PatchGap
Chrome · Extensions

CVE-2026-8587

UAF in Extensions
Medium chrome UAF 📄 Reporter bug report 🔧 Commit mapped

Overview

Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactUse after free in Extensions
DescriptionUse after free in Extensions
ComponentExtensions
Bug ClassUAF
Tracker507356235
Fix commitf571d6062862 (chromium/src) +86/-97
CISA KEVNot listed
Creditedzh1x1an1221 of Ant Group Tianqiong Security Lab
Disclosed2026-05-12

Changed Functions

FunctionChangeNotes
ContentSettingsTypeToApiPermission
extensions/browser/content_settings_extension_install_time_permission_provider.cc
 modified
switch
extensions/browser/content_settings_extension_install_time_permission_provider.cc
 modified
ApiPermissionRuleIterator
extensions/browser/content_settings_extension_install_time_permission_provider.cc
 modified
if
extensions/browser/content_settings_extension_install_time_permission_provider.cc
 modified

Files Changed

  • chrome/browser/content_settings/host_content_settings_map_factory.cc
  • chrome/browser/content_settings/host_content_settings_map_unittest.cc
  • extensions/browser/content_settings_extension_install_time_permission_provider.cc

Patch

view commit
From f571d6062862dac93885b588ddc2e5d3c4ae1f96 Mon Sep 17 00:00:00 2001
From: Joel Hockey <[email protected]>
Date: Mon, 04 May 2026 03:54:30 -0700
Subject: [PATCH] Store values in OriginValueMap to fix threading issues

GetRuleIterator() must be thread safe, so it cannot access
ExtensionRegistry. This class is now an ExtensionRegistryObserver and
keeps an OriginValueMap of which extensions have permissions enabled.

Bug: 507356235
Change-Id: I4048793bd0a7b15dc1992ed84e293d767baeb8bd
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7806867
Reviewed-by: Reilly Grant <[email protected]>
Commit-Queue: Joel Hockey <[email protected]>
Reviewed-by: Christian Dullweber <[email protected]>
Reviewed-by: Elias Klim <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1624561}
---

diff --git a/chrome/browser/content_settings/host_content_settings_map_factory.cc b/chrome/browser/content_settings/host_content_settings_map_factory.cc
index 76134bb..fd3e487 100644
--- a/chrome/browser/content_settings/host_content_settings_map_factory.cc
+++ b/chrome/browser/content_settings/host_content_settings_map_factory.cc
@@ -158,7 +158,7 @@
   settings_map->RegisterProvider(
       ProviderType::kExtensionInstallTimePermissionProvider,
       std::make_unique<extensions::ExtensionInstallTimePermissionProvider>(
-          extensions::ExtensionRegistry::Get(context)));
+          context, extensions::ExtensionRegistry::Get(context)));
 #endif  // BUILDFLAG(ENABLE_EXTENSIONS_CORE)
 
   supervised_user::FamilyLinkSettingsService* family_link_settings_service =
diff --git a/chrome/browser/content_settings/host_content_settings_map_unittest.cc b/chrome/browser/content_settings/host_content_settings_map_unittest.cc
index b608a5f..578f17c 100644
--- a/chrome/browser/content_settings/host_content_settings_map_unittest.cc
+++ b/chrome/browser/content_settings/host_content_settings_map_unittest.cc
@@ -3149,9 +3149,6 @@
       extensions::ExtensionBuilder("Test Extension 1").Build();
   scoped_refptr<const extensions::Extension> ext2 =
       extensions::ExtensionBuilder("Test Extension 2").Build();
-  auto* registry = extensions::ExtensionRegistry::Get(&profile);
-  registry->AddEnabled(ext1);
-  registry->AddEnabled(ext2);
 
   // Add api permission geolocation for ext1.
   extensions::APIPermissionSet apis;
@@ -3162,6 +3159,12 @@
           extensions::URLPatternSet(), extensions::URLPatternSet()),
       std::make_unique<extensions::PermissionSet>());
 
+  auto* registry = extensions::ExtensionRegistry::Get(&profile);
+  registry->AddEnabled(ext1);
+  registry->AddEnabled(ext2);
+  registry->TriggerOnLoaded(ext1.get());
+  registry->TriggerOnLoaded(ext2.get());
+
   // Validate ext1 is allowed, ext2 is ask.
   HostContentSettingsMap* map =
       HostContentSettingsMapFactory::GetForProfile(&profile);
diff --git a/extensions/browser/content_settings_extension_install_time_permission_provider.cc b/extensions/browser/content_settings_extension_install_time_permission_provider.cc
index 03b381d7..d909d04 100644
--- a/extensions/browser/content_settings_extension_install_time_permission_provider.cc
+++ b/extensions/browser/content_settings_extension_install_time_permission_provider.cc
@@ -7,6 +7,8 @@
 #include <memory>
 #include <optional>
 
+#include "base/containers/fixed_flat_map.h"
+#include "base/synchronization/lock.h"
 #include "base/values.h"
 #include "components/content_settings/core/browser/content_settings_rule.h"
 #include "components/content_settings/core/common/content_settings_pattern.h"
@@ -19,52 +21,26 @@
 namespace extensions {
 namespace {
 
