Chrome — 2026-W34
Clone-free silent-fix hunt over Chrome (Gerrit-sourced), 2026-08-17 → 2026-08-23. Every candidate
below is cherry-picked from the week’s merged security-relevant commits, triaged on
the patch-now / watch / noise ladder, given a full root-cause writeup, and
put through independent adversarial verification — the same bar as the WebKit
weekly reports.
This week. 25 candidates — 2 patch-now (RCE-class, attacker-reachable in default config), 7 watch (security-relevant but gated / weaker primitive / unproven), 16 noise, 0 duplicate. 25 root-caused · 25 tier-2 verified.
Candidates
Verdict: 🔴 patch-now (RCE-class, attacker-reachable in default config) · 🟡 watch (security-relevant but not confirmed patch-now — gated, weaker primitive, or unproven) · ⚪ noise (structural false positive) · 🔁 dup (cherry-pick). ✔︎verified = passed independent adversarial tier-2 review; ~plausible = tier-2 could not fully confirm from the diff. Conf is confidence the commit is a genuine security fix.
| Verdict | Class | Conf | Sev | CVSS | Component | Commit | Primitive |
|---|---|---|---|---|---|---|---|
| 🔴 patch-now · ✔︎verified | UAF | 7.5 | content/browser/ |
9d149ff313 |
[M151] [FedCM] Fix UAF when double clicking user other account | ||
| 🔴 patch-now · ✔︎verified | UAF | 8.1 | third_party/blink/renderer/core/ |
e404fdbb24 |
[M150] Add defensive copy in CollectFlattenedAssignedNodes | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
02e9309d4c |
[css-grid] Remove grid gap suppression flag | ||
| 🟡 watch · ~plausible | None | 0.0 | services/ |
0c12ca0334 |
hid: Support Feature and Output reports on Android | ||
| 🟡 watch · ✔︎verified | InputValidation | 5.3 | third_party/blink/renderer/modules/ |
10596a9178 |
[M144] Validate framebufferTextureMultiviewOVR target, attachment | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
171d5f7a03 |
Webium: skip quirk css initialization for initial web ui | ||
| 🟡 watch · ✔︎verified | LogicError | 4.3 | third_party/blink/renderer/core/ |
18edac1dca |
Consistently set XML parser ‘already started’ flag from parseFromString. | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
19958fb507 |
media: Report EME setServerCertificate UKM | ||
| 🟡 watch · ✔︎verified | UAF | 7.0 | media/ |
27bf1601ad |
[M144-LTS] media/audio/cras: Fix Use-After-Free in CrasInputStream | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
29a0d64a12 |
Eliminate redundant structured-header item type checks | ||
| ⚪ noise | None | 0.0 | content/browser/ |
38efd6ad13 |
[loader] Size the file:// response pipe to the file, capped at 2 MiB | ||
| 🟡 watch · ~plausible | OOB | 6.5 | services/ |
3dc8321375 |
WebNN: Emit self-consistent ONNX pooling descriptors for ceil rounding | ||
| 🟡 watch · ✔︎verified | UAF | 3.1 | gpu/command_buffer/ |
4b3e281393 |
[gpu] Safely handle in-process SharedImageInterface teardown | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
506d810bf1 |
[Switch Attribute] Add basic semantics | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
5c5b1c83e8 |
tests: tear down TaskEnvironment after ScopedFeatureList [blink] | ||
| ⚪ noise | LogicError | 2.0 | third_party/blink/renderer/core/ |
5c71e7722b |
Update both GeometryUtils endpoints before conversion | ||
| ⚪ noise | LogicError | 0.0 | third_party/blink/renderer/modules/ |
76e1371c4c |
[Interop 2026] WebRTC: Ignore IDs for in-band channels | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
7dd5671c5b |
Fix unsafe buffer usage in ImageDownloaderImpl | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
8ad7aba990 |
ProcessedLocalAudioSource invariant for APM location. | ||
| 🟡 watch · ✔︎verified | LogicError | 3.1 | third_party/blink/renderer/modules/ |
9f00fd0c8f |
[indexeddb] Fix aborted connection issue | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
e3e8cec916 |
[AdTracker] Remove cycle prevention logic and associated UMA | ||
| ⚪ noise | UAF | 3.1 | third_party/blink/renderer/core/ |
e833c61fd9 |
[agy][blink] Fix UAP in SynchronouslyComposite | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
eb285c41f7 |
Remove unused ScheduleCustomElementInvalidations | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
edde451c7d |
[Interop 2026] Use auto as the default ViewTimeline inset | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
fe3a61480e |
webgpu: Add snorm10-10-10-2 to GPUVertexFormat |