Medium chrome UAF 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactUse after free in Mojo
DescriptionUse after free in Mojo
ComponentMojo
Bug ClassUAF
Tracker496639647
Fix commit57fbced46b4b (chromium/src) +4/-0
CISA KEVNot listed
CreditedGoogle
Disclosed2026-05-12

Changed Functions

FunctionChangeNotes
WatcherImpl
mojo/public/java/system/watcher_impl.cc
modified

Files Changed

  • mojo/public/java/system/watcher_impl.cc
From 57fbced46b4bb4ffb3c938e335e027427e0c1203 Mon Sep 17 00:00:00 2001
From: mikt <[email protected]>
Date: Tue, 31 Mar 2026 00:16:30 -0700
Subject: [PATCH] Add AMSC macro to mojo::android::WatcherImpl

Bug: 496639647
Change-Id: Ifdd8dea7702b6639a8d4f9701e9e8f155a52c492
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7707718
Reviewed-by: Daniel Cheng <[email protected]>
Commit-Queue: Mikihito Matsuura <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1607682}
---

diff --git a/mojo/public/java/system/watcher_impl.cc b/mojo/public/java/system/watcher_impl.cc
index caed52da..fde62e8 100644
--- a/mojo/public/java/system/watcher_impl.cc
+++ b/mojo/public/java/system/watcher_impl.cc
@@ -8,6 +8,7 @@
 #include "base/android/jni_android.h"
 #include "base/android/scoped_java_ref.h"
 #include "base/functional/bind.h"
+#include "base/memory/advanced_memory_safety_checks.h"
 #include "base/task/sequenced_task_runner.h"
 #include "mojo/public/cpp/system/handle.h"
 #include "mojo/public/cpp/system/simple_watcher.h"
@@ -23,6 +24,9 @@
 namespace {
 
 class WatcherImpl {
+  // TODO(https://crbug.com/496639647): Remove this macro.
+  ADVANCED_MEMORY_SAFETY_CHECKS();
+
  public:
   WatcherImpl()
       : watcher_(FROM_HERE,
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.