-std::optional<extensions::mojom::APIPermissionID>
-ContentSettingsTypeToApiPermission(ContentSettingsType content_type) {
-  switch (content_type) {
-    case ContentSettingsType::GEOLOCATION:
-      return extensions::mojom::APIPermissionID::kGeolocation;
-    case ContentSettingsType::NOTIFICATIONS:
-      return extensions::mojom::APIPermissionID::kNotifications;
-    default:
-      return std::nullopt;
-  }
+static constexpr auto kTypesToPermissions =
+    base::MakeFixedFlatMap<ContentSettingsType,
+                           extensions::mojom::APIPermissionID>({
+        {ContentSettingsType::GEOLOCATION,
+         extensions::mojom::APIPermissionID::kGeolocation},
+        {ContentSettingsType::NOTIFICATIONS,
+         extensions::mojom::APIPermissionID::kNotifications},
+    });
 }
 
-std::unique_ptr<content_settings::Rule> CreateRule(const GURL& extension) {
-  return std::make_unique<content_settings::Rule>(
-      ContentSettingsPattern::FromURLNoWildcard(extension),
-      ContentSettingsPattern::Wildcard(), base::Value(CONTENT_SETTING_ALLOW),
-      content_settings::RuleMetaData{});
-}
-
-class ApiPermissionRuleIterator : public content_settings::RuleIterator {
- public:
-  explicit ApiPermissionRuleIterator(std::vector<GURL> extensions)
-      : extensions_(std::move(extensions)) {}
-
-  ApiPermissionRuleIterator(const ApiPermissionRuleIterator&) = delete;
-  ApiPermissionRuleIterator& operator=(const ApiPermissionRuleIterator&) =
-      delete;
-  ~ApiPermissionRuleIterator() override = default;
-
-  bool HasNext() const override { return index_ < extensions_.size(); }
-
-  std::unique_ptr<content_settings::Rule> Next() override {
-    DCHECK(HasNext());
-    return CreateRule(extensions_[index_++]);
-  }
-
- private:
-  std::vector<GURL> extensions_;
-  size_t index_ = 0;
-};
-
-}  // namespace
-
 ExtensionInstallTimePermissionProvider::ExtensionInstallTimePermissionProvider(
+    content::BrowserContext* context,
     extensions::ExtensionRegistry* extension_registry)
-    : extension_registry_(extension_registry) {}
+    : extension_registry_(extension_registry) {
+  extension_registry_->AddObserver(this);
+  for (const scoped_refptr<const Extension>& extension :
+       extension_registry->enabled_extensions()) {
+    OnExtensionLoaded(context, extension.get());
+  }
+}
 
 ExtensionInstallTimePermissionProvider::
     ~ExtensionInstallTimePermissionProvider() = default;
@@ -73,24 +49,7 @@
 ExtensionInstallTimePermissionProvider::GetRuleIterator(
     ContentSettingsType content_type,
     bool off_the_record) const {
-  auto api_permission = ContentSettingsTypeToApiPermission(content_type);
-  if (!api_permission) {
-    return nullptr;
-  }
-
-  if (!extension_registry_) {
-    return nullptr;
-  }
-
-  std::vector<GURL> extensions;
-  for (const scoped_refptr<const Extension>& extension :
-       extension_registry_->enabled_extensions()) {
-    if (extension->permissions_data()->HasAPIPermission(*api_permission)) {
-      extensions.emplace_back(extension->url());
-    }
-  }
-
-  return std::make_unique<ApiPermissionRuleIterator>(std::move(extensions));
+  return value_map_.GetRuleIterator(content_type);
 }
 
 std::unique_ptr<content_settings::Rule>
@@ -99,27 +58,8 @@
     const GURL& secondary_url,
     ContentSettingsType content_type,
     bool off_the_record) const {
-  if (!primary_url.SchemeIs(extensions::kExtensionScheme)) {
-    return nullptr;
-  }
-
-  auto api_permission = ContentSettingsTypeToApiPermission(content_type);
-  if (!api_permission) {
-    return nullptr;
-  }
-
-  if (!extension_registry_) {
-    return nullptr;
-  }
-  const extensions::Extension* extension =
-      extension_registry_->enabled_extensions().GetByID(primary_url.GetHost());
-
-  if (extension &&
-      extension->permissions_data()->HasAPIPermission(*api_permission)) {
-    return CreateRule(extension->url());
-  }
-
-  return nullptr;
+  base::AutoLock auto_lock(value_map_.GetLock());
+  return value_map_.GetRule(primary_url, secondary_url, content_type);
 }
 
 bool ExtensionInstallTimePermissionProvider::SetWebsiteSetting(
@@ -140,7 +80,36 @@
 void ExtensionInstallTimePermissionProvider::ShutdownOnUIThread() {
   DCHECK(CalledOnValidThread());
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/chrome/browser/content_settings/host_content_settings_map_unittest.cc b/chrome/browser/content_settings/host_content_settings_map_unittest.cc
index b608a5f..578f17c 100644
--- a/chrome/browser/content_settings/host_content_settings_map_unittest.cc
+++ b/chrome/browser/content_settings/host_content_settings_map_unittest.cc
@@ -3149,9 +3149,6 @@
       extensions::ExtensionBuilder("Test Extension 1").Build();
   scoped_refptr<const extensions::Extension> ext2 =
       extensions::ExtensionBuilder("Test Extension 2").Build();
-  auto* registry = extensions::ExtensionRegistry::Get(&profile);
-  registry->AddEnabled(ext1);
-  registry->AddEnabled(ext2);
 
