Chrome — 2026-W35
Clone-free silent-fix hunt over Chrome (Gerrit-sourced), 2026-08-24 → 2026-08-30. Every candidate
below is cherry-picked from the week’s merged security-relevant commits, triaged on
the patch-now / watch / noise ladder, given a full root-cause writeup, and
put through independent adversarial verification — the same bar as the WebKit
weekly reports.
This week. 23 candidates — 1 patch-now (RCE-class, attacker-reachable in default config), 3 watch (security-relevant but gated / weaker primitive / unproven), 18 noise, 0 duplicate, 1 not yet analyzed. 22 root-caused · 22 tier-2 verified.
Candidates
Verdict: 🔴 patch-now (RCE-class, attacker-reachable in default config) · 🟡 watch (security-relevant but not confirmed patch-now — gated, weaker primitive, or unproven) · ⚪ noise (structural false positive) · 🔁 dup (cherry-pick). ✔︎verified = passed independent adversarial tier-2 review; ~plausible = tier-2 could not fully confirm from the diff. Conf is confidence the commit is a genuine security fix.
| Verdict | Class | Conf | Sev | CVSS | Component | Commit | Primitive |
|---|---|---|---|---|---|---|---|
| 🔴 patch-now · ✔︎verified | UAF | 8.8 | third_party/blink/renderer/modules/ |
1e6fb5edb5 |
[M150] [WebRTC] Ensure WebRtcMediaStreamTrackAdapter is disposed on main thread | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
040623943d |
Reset font orientation when resolving canvas 2D fonts | ||
| ⚪ noise | LogicError | 2.0 | third_party/blink/renderer/core/ |
05a48fa69c |
Fix foster parenting into a template element | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
07b5a93d5a |
Fix unsafe buffer usage in PaintPropertyTreeBuilderTest | ||
| ⚪ noise | DoS | 1.8 | content/browser/ |
1775a79c3d |
cpu_performance: Do not crash on corrupted override setting | ||
| ⚪ noise | InputValidation | 3.1 | third_party/blink/renderer/core/ |
2c28ee75bf |
Check for NaN on progress() eager simplification path | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
2e75a3c596 |
Change WebDX names for out of order streaming | ||
| 🟡 watch · ✔︎verified | DoS | 4.3 | media/ |
30fadc3391 |
Fix null delegate dereference in MediaDevicesPermissionChecker | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
48695c998d |
[grid] Micro optimizations in GridPlacement | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
7aee5af032 |
Restore attributionsrc parsing in window.open to stub API | ||
| ⚪ noise | None | 0.0 | content/browser/ |
7d2115a464 |
[FedCM] Guard UserInfoRequest against re-entrant destruction | ||
| ⚪ noise | Race | 2.0 | third_party/blink/renderer/modules/ |
909aca0010 |
[WebXR] Forward texture array swap chain sync token | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
9807e6b575 |
Make Performance::SuspendObserver() idempotent | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
9a71218b4e |
[gap-decorations] Reuse gap range lookup | ||
| 🟡 watch · ✔︎verified | UAF | 7.1 | net/ |
a87859ad7a |
[M152] [Fortify] [CPRS] Fix UAF in ConfiguredProxyResolutionRequest::QueryComplete | ||
| ⚪ noise | LogicError | 3.1 | third_party/blink/renderer/core/ |
aa515a8ee3 |
CHECK that tree-scopes are populated before applying | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
ad23e586b6 |
Exclude PlacedGridItem prev_/next_ pointers from raw_ptr | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
c4e75dcfde |
[iframe] Fix a minor styling issue in IsAllowOrigins |
||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
e85deef6d4 |
Remove table_collapsed_borders from PhysicalFragmentRareData union | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
e85f6334af |
Migrate to [Get|Set]ContinuationPreservedEmbedderData from V2 API | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
f3a7362d62 |
Create tree-scoped computed names for timeline-trigger shorthand | ||
| 🟡 watch · ~plausible | UAF | 8.8 | third_party/blink/renderer/core/ |
fe5c369f21 |
[M150] Protect ParseChunk against re-entrancy |