PatchGap · Weakness Pattern
Stale pointer survives destruction order or cleanup path
WP-TEARDOWN-UAF
UAF
9 CVEs
9 mapped
CWE-416 use-after-freeCWE-672 operation on resource after expiration or release
2026-05 → 2026-09
An object is freed while a peer, guard, container, or asynchronous task still holds a pointer into it, or an error path skips the cleanup that a success path performs. The dangling reference is later used, read, or destroyed. The defect is one of static lifetime, destruction ordering, or error-path cleanup, with no re-entry into user code.
Invariant
Every owner or peer holding a pointer into an object must relinquish or outlive it in a deterministic order, and every failure path must undo the same partial state that the success path tears down; lifetime must not depend on unspecified destruction order or container address stability.
Mechanism
delete this frees an object while a peer still holds its native pointer (CVE-2026-13788), or a stack lock guard outlives the object it guards (CVE-2026-85049), or std::tuple leaves member destruction order unspecified (CVE-2026-15774). A TArray/map reallocates on growth while raw element pointers are treated as stable (CVE-2026-17653, CVE-2026-19176). Error paths skip cleanup: UNREACHABLE() guards a reachable failure (CVE-2026-14398), an RAII destructor only asserts instead of cleaning up (CVE-2026-95325), post-link tasks are joined only on success (CVE-2026-9878), or a worklet-thread refcount becomes the last owner and destructs off-thread (CVE-2026-95343).
Fix shape
Establish a deterministic teardown order (notify peers before free, name and scope guards, use explicit structs over tuples) and make every error path perform the same cleanup as success, or copy values out instead of holding pointers into reallocating containers.
CVEs in this pattern
4 components · Skia, ANGLE, WebAudio, Fullscreen| CVE | What | Component | Vendor | Severity | Month | |
|---|---|---|---|---|---|---|
| CVE-2026-85049 | UAF in Skia | Skia | chrome | High | 2026-09 | 🔧 |
| CVE-2026-95325 | UAF in ANGLE | ANGLE | chrome | Medium | 2026-09 | 🔧 |
| CVE-2026-95343 | UAF in WebAudio | WebAudio | chrome | High | 2026-09 | 🔧 |
| CVE-2026-19176 | UAF in Skia | Skia | chrome | High | 2026-08 | 🔧 |
| CVE-2026-15774 | UAF in Skia | Skia | chrome | High | 2026-07 | 🔧 |
| CVE-2026-17653 | UAF in Skia | Skia | chrome | Critical | 2026-07 | 🔧 |
| CVE-2026-13788 | UAF in Fullscree | Fullscreen | chrome | Critical | 2026-06 | 🔧 |
| CVE-2026-14398 | UAF in ANGLE | ANGLE | chrome | Critical | 2026-06 | 🔧 |
| CVE-2026-9878 | UAF in ANGLE | ANGLE | chrome | Critical | 2026-05 | 🔧 |
Hunt for siblings
Auditor/fuzzer signal: delete this or destructor ordering near peers that hold native pointers, raw pointers into TArray/std::map elements crossing an insert/grow, or RAII destructors that only DCHECK/UNREACHABLE on error paths.
Mitigations that would catch this class
- Notify or detach peers before delete, and give lock guards explicit scopes ending before free
- Copy values out of reallocating containers rather than holding element pointers across mutation
- Make every ANGLE_TRY / early-return / link-failure path run the same cleanup and task-join as success