   // Add api permission geolocation for ext1.
   extensions::APIPermissionSet apis;
@@ -3162,6 +3159,12 @@
           extensions::URLPatternSet(), extensions::URLPatternSet()),
       std::make_unique<extensions::PermissionSet>());
 
+  auto* registry = extensions::ExtensionRegistry::Get(&profile);
+  registry->AddEnabled(ext1);
+  registry->AddEnabled(ext2);
+  registry->TriggerOnLoaded(ext1.get());
+  registry->TriggerOnLoaded(ext2.get());
+
   // Validate ext1 is allowed, ext2 is ask.
   HostContentSettingsMap* map =
       HostContentSettingsMapFactory::GetForProfile(&profile);
diff --git a/extensions/browser/content_settings_extension_install_time_permission_provider_unittest.cc b/extensions/browser/content_settings_extension_install_time_permission_provider_unittest.cc
index 35567ae6..71452df 100644
--- a/extensions/browser/content_settings_extension_install_time_permission_provider_unittest.cc
+++ b/extensions/browser/content_settings_extension_install_time_permission_provider_unittest.cc
@@ -35,8 +35,8 @@
   void SetUp() override {
     ExtensionsTest::SetUp();
     registry_ = ExtensionRegistry::Get(browser_context());
-    provider_ =
-        std::make_unique<ExtensionInstallTimePermissionProvider>(registry_);
+    provider_ = std::make_unique<ExtensionInstallTimePermissionProvider>(
+        browser_context(), registry_);
 
     // Ensure geolocation and notifications are registered.
     PermissionsInfo* info = PermissionsInfo::GetInstance();
@@ -71,6 +71,7 @@
   AddPermission(extension.get(), mojom::APIPermissionID::kGeolocation);
   ASSERT_TRUE(extension);
   registry()->AddEnabled(extension);
+  registry()->TriggerOnLoaded(extension.get());
 
   // The primary URL must exactly match the extension's URL.
   GURL extension_url = extension->url();
@@ -111,15 +112,18 @@
       ExtensionBuilder("Extension 1").Build();
   AddPermission(extension1.get(), mojom::APIPermissionID::kGeolocation);
   registry()->AddEnabled(extension1);
+  registry()->TriggerOnLoaded(extension1.get());
 
   scoped_refptr<const Extension> extension2 =
       ExtensionBuilder("Extension 2").Build();
   registry()->AddEnabled(extension2);
+  registry()->TriggerOnLoaded(extension2.get());
 
   scoped_refptr<const Extension> extension3 =
       ExtensionBuilder("Extension 3").Build();
   AddPermission(extension3.get(), mojom::APIPermissionID::kGeolocation);
   registry()->AddEnabled(extension3);
+  registry()->TriggerOnLoaded(extension3.get());
 
   // Expect exactly two extensions (extension1, extension3) have GEOLOCATION.
   std::unique_ptr<content_settings::RuleIterator> iterator =
@@ -136,17 +140,13 @@
     count++;
   }
   EXPECT_EQ(2, count);
+  // reset iterator to release lock.
+  iterator.reset();
 
-  // Expect zero extensions have NOTIFICATIONS.
+  // Expect zero extensions have NOTIFICATIONS (null iterator).
   iterator = provider()->GetRuleIterator(ContentSettingsType::NOTIFICATIONS,
                                          /*off_the_record=*/false);
-  ASSERT_TRUE(iterator);
-  count = 0;
-  while (iterator->HasNext()) {
-    iterator->Next();
-    count++;
-  }
-  EXPECT_EQ(0, count);
+  ASSERT_FALSE(iterator);
 
   // Expect null iterator for unrelated ContentSettingsType.
   iterator = provider()->GetRuleIterator(ContentSettingsType::COOKIES,
@@ -159,6 +159,7 @@
       ExtensionBuilder("Test Extension").Build();
   AddPermission(extension.get(), mojom::APIPermissionID::kGeolocation);
   registry()->AddEnabled(extension);
+  registry()->TriggerOnLoaded(extension.get());
 
   // SetWebsiteSetting should return false (not supported).
   EXPECT_FALSE(provider()->SetWebsiteSetting(
Loading diff…

Original Bug Report

reported by [email protected]

Security: heap-use-after-free in extensions::ExtensionInstallTimePermissionProvider::GetRuleIterator

Steps to reproduce the problem

  1. Download mac-release-arm64_asan-mac-release-1621025

  2. Prepare a clean directory and store these files there.On my computer, I selected cd ~/Sites; mkdir fastcat-extension-registry-uaf-arm1621025;

poc.html
serve.py
manager/manifest.json
manager/sw.js
manager/settings_toggle.js
  • Check that the poc file is complete:
pwd
~/Sites/fastcat-extension-registry-uaf-arm1621025
ls -R
manager    poc.html   serve.py

./manager:
manifest.json      settings_toggle.js sw.js
  1. setup http-server:
cd ~/Sites/fastcat-extension-registry-uaf-arm1621025
python3 serve.py --host 127.0.0.1 --port 9000
  1. run asan mac chromium:
POC="/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025"
CHROMIUM="/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/MacOS/Chromium"
PROFILE="/tmp/fastcat-extension-registry-uaf-sites-profile"

rm -rf "$PROFILE" "$POC/targets"
mkdir -p "$POC/targets"

for n in {0..127}; do
  DIR="$(printf "%s/targets/t%04d" "$POC" "$n")"
  mkdir -p "$DIR"
  printf '{"manifest_version":3,"name":"FastCat Registry Race Target %04d","version":"1.0","permissions":["geolocation","notifications"]}\n' "$n" > "$DIR/manifest.json"
done

