb7d064a1b6)
    #1 0x7f94f4f32b69 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13
    #2 0x7f94f4f326c8 in base::PlatformThreadBase::CreateWithType(unsigned long, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:322:10
    #3 0x7f94f4e30866 in base::Thread::StartWithOptions(base::Thread::Options) base/threading/thread.cc:228:26
    #4 0x7f94cfd11705 in content::ChildProcess::ChildProcess(base::ThreadType, std::__Cr::unique_ptr<base::ThreadPoolInstance::InitParams, std::__Cr::default_delete<base::ThreadPoolInstance::InitParams>>, bool) content/child/child_process.cc:152:21
    #5 0x7f94dd2a0149 in content::UtilityMain(content::MainFunctionParams) content/utility/utility_main.cc:459:16
    #6 0x7f94dd5cb0ad in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:762:14
    #7 0x7f94dd5ce956 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #8 0x7f94dd5c47af in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #9 0x7f94dd5c5625 in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #10 0x555f9854f700 in ChromeMain chrome/app/chrome_main.cc:191:12
    #11 0x555f9854ef61 in main chrome/app/chrome_exe_main_aura.cc:17:10
    #12 0x7f93b39f1d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: heap-use-after-free net/socket/transport_client_socket_pool.h:350:14 in net::TransportClientSocketPool::Group::IsEmpty() const
Shadow bytes around the buggy address:
  0x7cf38a35b800: 00 07 00 06 fc 00 fc fc fc fc fc fc fc fc fc fc
  0x7cf38a35b880: fc fc fc fc fc fc fc fc fa fa fa fa fa fa fa fa
  0x7cf38a35b900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
  0x7cf38a35b980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7cf38a35ba00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7cf38a35ba80: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd
  0x7cf38a35bb00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7cf38a35bb80: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x7cf38a35bc00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
  0x7cf38a35bc80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7cf38a35bd00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==3183368==ADDITIONAL INFO

==3183368==Note: Please include this section with the ASan report.
Task trace:


Command line: `/proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --host-resolver-rules=MAP * 0.0.0.0,EXCLUDE localhost,EXCLUDE 127.0.0.1 --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --disable-quic --ignore-certificate-errors --crashpad-handler-pid=3183342 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/home/c/r72exact/profiles/chrome_profile_01emo4h6 --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,7858556789988091250,7114296443668740500,262144 --enable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,15791728013565851972,9863046745450112241,4 --trace-process-track-uuid=3950953896855098051`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==3183368==END OF ADDITIONAL INFO

==3183368==ABORTING

VERSION

Chrome Version: Chromium 147.0.7703.0 and Chromium 148.0.7729.0 dev ASAN builds
Operating System: Linux x86_64 on the two hosts (Ubuntu 22.04.3 LTS class and Ubuntu 25.04 class)

REPRODUCTION CASE

Primary HTML artifact: min_poc.html
Harness script: launch_standalone.sh

Run Chrome with flags (for reliable repro, not root cause of the bugs): --proxy-server=https://127.0.0.1:<port> --proxy-bypass-list=localhost;127.0.0.1;[::1] --ignore-certificate-errors --disable-quic --disable-domain-reliability --metrics-recording-only --disable-default-apps --disable-sync --host-resolver-rules=MAP * 0.0.0.0,EXCLUDE localhost,EXCLUDE 127.0.0.1 --headless=new

Fast Path

From this directory:

export CHROMIUM_PATH=/path/to/chrome
./launch_standalone.sh

What this does:

starts min_repro.py in HELPER_ONLY=1 mode
binds the local controller server on CONTROLLER_PORT (default 8872)
binds the local HTTPS H2 proxy on PROXY_PORT (default 8873)
launches Chrome directly against:
- http://127.0.0.1:${CONTROLLER_PORT}/min_poc.html?autorun=1
applies the proxy and network flags needed by this PoC

Manual Equivalent

If you want to launch Chrome yourself instead of using the wrapper:

Start the helper:

export CONTROLLER_PORT=8872
export PROXY_PORT=8873
HELPER_ONLY=1 python3 min_repro.py

In another shell, launch Chrome:

export CHROMIUM_PATH=/path/to/chrome
"$CHROMIUM_PATH" \
  --no-sandbox \
  --ignore-certificate-errors \
  --disable-background-networking \
  --disable-quic \
  --disable-domain-reliability \
  --metrics-recording-only \
  --disable-default-apps \
  --disable-sync \
  --host-resolver-rules="MAP * 0.0.0.0,EXCLUDE localhost,EXCLUDE 127.0.0.1" \
  --proxy-server="https://127.0.0.1:${PROXY_PORT}" \
  --proxy-bypass-list="localhost;127.0.0.1;[::1]" \
  "http://127.0.0.1:${CONTROLLER_PORT}/min_poc.html?autorun=1"

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION

Type of crash: Network Service utility-process crash Crash State: Representative callsite family net::TransportClientSocketPool::Group::IsEmpty() const; sanitizer log example asan_heap_uaf_exact.log ASAN type: heap-use-after-free

CREDIT INFORMATION

Reporter credit: heapracer

View on issue tracker

Links in the report

References

Vendor advisory Fix commit Bug tracker NVD

On This Page