Chrome — 2026-W36
Clone-free silent-fix hunt over Chrome (Gerrit-sourced), 2026-08-31 → 2026-09-06. Every candidate
below is cherry-picked from the week’s merged security-relevant commits, triaged on
the patch-now / watch / noise ladder, given a full root-cause writeup, and
put through independent adversarial verification — the same bar as the WebKit
weekly reports.
This week. 22 candidates — 4 patch-now (RCE-class, attacker-reachable in default config), 7 watch (security-relevant but gated / weaker primitive / unproven), 11 noise, 0 duplicate. 22 root-caused · 22 tier-2 verified.
Candidates
Verdict: 🔴 patch-now (RCE-class, attacker-reachable in default config) · 🟡 watch (security-relevant but not confirmed patch-now — gated, weaker primitive, or unproven) · ⚪ noise (structural false positive) · 🔁 dup (cherry-pick). ✔︎verified = passed independent adversarial tier-2 review; ~plausible = tier-2 could not fully confirm from the diff. Conf is confidence the commit is a genuine security fix.
| Verdict | Class | Conf | Sev | CVSS | Component | Commit | Primitive |
|---|---|---|---|---|---|---|---|
| 🔴 patch-now · ✔︎verified | UAF | 8.1 | content/browser/ |
5d16106435 |
[FedCM] Fix UAF in content::webid::Request | ||
| 🔴 patch-now · ✔︎verified | UAF | 8.1 | — |
91fd9726d3 |
[M152] Prevent crash if WidgetBase is destroyed during GetTextInputType. | ||
| 🔴 patch-now · ✔︎verified | UAF | 8.1 | content/browser/ |
d402226fba |
[M154] [FedCM] Fix UAF in content::webid::Request | ||
| 🔴 patch-now · ✔︎verified | UAF | 8.1 | content/browser/ |
f9d51570c8 |
[M154] Fix UAF in TouchEventAckQueue::ProcessAckedTouchEvents | ||
| ⚪ noise | None | 0 | third_party/blink/renderer/core/ |
22701ab78e |
Remove the CSSColorQuantizedAlphaOnlyLegacy flag | ||
| ⚪ noise | None | 0 | third_party/blink/renderer/core/ |
49e2d8ee08 |
Remove the QuoteFirstLineStyle runtime flag |
||
| 🟡 watch · ✔︎verified | UAF | 5.9 | content/browser/ |
693bdacc0e |
Add null check to prevent UAF during shutdown | ||
| ⚪ noise | None | 0 | third_party/blink/renderer/core/ |
86e6d00205 |
[layout] Make LayoutObject::HasStyle DCHECK-only. | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
878c12216c |
[webvtt] Size cue line boxes from the cue text font | ||
| 🟡 watch · ✔︎verified | UAF | 7.3 | services/ |
9b683ce132 |
WebNN: Keep ORT mapped D3D12 buffer alive | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
a5f54f15d0 |
canvas: Include HDR metadata in resource comparison | ||
| 🟡 watch · ✔︎verified | DoS | 4.0 | services/ |
adfbd9b296 |
WebNN: Guard against duplicate context removal on disconnect | ||
| 🟡 watch · ✔︎verified | InfoDisclosure | 6.5 | third_party/blink/renderer/core/ |
b3572c490c |
[M152] [HiC] Fix privacy leaks due to feature flag checks | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
bd805e3ea3 |
Don’t pass explicit nullptr break token to BlockNode::Layout(). | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
c2c25c0739 |
[line-clamp] Make ellipsis-displaced lines not pushed down by floats | ||
| 🟡 watch · ✔︎verified | DoS | 3.1 | third_party/blink/renderer/core/ |
cfc5c14962 |
[layout] Don’t compute borders for sections/rows. | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
d01cd8785a |
Remove the FirstLineOnListItem runtime flag |
||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
d326ba9b05 |
[layout] Switch full_remove_insert to being true within MakeChildrenNonInline. | ||
| 🟡 watch · ✔︎verified | UAF | 6.5 | content/browser/ |
d5b7179880 |
[M153] Prevent UAF in TargetHandler::SetAttachedTargetsOfType | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
e12a671a12 |
[M154] blink / extensions: Force minimum scale to 1 in Android on auto resize | ||
| ⚪ noise | None | 0.0 | content/browser/ |
e2e2bedab9 |
[Gardener] Disable AccessibilityAudio on Linux with ASan/LSan | ||
| 🟡 watch · ✔︎verified | PolicyBypass | 4.3 | third_party/blink/renderer/core/ |
e4a9d76ade |
Exclude chrome-untrusted:// from access to the unbounded API |