EXTS="$POC/manager"
for n in {0..127}; do
  EXTS="$EXTS,$(printf "%s/targets/t%04d" "$POC" "$n")"
done

"$CHROMIUM" \
  --no-sandbox \
  --user-data-dir="$PROFILE" \
  --disable-breakpad \
  --no-first-run \
  --no-default-browser-check \
  --enable-logging=stderr \
  --disable-popup-blocking \
  --disable-background-timer-throttling \
  --disable-renderer-backgrounding \
  --extensions-on-chrome-urls \
  --load-extension="$EXTS" \
  http://127.0.0.1:9000/poc.html

Problem Description

RCA and BISECT coming soon!

Summary

Security: heap-use-after-free in extensions::ExtensionInstallTimePermissionProvider::GetRuleIterator

Custom Questions

Type of crash:

browser

Crash state:

=================================================================
==41907==ERROR: AddressSanitizer: heap-use-after-free on address 0x606000277708 at pc 0x00035625eaa8 bp 0x000173d6e370 sp 0x000173d6e368
READ of size 8 at 0x606000277708 thread T14
==41907==WARNING: invalid path to external symbolizer!
==41907==WARNING: Failed to use and restart external symbolizer!
    #0 0x00035625eaa4 in extensions::ExtensionInstallTimePermissionProvider::GetRuleIterator(content_settings::mojom::ContentSettingsType, bool) const+0x44c (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xb3f2aa4)
    #1 0x0003661c259c in HostContentSettingsMap::AddSettingsForOneType(content_settings::ProviderInterface const*, content_settings::mojom::ProviderType, content_settings::mojom::ContentSettingsType, std::__Cr::vector<ContentSettingPatternSource, std::__Cr::allocator<ContentSettingPatternSource>>*, bool, std::__Cr::optional<content_settings::mojom::SessionModel>) const+0x11c (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x1b35659c)
    #2 0x0003661c239c in HostContentSettingsMap::GetSettingsForOneType(content_settings::mojom::ContentSettingsType, std::__Cr::optional<content_settings::mojom::SessionModel>) const+0x134 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x1b35639c)
    #3 0x00035c3613d8 in UnusedSitePermissionsManager::UpdateOnBackgroundThread(base::Clock*, scoped_refptr<HostContentSettingsMap>, bool)+0x3ec (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x114f53d8)
    #4 0x00035c35ad84 in base::internal::Invoker<base::internal::FunctorTraits<std::__Cr::unique_ptr<SafetyHubResult, std::__Cr::default_delete<SafetyHubResult>> (*&&)(base::Clock*, scoped_refptr<HostContentSettingsMap>, bool), base::raw_ptr<base::Clock, (partition_alloc::internal::RawPtrTraits)0>&&, scoped_refptr<HostContentSettingsMap>&&, bool&&>, base::internal::BindState<false, true, false, std::__Cr::unique_ptr<SafetyHubResult, std::__Cr::default_delete<SafetyHubResult>> (*)(base::Clock*, scoped_refptr<HostContentSettingsMap>, bool), base::internal::UnretainedWrapper<base::Clock, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, scoped_refptr<HostContentSettingsMap>, bool>, std::__Cr::unique_ptr<SafetyHubResult, std::__Cr::default_delete<SafetyHubResult>> ()>::RunOnce(base::internal::BindStateBase*)+0x1ac (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x114eed84)
    #5 0x00035c35e398 in void base::internal::ReturnAsParamAdapter<std::__Cr::tuple<std::__Cr::unique_ptr<SafetyHubResult, std::__Cr::default_delete<SafetyHubResult>>>, std::__Cr::unique_ptr<SafetyHubResult, std::__Cr::default_delete<SafetyHubResult>>>(base::OnceCallback<std::__Cr::unique_ptr<SafetyHubResult, std::__Cr::default_delete<SafetyHubResult>> ()>, std::__Cr::unique_ptr<std::__Cr::tuple<std::__Cr::unique_ptr<SafetyHubResult, std::__Cr::default_delete<SafetyHubResult>>>, std::__Cr::default_delete<std::__Cr::tuple<std::__Cr::unique_ptr<SafetyHubResult, std::__Cr::default_delete<SafetyHubResult>>>>>*)+0x13c (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x114f2398)
    #6 0x00035c35e9b0 in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::OnceCallback<std::__Cr::unique_ptr<SafetyHubResult, std::__Cr::default_delete<SafetyHubResult>> ()>, std::__Cr::unique_ptr<std::__Cr::tuple<std::__Cr::unique_ptr<SafetyHubResult, std::__Cr::default_delete<SafetyHubResult>>>, std::__Cr::default_delete<std::__Cr::tuple<std::__Cr::unique_ptr<SafetyHubResult, std::__Cr::default_delete<SafetyHubResult>>>>>*), base::OnceCallback<std::__Cr::unique_ptr<SafetyHubResult, std::__Cr::default_delete<SafetyHubResult>> ()>&&, std::__Cr::unique_ptr<std::__Cr::tuple<std::__Cr::unique_ptr<SafetyHubResult, std::__Cr::default_delete<SafetyHubResult>>>, std::__Cr::default_delete<std::__Cr::tuple<std::__Cr::unique_ptr<SafetyHubResult, std::__Cr::default_delete<SafetyHubResult>>>>>*&&>, base::internal::BindState<false, true, false, void (*)(base::OnceCallback<std::__Cr::unique_ptr<SafetyHubResult, std::__Cr::default_delete<SafetyHubResult>> ()>, std::__Cr::unique_ptr<std::__Cr::tuple<std::__Cr::unique_ptr<SafetyHubResult, std::__Cr::default_delete<SafetyHubResult>>>, std::__Cr::default_delete<std::__Cr::tuple<std::__Cr::unique_ptr<SafetyHubResult, std::__Cr::default_delete<SafetyHubResult>>>>>*), base::OnceCallback<std::__Cr::unique_ptr<SafetyHubResult, std::__Cr::default_delete<SafetyHubResult>> ()>, base::internal::UnretainedWrapper<std::__Cr::unique_ptr<std::__Cr::tuple<std::__Cr::unique_ptr<SafetyHubResult, std::__Cr::default_delete<SafetyHubResult>>>, std::__Cr::default_delete<std::__Cr::tuple<std::__Cr::unique_ptr<SafetyHubResult, std::__Cr::default_delete<SafetyHubResult>>>>>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*)+0x198 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x114f29b0)
    #7 0x00035daf2848 in base::internal::PostTaskAndReplyRelay::RunTaskAndPostReply(base::internal::PostTaskAndReplyRelay)+0x144 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12c86848)
    #8 0x00035daf2d10 in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay&&>, base::internal::BindState<false, true, false, void (*)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay>, void ()>::RunOnce(base::internal::BindStateBase*)+0x110 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12c86d10)
    #9 0x00035da7a678 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&)+0x360 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12c0e678)
    #10 0x00035dafdff8 in base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&)+0x1f0 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12c91ff8)
    #11 0x00035dafe244 in base::internal::TaskTracker::RunSkipOnShutdown(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&)+0xec (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12c92244)
    #12 0x00035dafcc04 in base::internal::TaskTracker::RunTask(base::internal::Task, base::internal::TaskSource*, base::TaskTraits const&, base::ThreadType)+0x3f4 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12c90c04)
    #13 0x00035dafbfd8 in base::internal::TaskTracker::RunAndPopNextTask(base::internal::RegisteredTaskSource)+0x540 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12c8ffd8)
    #14 0x00035db385d4 in base::internal::WorkerThread::RunWorker()+0x828 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12ccc5d4)
    #15 0x00035db376d8 in base::internal::WorkerThread::RunBackgroundPooledWorker()+0xac (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12ccb6d8)
    #16 0x00035db374bc in base::internal::WorkerThread::ThreadMain()+0x24c (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12ccb4bc)
    #17 0x00035dbaccf8 in base::(anonymous namespace)::ThreadFunc(void*)+0x154 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12d40cf8)
    #18 0x00010074d99c in __sanitizer_weak_hook_memcmp+0x36694 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x5199c)
    #19 0x000189283c54 in _pthread_start+0x84 (/usr/lib/system/libsystem_pthread.dylib:arm64e+0x6c54)
    #20 0x00018927ec18 in thread_start+0x4 (/usr/lib/system/libsystem_pthread.dylib:arm64e+0x1c18)

