From efb8b71e56b1d5dd3f1bc6e12b5e764ab74a47eb Mon Sep 17 00:00:00 2001
From: Mike Wasserman <[email protected]>
Date: Fri, 14 Aug 2026 22:48:45 -0700
Subject: [PATCH] Fix potential UAF in BrowserView::Show()

Guard against synchronous destruction showing the BrowserView Widget.

Widget::Show() may reach synchronous event dispatch code, e.g. on Win:
 - HWNDMessageHandler::Show -> SetFullscreen / ::ShowWindow / Activate
Event handlers may synchronously close and destroy the browser window.

Mirrors https://crrev.com/c/7897839

Fixed: 537105664
Change-Id: I00546b1c44ad6cf923b061d1a6c39b7322f77c96
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8258613
Commit-Queue: Mike Wasserman <[email protected]>
Reviewed-by: Darryl James <[email protected]>
Auto-Submit: Mike Wasserman <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1680133}
---

diff --git a/chrome/browser/ui/views/frame/browser_view.cc b/chrome/browser/ui/views/frame/browser_view.cc
index 792b839..f9b1d3d 100644
--- a/chrome/browser/ui/views/frame/browser_view.cc
+++ b/chrome/browser/ui/views/frame/browser_view.cc
@@ -1618,7 +1618,13 @@
   if (base::FeatureList::IsEnabled(features::kArtificialUIDelay)) {
     base::PlatformThread::Sleep(features::kViewsUIDelayDuration.Get());
   }
+
+  // Guard against destruction by platform event handlers called during Show().
+  auto weak_ptr = weak_ptr_factory_.GetWeakPtr();
   browser_widget_->Show();
+  if (!weak_ptr) {
+    return;
+  }
 
   OnWindowDidShow();