From e6bca4df6bc1e28a27e0dbf2921b3b5502a9310b Mon Sep 17 00:00:00 2001
From: Zonghan Xu <[email protected]>
Date: Wed, 12 Aug 2026 05:20:23 -0700
Subject: [PATCH] [DTC Consent] [Fortify] Fix potential UAF in ConsentDialogCoordinator::Show()

Showing a modal dialog can spin a nested run loop on macOS, during
which the owning browser, profile, or coordinator may be torn down.
Guard the post-show write with a weak pointer to avoid a
use-after-free write if `this` is destroyed during ShowBrowserModal.

Bug: 534862220
Change-Id: Ia3536e34be051089bfea7633415ed0939ef933ab
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8242507
Reviewed-by: Dominique Fauteux-Chapleau <[email protected]>
Commit-Queue: Dominique Fauteux-Chapleau <[email protected]>
Auto-Submit: Zonghan Xu <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1677948}
---

diff --git a/chrome/browser/ui/views/device_signals_consent/consent_dialog_coordinator.cc b/chrome/browser/ui/views/device_signals_consent/consent_dialog_coordinator.cc
index 349b320..86ef5bba 100644
--- a/chrome/browser/ui/views/device_signals_consent/consent_dialog_coordinator.cc
+++ b/chrome/browser/ui/views/device_signals_consent/consent_dialog_coordinator.cc
@@ -152,8 +152,13 @@
     return;
   }
   base::RecordAction(base::UserMetricsAction("DeviceSignalsConsent_Shown"));
-  dialog_widget_ = chrome::ShowBrowserModal(
+
+  auto weak_this = weak_ptr_factory_.GetWeakPtr();
+  views::Widget* widget = chrome::ShowBrowserModal(
       browser_, CreateDeviceSignalsConsentDialogModel());
+  if (weak_this) {
+    dialog_widget_ = widget;
+  }
 }
 
 void ConsentDialogCoordinator::OnConsentDialogAccept() {