0x606000277708 is located 8 bytes inside of 64-byte region [0x606000277700,0x606000277740)
freed by thread T0 here:
    #0 0x000100751184 in __asan_memmove+0x3078 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x55184)
    #1 0x00036590fb0c in std::__Cr::__tree<std::__Cr::__value_type<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, scoped_refptr<extensions::Extension const>>, std::__Cr::__map_value_compare<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, std::__Cr::pair<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const, scoped_refptr<extensions::Extension const>>, std::__Cr::less<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>>>, std::__Cr::allocator<std::__Cr::pair<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const, scoped_refptr<extensions::Extension const>>>>::erase(std::__Cr::__tree_const_iterator<std::__Cr::__value_type<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, scoped_refptr<extensions::Extension const>>, std::__Cr::__tree_node<std::__Cr::__value_type<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, scoped_refptr<extensions::Extension const>>, void*>*, long>)+0x190 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x1aaa3b0c)
    #2 0x00036590db5c in extensions::ExtensionSet::Remove(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&)+0x19c (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x1aaa1b5c)
    #3 0x000356370d7c in extensions::ExtensionRegistrar::DisableExtensionWithRawReasons(extensions::ExtensionPrefs::DisableReasonRawManipulationPasskey, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, base::internal::flat_tree<int, std::__Cr::identity, std::__Cr::less<void>, std::__Cr::vector<int, std::__Cr::allocator<int>>>)+0x508 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xb504d7c)
    #4 0x000356371750 in extensions::ExtensionRegistrar::DisableExtensionWithSource(extensions::Extension const*, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, extensions::disable_reason::DisableReason)+0x218 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xb505750)
    #5 0x00035907b114 in extensions::ChromeManagementAPIDelegate::DisableExtension(content::BrowserContext*, extensions::Extension const*, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, extensions::disable_reason::DisableReason) const+0x134 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xe20f114)
    #6 0x000356cc9400 in extensions::ManagementSetEnabledFunction::Run()+0xa4c (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xbe5d400)
    #7 0x0003563004b4 in ExtensionFunction::RunWithValidation()+0x1b8 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xb4944b4)
    #8 0x00035630eeb0 in extensions::ExtensionFunctionDispatcher::DispatchWithCallbackInternal(mojo::StructPtr<extensions::mojom::RequestParams>, content::RenderFrameHost*, content::RenderProcessHost&, base::OnceCallback<void (ExtensionFunction::ResponseType, base::ListValue, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, mojo::StructPtr<extensions::mojom::ExtraResponseData>)>)+0xf10 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xb4a2eb0)
    #9 0x00035630f9d0 in extensions::ExtensionFunctionDispatcher::DispatchForServiceWorker(mojo::StructPtr<extensions::mojom::RequestParams>, int, base::OnceCallback<void (bool, base::ListValue, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, mojo::StructPtr<extensions::mojom::ExtraResponseData>)>)+0x3d8 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xb4a39d0)
    #10 0x000356482a10 in extensions::ServiceWorkerHost::RequestWorker(mojo::StructPtr<extensions::mojom::RequestParams>, base::OnceCallback<void (bool, base::ListValue, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, mojo::StructPtr<extensions::mojom::ExtraResponseData>)>)+0x244 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xb616a10)
    #11 0x0003565ea5b4 in extensions::mojom::ServiceWorkerHostStubDispatch::AcceptWithResponder(extensions::mojom::ServiceWorkerHost*, mojo::Message*, std::__Cr::unique_ptr<mojo::MessageReceiverWithStatus, std::__Cr::default_delete<mojo::MessageReceiverWithStatus>>)+0x28c (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xb77e5b4)
    #12 0x00035e1769b4 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*)+0x8b8 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x1330a9b4)
    #13 0x00035e18b808 in mojo::MessageDispatcher::Accept(mojo::Message*)+0x2f0 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x1331f808)
    #14 0x00035e17bbdc in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*)+0x148 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x1330fbdc)
    #15 0x00035e19852c in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*)+0x624 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x1332c52c)
    #16 0x00035e197004 in mojo::internal::MultiplexRouter::Accept(mojo::Message*)+0x554 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x1332b004)
    #17 0x00035e18b808 in mojo::MessageDispatcher::Accept(mojo::Message*)+0x2f0 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x1331f808)
    #18 0x00035e169bd0 in mojo::Connector::DispatchMessage(mojo::ScopedHandleBase<mojo::MessageHandle>)+0x37c (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x132fdbd0)
    #19 0x00035e16b0e8 in mojo::Connector::ReadAllAvailableMessages()+0x234 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x132ff0e8)
    #20 0x00035e16ba60 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::Connector::*&&)(), base::WeakPtr<mojo::Connector>&&>, base::internal::BindState<true, true, false, void (mojo::Connector::*)(), base::WeakPtr<mojo::Connector>>, void ()>::RunOnce(base::internal::BindStateBase*)+0x15c (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x132ffa60)
    #21 0x00035da7a678 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&)+0x360 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12c0e678)
    #22 0x00035dadd444 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)+0x8f8 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12c71444)
    #23 0x00035dadc794 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork()+0x138 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12c70794)
    #24 0x00035dbfd604 in base::MessagePumpCFRunLoopBase::RunWork()+0x1c0 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12d91604)
    #25 0x00035dbeee1c in base::apple::CallWithEHFrame(void () block_pointer)+0xc (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12d82e1c)
    #26 0x00035dbfba84 in base::MessagePumpCFRunLoopBase::RunWorkSource(void*)+0xe4 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12d8fa84)
    #27 0x000189340bbc in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__+0x18 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x7dbbc)
    #28 0x000189340b50 in __CFRunLoopDoSource0+0xa8 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x7db50)
    #29 0x0001893408bc in __CFRunLoopDoSources0+0xe4 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x7d8bc)

