Chrome — 2026-W03
Clone-free silent-fix hunt over Chrome (Gerrit-sourced), 2026-01-12 → 2026-01-18. Every candidate
below is cherry-picked from the week’s merged security-relevant commits, triaged on
the patch-now / watch / noise ladder, given a full root-cause writeup, and
put through independent adversarial verification — the same bar as the WebKit
weekly reports.
This week. 19 candidates — 1 patch-now (RCE-class, attacker-reachable in default config), 16 watch (security-relevant but gated / weaker primitive / unproven), 1 noise, 1 duplicate. 19 root-caused · 18 tier-2 verified.
Candidates
Verdict: 🔴 patch-now (RCE-class, attacker-reachable in default config) · 🟡 watch (security-relevant but not confirmed patch-now — gated, weaker primitive, or unproven) · ⚪ noise (structural false positive) · 🔁 dup (cherry-pick). ✔︎verified = passed independent adversarial tier-2 review; ~plausible = tier-2 could not fully confirm from the diff. Conf is confidence the commit is a genuine security fix.
| Verdict | Class | Conf | Sev | CVSS | Component | Commit | Primitive |
|---|---|---|---|---|---|---|---|
| 🔴 patch-now · ✔︎verified | UAF | 0.9 | high | 7.5 | content/browser/ |
01c3da8955 |
Use-after-free of RenderWidgetHostViewAura when DestroyWindow() on the legacy HWND pumps window messages that re-enter and destroy the view mid-OnWindowDestroying(). |
| 🟡 watch | IntegerOverflow | 0.7 | low | 3.1 | — |
d7d097b65c |
SVG feTurbulence filter subregion exceeding INT_MAX float-casts to a garbage/overflowed SkISize passed to Skia’s TurbulencePaintFilter. |
| 🟡 watch · ✔︎verified | use-after-free | 0.6 | medium | 6.5 | services/network/enterprise |
105200496f |
crypto::Aead::Init retains a reference to the passed key bytes; those pointed into EncryptionContext, so if it was destroyed the Aead read freed key memory. Fix copies derived_key_ into ChunkedEncryptor. |
| 🟡 watch · ✔︎verified | use-after-poison | 0.6 | medium | 6.5 | third_party/blink/renderer |
209f799f3e |
Oilpan poisons GCed memory before running dtors; the trace-session observer list held a pointer into a PaintTimingVisualizer embedded in a GCed object, dereferenced after poison. Fix holds it via unique_ptr outside the GC heap. |
| 🟡 watch · ✔︎verified | ipc-input-validation | 0.6 | medium | 6.5 | content/browser/indexed_db |
81341707ff |
A renderer could send a file with last_modified before the Windows epoch (negative delta); the browser accepted it into IndexedDBExternalObject, per a ClusterFuzz testcase. Fix rejects such values. |
| 🟡 watch · ✔︎verified | null-deref | 0.6 | medium | 6.5 | third_party/blink/renderer |
bdcb10e3b7 |
media::VideoFrame::WrapSharedImage may return nullptr; the old code then called frame->set_color_space(), dereferencing null. Fix captures gfx_color_space up front and applies it only to a valid frame. |
| 🟡 watch · ✔︎verified | reachable-NOTREACHED/crash | 0.55 | low | 5.3 | third_party/blink/renderer |
16adc8a864 |
Events forwarded by a label to its form control are always isTrusted, bypassing the isTrusted() filter and creating a SoftNavigationContext where WebSchedulingTaskState::ForkAndSetVariable assumed none, hitting NOTREACHED. Fix uses IsFullyTrusted() and downgrades to NotFatalUntil M149. |
🔁 dup of 16adc8a864 |
reachable-NOTREACHED/crash | 0.55 | low | 5.3 | third_party/blink/renderer |
2ae8fe41b5 |
Same as parent: label-forwarded ’trusted’ clicks create an unexpected SoftNavigationContext, tripping NOTREACHED in web scheduling task state. Fix switches to IsFullyTrusted(). |
| 🟡 watch · ✔︎verified | undefined-behavior/float-cast-overflow | 0.55 | low | 5.0 | third_party/blink/renderer |
c1860bfe0f |
OrientationMediaFeatureEval cast viewport width/height through int, overflowing on extreme values (UBSAN float-cast-overflow). Fix uses doubles. |
| 🟡 watch · ✔︎verified | renderer-crash/bad-state | 0.5 | medium | 6.5 | third_party/blink/renderer |
07e904d119 |
PaintLayer visual-overflow recalc walked into content-visibility-locked subtrees; fix defers the recalc (NotifyVisualOverflowRecalcWasBlocked) until unlock instead of operating on locked/incomplete layout. |
| 🟡 watch · ✔︎verified | detached-arraybuffer-access | 0.5 | medium | 6.5 | third_party/blink/renderer |
29670ccd49 |
The depth buffer became a longer-lived cached object; without a detach check, script could obtain a DOMArrayBuffer that was already detached (backing store gone). Fix throws on IsDetached() and guards recreate-vs-copy. |
| 🟡 watch · ✔︎verified | logic-UB/NaN-DCHECK | 0.5 | low | 5.0 | third_party/blink/renderer |
bfbac7d2e3 |
For calcMode=spline with duplicated trailing keyTimes not ending at 1, CalculateKeyTimesIndex returned a bad index producing inf then NaN in Bezier math, tripping a DCHECK. Fix rejects such splines. |
| 🟡 watch · ✔︎verified | crash/stale-cache-read | 0.45 | low | 5.0 | third_party/blink/renderer |
30bde0efb4 |
During frozen-cache serialization, IsIncludedInTree() on recursively-visited children with stale cached values triggered CheckCanAccessCachedValues, hitting NOTREACHED. Fix reads CachedIsIncludedInTree() directly. |
| 🟡 watch · ~plausible | css-type-validation | 0.45 | low | 5.3 | third_party/blink/renderer |
c4d17d27b5 |
abs() failed to validate its operand’s type, accepting intermediate-result types (e.g. calc(100% + abs(1vmin * 10%))) it should reject. Fix returns nullptr when the operand IsIntermediateResult. |
| 🟡 watch · ~plausible | invalid-state-access | 0.45 | medium | 6.0 | third_party/blink/renderer |
c773351fb1 |
The methods only checked layer->HasSharedImage(), allowing calls for a layer not in the active render state; fix requires session()->renderState()->HasLayer(layer). |
| 🟡 watch · ~plausible | use-after-free/stale-member | 0.4 | medium | 6.0 | third_party/blink/renderer |
264b431711 |
microtasks_pauser_, prescient_networking_ and link_preview_triggerer_ were not reset during LocalFrame detach, so post-detach access could touch stale state. Fix resets them at detach time. |
| 🟡 watch · ✔︎verified | null-deref/hardening | 0.4 | low | 5.3 | third_party/blink/renderer |
79286fe09f |
body_loader_ is sometimes null when StartLoadingInternal calls body_loader_->SetDefersLoading, a null dereference (crbug 471268403). A CHECK is added to catch it. |
| 🟡 watch · ✔︎verified | layout-crash | 0.4 | low | 5.0 | third_party/blink/renderer |
e7d8e0eb72 |
A recent feature allowed adding a fieldset child with a non-null before_child, which LayoutFieldset::AddChild did not expect, crashing on a float dynamic change. Fix routes through the existing before_child selection logic. |
| ⚪ noise | NotSecurity | 0.05 | dev | 0.0 | third_party/blink/renderer/core/ |
864f0cb333 |
Layout feature: allow scroll overflow in all directions for ::overscroll-area-parent pseudo-elements. |