[1486:1486:0401/141510.405574:ERROR:content/browser/renderer_host/navigation_throttle_registry_impl.cc:177] [UAFPoc] Registering UAFPocThrottle for http://127.0.0.1:8889/target?uafpoc-trigger
[1486:1486:0401/141510.424839:ERROR:content/browser/renderer_host/navigation_throttle_registry_impl.cc:113] [UAFPoc] WillProcessResponse: arming the bug
[1486:1486:0401/141510.424952:ERROR:content/browser/renderer_host/navigation_throttle_registry_impl.cc:167] [UAFPoc] WillProcessResponse: returning DEFER. response_body_watcher_ is now armed; Resume() task is queued.
[1486:1486:0401/141510.444490:ERROR:content/browser/renderer_host/navigation_throttle_registry_impl.cc:183] [UAFPoc] DeferredResume: calling NavigationThrottle::Resume(). response_body_watcher_ should still be armed.
[1486:1486:0401/141510.444556:ERROR:content/browser/renderer_host/navigation_throttle_registry_impl.cc:131] [UAFPoc] response_body_callback: body.size()=0 -- calling ResetNavigationRequest() to free NavigationRequest + all throttles
[1486:1486:0401/141510.447198:ERROR:content/browser/renderer_host/navigation_throttle_registry_impl.cc:106] [UAFPoc] ~UAFPocThrottle: throttle is being FREED. resuming_throttle in NavigationRequest::Resume() now dangles.
[1486:1486:0401/141510.447854:ERROR:content/browser/renderer_host/navigation_throttle_registry_impl.cc:137] [UAFPoc] response_body_callback: returned. NavigationRequest and resuming_throttle are now freed. Next access in Resume() is UAF.
=================================================================
==1486==ERROR: AddressSanitizer: heap-use-after-free on address 0x7b6350fe7450 at pc 0x55fb97b4ad2f bp 0x7ffe153f8750 sp 0x7ffe153f8748
READ of size 8 at 0x7b6350fe7450 thread T0 (chrome)
    #0 0x55fb97b4ad2e in content::NavigationRequest::Resume(content::NavigationThrottle*) content/browser/renderer_host/navigation_request.cc:8406:54
    #1 0x55fb9010b737 in content::NavigationThrottle::Resume() content/public/browser/navigation_throttle.cc:95:63
    #2 0x55fb97b9e911 in content::(anonymous namespace)::UAFPocThrottle::DeferredResume() content/browser/renderer_host/navigation_throttle_registry_impl.cc:185:5
    #3 0x55fb97b9f040 in base::internal::Invoker<base::internal::FunctorTraits<void (content::(anonymous namespace)::UAFPocThrottle::*&&)(), base::WeakPtr<content::(anonymous namespace)::UAFPocThrottle>&&>, base::internal::BindState<true, true, false, void (content::(anonymous namespace)::UAFPocThrottle::*)(), base::WeakPtr<content::(anonymous namespace)::UAFPocThrottle>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #4 0x55fba2bed916 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #5 0x55fba2c64fb9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #6 0x55fba2c63e2a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #7 0x55fba2e13314 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:782:48
    #8 0x55fba2c666c7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #9 0x55fba2b68290 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #10 0x55fb9666788c in content::BrowserMainLoop::RunMainMessageLoop() content/browser/browser_main_loop.cc:1105:18
    #11 0x55fb9666ff3c in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner_impl.cc:151:15
    #12 0x55fb9665e5bc in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:32:28
    #13 0x55fb9e70633f in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:696:10
    #14 0x55fb9e70a328 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1320:10
    #15 0x55fb9e7097ba in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1150:12
    #16 0x55fb9e703161 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #17 0x55fb9e70375c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #18 0x55fb8ac36b39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #19 0x7f235282b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x7b6350fe7450 is located 0 bytes inside of 48-byte region [0x7b6350fe7450,0x7b6350fe7480)
freed by thread T0 (chrome) here:
    #0 0x55fb8ac35c3d in operator delete(void*) (/chromium/chromium/src/out/asan/chrome+0x10e14c3d) (BuildId: 7d3d209a8ea69df6)
    #1 0x55fb97b9dda2 in content::(anonymous namespace)::UAFPocThrottle::~UAFPocThrottle() content/public/browser/navigation_throttle.h:30:3
    #2 0x55fb97b9d74b in std::__Cr::vector<std::__Cr::unique_ptr<content::NavigationThrottle, std::__Cr::default_delete<content::NavigationThrottle>>, std::__Cr::allocator<std::__Cr::unique_ptr<content::NavigationThrottle, std::__Cr::default_delete<content::NavigationThrottle>>>>::__destroy_vector::operator()() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #3 0x55fb97b99d9c in content::NavigationThrottleRegistryImpl::~NavigationThrottleRegistryImpl() gen/third_party/libc++/src/include/__vector/vector.h:259:67
    #4 0x55fb97af964d in content::NavigationRequest::~NavigationRequest() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #5 0x55fb97affd83 in content::NavigationRequest::~NavigationRequest() content/browser/renderer_host/navigation_request.cc:2304:41
    #6 0x55fb978b1aaf in content::FrameTreeNode::ResetNavigationRequestButKeepState(content::NavigationDiscardReason) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #7 0x55fb978b1e25 in content::FrameTreeNode::ResetNavigationRequest(content::NavigationDiscardReason) content/browser/renderer_host/frame_tree_node.cc:642:3
    #8 0x55fb97b9ec96 in base::internal::Invoker<base::internal::FunctorTraits<content::(anonymous namespace)::UAFPocThrottle::WillProcessResponse()::'lambda'(content::FrameTreeNode*, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&)&&, content::FrameTreeNode*&&>, base::internal::BindState<false, false, false, content::(anonymous namespace)::UAFPocThrottle::WillProcessResponse()::'lambda'(content::FrameTreeNode*, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&), base::internal::UnretainedWrapper<content::FrameTreeNode, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&)>::RunOnce(base::internal::BindStateBase*, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&) content/browser/renderer_host/navigation_throttle_registry_impl.cc:135:16
    #9 0x55fb97b4a854 in content::NavigationRequest::Resume(content::NavigationThrottle*) base/functional/callback.h:155:12
    #10 0x55fb9010b737 in content::NavigationThrottle::Resume() content/public/browser/navigation_throttle.cc:95:63
    #11 0x55fb97b9e911 in content::(anonymous namespace)::UAFPocThrottle::DeferredResume() content/browser/renderer_host/navigation_throttle_registry_impl.cc:185:5
    #12 0x55fb97b9f040 in base::internal::Invoker<base::internal::FunctorTraits<void (content::(anonymous namespace)::UAFPocThrottle::*&&)(), base::WeakPtr<content::(anonymous namespace)::UAFPocThrottle>&&>, base::internal::BindState<true, true, false, void (content::(anonymous namespace)::UAFPocThrottle::*)(), base::WeakPtr<content::(anonymous namespace)::UAFPocThrottle>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #13 0x55fba2bed916 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #14 0x55fba2c64fb9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #15 0x55fba2c63e2a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #16 0x55fba2e13314 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:782:48
    #17 0x55fba2c666c7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #18 0x55fba2b68290 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #19 0x55fb9666788c in content::BrowserMainLoop::RunMainMessageLoop() content/browser/browser_main_loop.cc:1105:18
    #20 0x55fb9666ff3c in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner_impl.cc:151:15
    #21 0x55fb9665e5bc in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:32:28
    #22 0x55fb9e70633f in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:696:10
    #23 0x55fb9e70a328 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1320:10
    #24 0x55fb9e7097ba in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1150:12
    #25 0x55fb9e703161 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #26 0x55fb9e70375c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #27 0x55fb8ac36b39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #28 0x7f235282b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