previously allocated by thread T0 here:
    #0 0x000100751094 in __asan_memmove+0x2f88 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x55094)
    #1 0x00037452cad4 in operator new(unsigned long)+0x18 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x296c0ad4)
    #2 0x00036590f4f4 in std::__Cr::pair<std::__Cr::__tree_iterator<std::__Cr::__value_type<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, scoped_refptr<extensions::Extension const>>, std::__Cr::__tree_node<std::__Cr::__value_type<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, scoped_refptr<extensions::Extension const>>, void*>*, long>, bool> std::__Cr::__tree<std::__Cr::__value_type<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, scoped_refptr<extensions::Extension const>>, std::__Cr::__map_value_compare<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, std::__Cr::pair<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const, scoped_refptr<extensions::Extension const>>, std::__Cr::less<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>>>, std::__Cr::allocator<std::__Cr::pair<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const, scoped_refptr<extensions::Extension const>>>>::__emplace_unique<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, scoped_refptr<extensions::Extension const> const&>(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, scoped_refptr<extensions::Extension const> const&)::'lambda'(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, scoped_refptr<extensions::Extension const> const&)::operator()(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, scoped_refptr<extensions::Extension const> const&) const+0x190 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x1aaa34f4)
    #3 0x00036590d568 in extensions::ExtensionSet::Insert(scoped_refptr<extensions::Extension const> const&)+0x248 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x1aaa1568)
    #4 0x0003563701ec in extensions::ExtensionRegistrar::EnableExtension(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&)+0x384 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xb5041ec)
    #5 0x00035907adac in extensions::ChromeManagementAPIDelegate::EnableExtension(content::BrowserContext*, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&) const+0x180 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xe20edac)
    #6 0x000356ccb8b4 in extensions::ManagementSetEnabledFunction::OnManifestV2DeprecationChecked(bool)+0x184 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xbe5f8b4)
    #7 0x000356ccb51c in extensions::ManagementSetEnabledFunction::CheckManifestV2Deprecation()+0x310 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xbe5f51c)
    #8 0x000356ccad74 in extensions::ManagementSetEnabledFunction::CheckPermissionsIncrease()+0x350 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xbe5ed74)
    #9 0x000356cca7bc in extensions::ManagementSetEnabledFunction::OnRequirementsChecked(std::__Cr::set<extensions::PreloadCheck::Error, std::__Cr::less<extensions::PreloadCheck::Error>, std::__Cr::allocator<extensions::PreloadCheck::Error>> const&)+0x1fc (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xbe5e7bc)
    #10 0x000356cca458 in extensions::ManagementSetEnabledFunction::CheckRequirements(extensions::Extension const&)+0x284 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xbe5e458)
    #11 0x000356cc943c in extensions::ManagementSetEnabledFunction::Run()+0xa88 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xbe5d43c)
    #12 0x0003563004b4 in ExtensionFunction::RunWithValidation()+0x1b8 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xb4944b4)
    #13 0x00035630eeb0 in extensions::ExtensionFunctionDispatcher::DispatchWithCallbackInternal(mojo::StructPtr<extensions::mojom::RequestParams>, content::RenderFrameHost*, content::RenderProcessHost&, base::OnceCallback<void (ExtensionFunction::ResponseType, base::ListValue, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, mojo::StructPtr<extensions::mojom::ExtraResponseData>)>)+0xf10 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xb4a2eb0)
    #14 0x00035630f9d0 in extensions::ExtensionFunctionDispatcher::DispatchForServiceWorker(mojo::StructPtr<extensions::mojom::RequestParams>, int, base::OnceCallback<void (bool, base::ListValue, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, mojo::StructPtr<extensions::mojom::ExtraResponseData>)>)+0x3d8 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xb4a39d0)
    #15 0x000356482a10 in extensions::ServiceWorkerHost::RequestWorker(mojo::StructPtr<extensions::mojom::RequestParams>, base::OnceCallback<void (bool, base::ListValue, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, mojo::StructPtr<extensions::mojom::ExtraResponseData>)>)+0x244 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xb616a10)
    #16 0x0003565ea5b4 in extensions::mojom::ServiceWorkerHostStubDispatch::AcceptWithResponder(extensions::mojom::ServiceWorkerHost*, mojo::Message*, std::__Cr::unique_ptr<mojo::MessageReceiverWithStatus, std::__Cr::default_delete<mojo::MessageReceiverWithStatus>>)+0x28c (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xb77e5b4)
    #17 0x00035e1769b4 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*)+0x8b8 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x1330a9b4)
    #18 0x00035e18b808 in mojo::MessageDispatcher::Accept(mojo::Message*)+0x2f0 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x1331f808)
    #19 0x00035e17bbdc in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*)+0x148 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x1330fbdc)
    #20 0x00035e19852c in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*)+0x624 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x1332c52c)
    #21 0x00035e197004 in mojo::internal::MultiplexRouter::Accept(mojo::Message*)+0x554 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x1332b004)
    #22 0x00035e18b808 in mojo::MessageDispatcher::Accept(mojo::Message*)+0x2f0 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x1331f808)
    #23 0x00035e169bd0 in mojo::Connector::DispatchMessage(mojo::ScopedHandleBase<mojo::MessageHandle>)+0x37c (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x132fdbd0)
    #24 0x00035e16b0e8 in mojo::Connector::ReadAllAvailableMessages()+0x234 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x132ff0e8)
    #25 0x00035e16ba60 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::Connector::*&&)(), base::WeakPtr<mojo::Connector>&&>, base::internal::BindState<true, true, false, void (mojo::Connector::*)(), base::WeakPtr<mojo::Connector>>, void ()>::RunOnce(base::internal::BindStateBase*)+0x15c (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x132ffa60)
    #26 0x00035da7a678 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&)+0x360 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12c0e678)
    #27 0x00035dadd444 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)+0x8f8 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12c71444)
    #28 0x00035dadc794 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork()+0x138 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12c70794)
    #29 0x00035dbfd604 in base::MessagePumpCFRunLoopBase::RunWork()+0x1c0 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12d91604)

