UAF 15 CVEs 15 mapped CWE-416CWE-362 2026-03 → 2026-09

A map, hash map, or flag reached from more than one thread (GPU IO vs main, async pipeline creation, or concurrent device connections) is accessed without synchronization — a concurrent insert/erase/rehash corrupts it and hands out dangling entries.

Invariant
Any container or state flag reachable from more than one thread must be guarded; an unsynchronized insert/erase/rehash corrupts it and dangles the entries other threads hold.

Mechanism

A base::flat_map/absl::flat_hash_map, or a shared “operation in progress” flag, is reached from two threads — the GPU IO thread and the GPU main thread, several async pipeline-creation threads, or multiple WebUSB DeviceImpl connections to one physical device. Access is unsynchronized.

A concurrent insert or erase triggers a rehash/reallocation while another thread is mid-read, dangling its iterator or handle → use-after-free / OOB in the GPU or device process. The flag variant races across per-connection instances: a destroyed connection leaks the shared flag as permanently “in progress”, wedging the device.

Fix shape

Wrap the container in a lock and route every access through it (base::Lock + GUARDED_BY, or MutexProtected<...> with Use/ConstUse); resolve create-races by destroying the losing duplicate; and track such state per-instance, clearing it on destruction.

CVEs in this pattern

13 components · V8, Core, Input, Chromecast, Payments, USB, Skia, GPU, Serial, Dawn, ANGLE, Video, WebGPU
CVEWhatComponentVendorSeverityMonth
CVE-2026-87504 UAF in Core Core chrome Medium 2026-09 🔧
CVE-2026-87542 UAF in Input Input chrome High 2026-09 🔧
CVE-2026-87588 UAF in Chromecast Chromecast chrome Medium 2026-09 🔧
CVE-2026-87615 Race in Payments Payments chrome Medium 2026-09 🔧
CVE-2026-95280 Race in V8 V8 chrome High 2026-09 🔧
CVE-2026-76044 Race in USB USB chrome High 2026-08 🔧
CVE-2026-78899 UAF in V8 V8 chrome High 2026-08 🔧
CVE-2026-17712 Race in Skia Skia chrome High 2026-07 🔧
CVE-2026-13775 UAF in GPU GPU chrome Critical 2026-06 🔧
CVE-2026-11012 UAF in Serial Serial chrome Medium 2026-06 🔧
CVE-2026-14394 UAF in V8 V8 chrome Low 2026-06 🔧
CVE-2026-9874 UAF in Daw Dawn chrome Critical 2026-05 🔧
CVE-2026-7901 UAF in ANGLE ANGLE chrome High 2026-05 🔧
CVE-2026-6359 UAF in Video Video chrome High 2026-04 🔧
CVE-2026-4678 UAF in WebGPU WebGPU chrome High 2026-03 🔧

Hunt for siblings

Flag container members reached from more than one thread that have no lock sibling / GUARDED_BY annotation.

grep / ripgrep
# Container members with no GUARDED_BY in the same header:
rg -n 'flat_map|flat_hash_map|base::flat_map' --glob '*.h' gpu/ ui/gl/ \
  | rg -v 'GUARDED_BY'

Mitigations that would catch this class

  • GUARDED_BY annotations + Clang thread-safety analysis on every cross-thread container
  • TSan coverage of the GPU IO/main-thread and async-pipeline paths
  • Prefer a single-threaded owner + posted tasks over a shared mutable container