Chrome — 2026-W33
Clone-free silent-fix hunt over Chrome (Gerrit-sourced), 2026-08-10 → 2026-08-16. Every candidate
below is cherry-picked from the week’s merged security-relevant commits, triaged on
the patch-now / watch / noise ladder, given a full root-cause writeup, and
put through independent adversarial verification — the same bar as the WebKit
weekly reports.
This week. 23 candidates — 1 patch-now (RCE-class, attacker-reachable in default config), 9 watch (security-relevant but gated / weaker primitive / unproven), 13 noise, 0 duplicate. 23 root-caused · 23 tier-2 verified.
Candidates
Verdict: 🔴 patch-now (RCE-class, attacker-reachable in default config) · 🟡 watch (security-relevant but not confirmed patch-now — gated, weaker primitive, or unproven) · ⚪ noise (structural false positive) · 🔁 dup (cherry-pick). ✔︎verified = passed independent adversarial tier-2 review; ~plausible = tier-2 could not fully confirm from the diff. Conf is confidence the commit is a genuine security fix.
| Verdict | Class | Conf | Sev | CVSS | Component | Commit | Primitive |
|---|---|---|---|---|---|---|---|
| 🔴 patch-now · ✔︎verified | UAF | 8.8 | third_party/blink/renderer/core/ |
412333a8f5 |
[M144] Add defensive copy in CollectFlattenedAssignedNodes | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
0b49f6c3d6 |
[AF] Decrease IntersectionObserver threshold for omnibox autofill | ||
| 🟡 watch · ✔︎verified | UAF | 5.1 | net/ |
1970523598 |
[Code health] Remove dangling pointer in QuicChromiumClientSession | ||
| 🟡 watch · ✔︎verified | DoS | 3.1 | third_party/blink/renderer/modules/ |
1f9ec27bbe |
[WebAudio] Use TryAllocate in AudioWorklet output buffer allocation | ||
| 🟡 watch · ~plausible | InputValidation | 5.3 | third_party/blink/renderer/modules/ |
25189dfe0a |
[WebAudio] MediaStreamAudioSourceNode error with large render quantum | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
2c254e7723 |
audio: Centralize voice isolation defaults in AudioProcessingProperties | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
32bb556976 |
[webgpu] Add GPURenderBundleEncoderDescriptor::usesResourceTable. | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
38f7e5fab8 |
[M152] Remove zoom from SVGImage container scale | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
446da4ecf5 |
Make CSSSelectorList::Empty() a thread-local singleton | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
629c9e55b5 |
Remove SlotAssignNotifyDifferentShadowRoots flag | ||
| 🟡 watch · ~plausible | UAF | 3.1 | third_party/blink/renderer/core/ |
77e479c3f2 |
[autofill] Remove SelfKeepAlive from WebFormElementObserverImpl | ||
| 🟡 watch · ✔︎verified | DoS | 3.1 | third_party/blink/renderer/modules/ |
7f42272d65 |
[M152] Built-In AI APIs: Check execution_context for console messaging | ||
| 🟡 watch · ✔︎verified | UAF | 4.0 | mojo/ |
9d6494bbf8 |
Destruct cdm_factory_ before frame_interfaces_ to avoid dangling pointer |
||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
9f095c1cbb |
Remove AnchorFocusRingFix flag | ||
| 🟡 watch · ~plausible | DoS | 3.1 | third_party/blink/renderer/core/ |
9fb68176b4 |
Skip cull rect update when a layer doesn’t have LocalBorderBoxProperties | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
a68b302afa |
[WebAudio] Expose renderQuantumSize to devtools and inspector | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
ab7fa1a171 |
Optimize HitTestRequest stop node handling | ||
| 🟡 watch · ✔︎verified | InputValidation | 4.3 | third_party/blink/renderer/modules/ |
adf0c557b6 |
[M151] Validate framebufferTextureMultiviewOVR target, attachment | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
bb999c5a44 |
Improve unit testing of moveBefore | ||
| ⚪ noise | LogicError | 2.0 | third_party/blink/renderer/modules/ |
db54c6c1b2 |
[M152] Built-in AI: Gate model session creation on adequate cache disk space | ||
| 🟡 watch · ✔︎verified | DoS | 3.5 | mojo/ |
e8736f9d1a |
[mojo] Guard VM buffer address access in ChannelMac | ||
| ⚪ noise | LogicError | 2.0 | third_party/blink/renderer/core/ |
ed31635c44 |
[HiC] Correct parent lookup in IsFocusableStyle | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
f093d1a056 |
[M151] Fix flag-check in LayoutSVGShape::ComputeNonScalingStrokeTransform |