Thread T14 created by T0 here:
    #0 0x000100747ad0 in __sanitizer_weak_hook_memcmp+0x307c8 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x4bad0)
    #1 0x00035dbac28c in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType)+0x26c (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12d4028c)
    #2 0x00035db36418 in base::internal::WorkerThread::Start(scoped_refptr<base::SingleThreadTaskRunner>, base::WorkerThreadObserver*)+0x27c (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12cca418)
    #3 0x00035db03780 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::Flush()+0x244 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12c97780)
    #4 0x00035db034dc in base::internal::ThreadGroup::BaseScopedCommandsExecutor::~BaseScopedCommandsExecutor()+0x44 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12c974dc)
    #5 0x00035db098b0 in base::internal::ThreadGroupImpl::Start(unsigned long, unsigned long, base::TimeDelta, scoped_refptr<base::SingleThreadTaskRunner>, base::WorkerThreadObserver*, base::internal::ThreadGroup::WorkerEnvironment, bool, std::__Cr::optional<base::TimeDelta>)+0x3a8 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12c9d8b0)
    #6 0x00035db2ae40 in base::internal::ThreadPoolImpl::Start(base::ThreadPoolInstance::InitParams const&, base::WorkerThreadObserver*)+0x1454 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x12cbee40)
    #7 0x000355187b08 in content::StartBrowserThreadPool()+0x148 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xa31bb08)
    #8 0x00035a8a542c in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool)+0x83c (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xfa3942c)
    #9 0x00035a8a4954 in content::ContentMainRunnerImpl::Run()+0x568 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xfa38954)
    #10 0x00035a8a04a0 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*)+0x854 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xfa344a0)
    #11 0x00035a8a0990 in content::ContentMain(content::ContentMainParams)+0x190 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xfa34990)
    #12 0x00034ae71cb0 in ChromeMain+0x494 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x5cb0)
    #13 0x000100388bb0 in main+0x1f8 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/MacOS/Chromium:arm64+0x100000bb0)
    #14 0x000188ec7da0 in start+0x1b4c (/usr/lib/dyld:arm64e+0x1fda0)