previously allocated by thread T0 (chrome) here:
    #0 0x55fb8ac353fd in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e143fd) (BuildId: 7d3d209a8ea69df6)
    #1 0x55fb97b9a5dc in content::NavigationThrottleRegistryImpl::RegisterNavigationThrottles() content/public/browser/navigation_throttle.h:30:3
    #2 0x55fb97b0d5a9 in content::NavigationRequest::WillStartRequest() content/browser/renderer_host/navigation_request.cc:8524:25
    #3 0x55fb97b0486c in content::NavigationRequest::BeginNavigationImpl() content/browser/renderer_host/navigation_request.cc:3096:3
    #4 0x55fb97b007b5 in content::NavigationRequest::BeginNavigation() content/browser/renderer_host/navigation_request.cc:2602:3
    #5 0x55fb97bb2543 in content::Navigator::OnBeginNavigation(content::FrameTreeNode*, mojo::StructPtr<blink::mojom::CommonNavigationParams>, mojo::StructPtr<blink::mojom::BeginNavigationParams>, scoped_refptr<network::SharedURLLoaderFactory>, mojo::PendingAssociatedRemote<content::mojom::NavigationClient>, scoped_refptr<content::PrefetchedSignedExchangeCache>, int, mojo::PendingReceiver<content::mojom::NavigationRendererCancellationListener>, mojo::PendingReceiver<blink::mojom::NavigationResumeDeferredCommitListener>) content/browser/renderer_host/navigator.cc:1410:23
    #6 0x55fb97c6f902 in content::RenderFrameHostImpl::BeginNavigation(mojo::StructPtr<blink::mojom::CommonNavigationParams>, mojo::StructPtr<blink::mojom::BeginNavigationParams>, mojo::PendingRemote<blink::mojom::BlobURLToken>, mojo::PendingAssociatedRemote<content::mojom::NavigationClient>, mojo::PendingRemote<blink::mojom::NavigationStateKeepAliveHandle>, mojo::PendingReceiver<content::mojom::NavigationRendererCancellationListener>, mojo::PendingReceiver<blink::mojom::NavigationResumeDeferredCommitListener>) content/browser/renderer_host/render_frame_host_impl.cc:11631:33
    #7 0x55fb9073adcf in content::mojom::FrameHostStubDispatch::Accept(content::mojom::FrameHost*, mojo::Message*) gen/content/common/frame.mojom.cc:5847:13
    #8 0x55fba29ad659 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
    #9 0x55fba29cb3e3 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:51:24
    #10 0x55fba29b3b03 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #11 0x55fba68d3dbd in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #12 0x55fba68d6245 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #13 0x55fba2bed916 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #14 0x55fba2c64fb9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #15 0x55fba2c63e2a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #16 0x55fba2e129d8 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46
    #17 0x55fba2e15f98 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43
    #18 0x7f2353ca4718 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x54718) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d)

