From e533bd77f25f9786d206314b076bd4ed50df9dee Mon Sep 17 00:00:00 2001
From: Jakob Kummerow <[email protected]>
Date: Mon, 10 Aug 2026 20:45:05 +0200
Subject: [PATCH] [wasm][sandbox] CHECK for SetUrl() race

An attacker with in-sandbox corruption can cause a race condition
around WasmStreaming::SetUrl(). Mitigate that with CHECKs.

Fixed: 542146471
Change-Id: I844b8d5da7f38b4c73f0105c56aabb7d54009034
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8233198
Auto-Submit: Jakob Kummerow <[email protected]>
Reviewed-by: Matthias Liedtke <[email protected]>
Commit-Queue: Matthias Liedtke <[email protected]>
Cr-Commit-Position: refs/heads/main@{#109173}
---

diff --git a/src/wasm/streaming-decoder.h b/src/wasm/streaming-decoder.h
index 2f5094a..d6b5b5a 100644
--- a/src/wasm/streaming-decoder.h
+++ b/src/wasm/streaming-decoder.h
@@ -125,7 +125,16 @@
   std::shared_ptr<const std::string> shared_url() const { return url_; }
 
   void SetUrl(base::Vector<const char> url) {
+    // We shouldn't modify {url_} while it is being read. The API contract
+    // hence states that {SetUrl()} must be called early.
+    // Enforcing this with a CHECK is possibly racy when an attacker with an
+    // in-sandbox corruption primitive performs a swapping attack. If that
+    // becomes a problem, we can add a lock. As an attack mitigation, a CHECK
+    // that fails most of the time is probably good enough.
+    SBXCHECK_EQ(stream_state_, kReceivingBytes);
     url_->assign(url.begin(), url.size());
+    // Safely crash if a race did happen:
+    SBXCHECK_EQ(stream_state_, kReceivingBytes);
   }
 
   static std::unique_ptr<StreamingDecoder> Create(