SUMMARY: AddressSanitizer: heap-use-after-free (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0xb3f2aa4) in extensions::ExtensionInstallTimePermissionProvider::GetRuleIterator(content_settings::mojom::ContentSettingsType, bool) const+0x44c
Shadow bytes around the buggy address:
  0x606000277480: fd fd fd fa fa fa f7 fa fd fd fd fd fd fd fd fd
  0x606000277500: fa fa f7 fa fd fd fd fd fd fd fd fd fa fa f7 fa
  0x606000277580: fd fd fd fd fd fd fd fa fa fa f7 fa fd fd fd fd
  0x606000277600: fd fd fd fa fa fa f7 fa fd fd fd fd fd fd fd fd
  0x606000277680: fa fa f7 fa fd fd fd fd fd fd fd fa fa fa f7 fa
=>0x606000277700: fd[fd]fd fd fd fd fd fd fa fa f7 fa fd fd fd fd
  0x606000277780: fd fd fd fd fa fa f7 fa fd fd fd fd fd fd fd fa
  0x606000277800: fa fa f7 fa fd fd fd fd fd fd fd fd fa fa f7 fa
  0x606000277880: fd fd fd fd fd fd fd fd fa fa f7 fa fd fd fd fd
  0x606000277900: fd fd fd fa fa fa f7 fa fd fd fd fd fd fd fd fa
  0x606000277980: fa fa f7 fa fd fd fd fd fd fd fd fd fa fa f7 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==41907==ADDITIONAL INFO

==41907==Note: Please include this section with the ASan report.
Task trace:
    #0 0x00035c35c7a4 in SafetyHubService::UpdateAsync()+0x110 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x114f07a4)
    #1 0x000361003184 in IPC::ChannelAssociatedGroupController::Accept(mojo::Message*)+0x7c4 (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x16197184)
    #2 0x00035e1f9c68 in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int)+0x22c (/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7812.0/Chromium Framework:arm64+0x1338dc68)

Command line: `/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/Chromium.app/Contents/MacOS/Chromium --no-sandbox --user-data-dir=/tmp/fastcat-extension-registry-uaf-sites-profile --disable-breakpad --no-first-run --no-default-browser-check --enable-logging=stderr --disable-popup-blocking --disable-background-timer-throttling --disable-renderer-backgrounding --extensions-on-chrome-urls --disable-features=ExperimentalWebMachineLearningNeuralNetwork,WebMachineLearningNeuralNetwork,WebNNCoreML,WebNNCoreMLExplicitGPUOrNPU --load-extension=/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/manager,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0000,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0001,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0002,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0003,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0004,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0005,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0006,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0007,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0008,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0009,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0010,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0011,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0012,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0013,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0014,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0015,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0016,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0017,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0018,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0019,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0020,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0021,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0022,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0023,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0024,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0025,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0026,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0027,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0028,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0029,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0030,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0031,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0032,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0033,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0034,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0035,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0036,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0037,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0038,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0039,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0040,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0041,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0042,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0043,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0044,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0045,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0046,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0047,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0048,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0049,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0050,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0051,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0052,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0053,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0054,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0055,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0056,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0057,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0058,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0059,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0060,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0061,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0062,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0063,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0064,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0065,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0066,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0067,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0068,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0069,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0070,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0071,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0072,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0073,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0074,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0075,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0076,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0077,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0078,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0079,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0080,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0081,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0082,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0083,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0084,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0085,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0086,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0087,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0088,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0089,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0090,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0091,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0092,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0093,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0094,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0095,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0096,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0097,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0098,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0099,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0100,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0101,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0102,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0103,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0104,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0105,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0106,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0107,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0108,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0109,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0110,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0111,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0112,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0113,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0114,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0115,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0116,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0117,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0118,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0119,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0120,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0121,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0122,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0123,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0124,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0125,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0126,/Users/zh1x1an1221/Sites/fastcat-extension-registry-uaf-arm1621025/targets/t0127 --flag-switches-begin --flag-switches-end --file-url-path-alias=/gen=/Users/zh1x1an1221/collection-mac-asan-chromium/mac-release-arm64_asan-mac-release-1621025/gen http://127.0.0.1:9000/poc.html`

MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==41907==END OF ADDITIONAL INFO

Additional Data

Category: Security
Chrome Channel: Not sure
Regression: N/A \

View on issue tracker
Links in the report
On This Page