A shared container is mutated from two threads without a lock
A map, hash map, or flag reached from more than one thread (GPU IO vs main, async pipeline creation, or concurrent device connections) is accessed without synchronization — a concurrent insert/erase/rehash corrupts it and hands out dangling entries.
Mechanism
A base::flat_map/absl::flat_hash_map, or a shared “operation in progress” flag, is reached from two threads — the GPU IO thread and the GPU main thread, several async pipeline-creation threads, or multiple WebUSB DeviceImpl connections to one physical device. Access is unsynchronized.
A concurrent insert or erase triggers a rehash/reallocation while another thread is mid-read, dangling its iterator or handle → use-after-free / OOB in the GPU or device process. The flag variant races across per-connection instances: a destroyed connection leaks the shared flag as permanently “in progress”, wedging the device.
Fix shape
base::Lock + GUARDED_BY, or MutexProtected<...> with Use/ConstUse); resolve create-races by destroying the losing duplicate; and track such state per-instance, clearing it on destruction.CVEs in this pattern
13 components · V8, Core, Input, Chromecast, Payments, USB, Skia, GPU, Serial, Dawn, ANGLE, Video, WebGPU| CVE | What | Component | Vendor | Severity | Month | |
|---|---|---|---|---|---|---|
| CVE-2026-87504 | UAF in Core | Core | chrome | Medium | 2026-09 | 🔧 |
| CVE-2026-87542 | UAF in Input | Input | chrome | High | 2026-09 | 🔧 |
| CVE-2026-87588 | UAF in Chromecast | Chromecast | chrome | Medium | 2026-09 | 🔧 |
| CVE-2026-87615 | Race in Payments | Payments | chrome | Medium | 2026-09 | 🔧 |
| CVE-2026-95280 | Race in V8 | V8 | chrome | High | 2026-09 | 🔧 |
| CVE-2026-76044 | Race in USB | USB | chrome | High | 2026-08 | 🔧 |
| CVE-2026-78899 | UAF in V8 | V8 | chrome | High | 2026-08 | 🔧 |
| CVE-2026-17712 | Race in Skia | Skia | chrome | High | 2026-07 | 🔧 |
| CVE-2026-13775 | UAF in GPU | GPU | chrome | Critical | 2026-06 | 🔧 |
| CVE-2026-11012 | UAF in Serial | Serial | chrome | Medium | 2026-06 | 🔧 |
| CVE-2026-14394 | UAF in V8 | V8 | chrome | Low | 2026-06 | 🔧 |
| CVE-2026-9874 | UAF in Daw | Dawn | chrome | Critical | 2026-05 | 🔧 |
| CVE-2026-7901 | UAF in ANGLE | ANGLE | chrome | High | 2026-05 | 🔧 |
| CVE-2026-6359 | UAF in Video | Video | chrome | High | 2026-04 | 🔧 |
| CVE-2026-4678 | UAF in WebGPU | WebGPU | chrome | High | 2026-03 | 🔧 |
Hunt for siblings
Flag container members reached from more than one thread that have no lock sibling / GUARDED_BY annotation.
# Container members with no GUARDED_BY in the same header:
rg -n 'flat_map|flat_hash_map|base::flat_map' --glob '*.h' gpu/ ui/gl/ \
| rg -v 'GUARDED_BY'
Mitigations that would catch this class
GUARDED_BYannotations + Clang thread-safety analysis on every cross-thread container- TSan coverage of the GPU IO/main-thread and async-pipeline paths
- Prefer a single-threaded owner + posted tasks over a shared mutable container