SUMMARY: AddressSanitizer: heap-use-after-free content/browser/renderer_host/navigation_request.cc:8406:54 in content::NavigationRequest::Resume(content::NavigationThrottle*)
Shadow bytes around the buggy address:
  0x7b6350fe7180: f7 fa fd fd fd fd fd fa f7 fa 00 00 00 00 00 00
  0x7b6350fe7200: f7 fa fd fd fd fd fd fd f7 fa fd fd fd fd fd fd
  0x7b6350fe7280: f7 fa fd fd fd fd fd fd f7 fa fd fd fd fd fd fa
  0x7b6350fe7300: f7 fa fd fd fd fd fd fd f7 fa fd fd fd fd fd fd
  0x7b6350fe7380: f7 fa fd fd fd fd fd fd f7 fa fd fd fd fd fd fa
=>0x7b6350fe7400: f7 fa fd fd fd fd fd fd f7 fa[fd]fd fd fd fd fd
  0x7b6350fe7480: f7 fa 00 00 00 00 00 fa f7 fa fd fd fd fd fd fd
  0x7b6350fe7500: f7 fa fd fd fd fd fd fd f7 fa fd fd fd fd fd fa
  0x7b6350fe7580: f7 fa fd fd fd fd fd fd f7 fa fd fd fd fd fd fa
  0x7b6350fe7600: f7 fa fd fd fd fd fd fa f7 fa fd fd fd fd fd fd
  0x7b6350fe7680: f7 fa fd fd fd fd fd fd f7 fa fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==1486==ADDITIONAL INFO

==1486==Note: Please include this section with the ASan report.
Task trace:
    #0 0x55fb97b9e2a6 in content::(anonymous namespace)::UAFPocThrottle::WillProcessResponse() content/browser/renderer_host/navigation_throttle_registry_impl.cc:164:9
    #1 0x55fba383e6b3 in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) mojo/public/cpp/system/simple_watcher.cc:103:13


Command line: `/chromium/chromium/src/out/asan/chrome --no-sandbox --no-first-run --no-default-browser-check --disable-gpu --headless=new --user-data-dir=/tmp/chrome-poc-profile --enable-logging=stderr --v=0 --noerrdialogs --ozone-platform=headless --ozone-override-screen-size=800,600 --use-angle=swiftshader-webgl --flag-switches-begin --flag-switches-end http://127.0.0.1:8889/`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==1486==END OF ADDITIONAL INFO

==1486==ABORTING