Chrome — 2026-W37
Clone-free silent-fix hunt over Chrome (Gerrit-sourced), 2026-09-07 → 2026-09-13. Every candidate
below is cherry-picked from the week’s merged security-relevant commits, triaged on
the patch-now / watch / noise ladder, given a full root-cause writeup, and
put through independent adversarial verification — the same bar as the WebKit
weekly reports.
This week. 24 candidates — 6 patch-now (RCE-class, attacker-reachable in default config), 3 watch (security-relevant but gated / weaker primitive / unproven), 15 noise, 0 duplicate. 24 root-caused · 24 tier-2 verified.
Candidates
Verdict: 🔴 patch-now (RCE-class, attacker-reachable in default config) · 🟡 watch (security-relevant but not confirmed patch-now — gated, weaker primitive, or unproven) · ⚪ noise (structural false positive) · 🔁 dup (cherry-pick). ✔︎verified = passed independent adversarial tier-2 review; ~plausible = tier-2 could not fully confirm from the diff. Conf is confidence the commit is a genuine security fix.
| Verdict | Class | Conf | Sev | CVSS | Component | Commit | Primitive |
|---|---|---|---|---|---|---|---|
| 🔴 patch-now · ✔︎verified | UAF | 8.1 | content/browser/ |
4e5229cb51 |
[M152] Prevent UAF during re-entrant destruction in IME callouts. | ||
| 🔴 patch-now · ✔︎verified | TypeConfusion | 6.5 | third_party/blink/renderer/core/ |
550f34cd98 |
Incorrect cast to CSSSuperellipseValue | ||
| 🔴 patch-now · ✔︎verified | UAF | 8.1 | content/browser/ |
553b8e73bf |
[M154] Fix UAF in WebContentsImpl when dropping fullscreen for dialogs | ||
| 🔴 patch-now · ✔︎verified | UAF | 8.1 | content/browser/ |
98e3a15c06 |
[M153] Fix Browser-process Heap-UAF in LockManager caused by stale SharedWorkerHost | ||
| 🔴 patch-now · ✔︎verified | UAF | 8.8 | third_party/blink/renderer/core/ |
b374b0cf7b |
[M153] Fix slot assignment recalculation depth check and add defensive copies | ||
| 🔴 patch-now · ✔︎verified | UAF | 8.8 | third_party/blink/renderer/core/ |
fd4e928e7b |
[parser] Store stable element identity in adoption agency Bookmark | ||
| ⚪ noise | LogicError | 2.0 | third_party/blink/renderer/core/ |
15269f9710 |
Clamp depths below 1px in CSSPerspective::toMatrix() | ||
| ⚪ noise | LogicError | 3.1 | third_party/blink/renderer/modules/ |
201279053c |
Implicitly disable PLS during generateMipmap. | ||
| ⚪ noise | LogicError | 2.0 | third_party/blink/renderer/core/ |
3107f5b294 |
[HitTest] Forward bounds in LayoutSVG* to AddNodeToListBasedTestResult |
||
| ⚪ noise | LogicError | 2.5 | third_party/blink/renderer/core/ |
4628fb0004 |
[css] Treat valueluess dynamic-range values as truthy | ||
| 🟡 watch · ✔︎verified | DoS | 4.3 | third_party/blink/renderer/modules/ |
627c7dc35b |
[Blink] Fetch ClientSharedImage early in CreateExternalTexture | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
65f7e60841 |
Fix outside-flat-tree TODO | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
746b09d5ad |
[M154] Dictation: Keep caret in view when committing text | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
77b09f26af |
PaintTiming: Disable kPaintTimingWaitForPresentationFrameIndex | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
7b82bfcde1 |
[webgpu] Add AtomicVec2uMinMax as an unsafe feature | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
84cd244ec2 |
shrink-to-fit: Support fieldset and legend | ||
| 🟡 watch · ~plausible | TypeConfusion | 5.3 | third_party/blink/renderer/core/ |
9456bac0b6 |
Restrict EventTrigger target to Node. | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
9b1b9d52b8 |
Clipboard: construct SystemClipboard from an ExecutionContext | ||
| 🟡 watch · ✔︎verified | DoS | 5.3 | third_party/blink/renderer/core/ |
9f9aa5ace6 |
[gap-decorations] Fix crash with huge row gaps | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
aab3b4d31a |
[EditContext] Update selection before textupdate on deletion | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
b24bd5c2f2 |
Disable aggressive throttling when a WebHID device is open | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
b501e9c553 |
CanvasAsyncBlobCreator: Remove premature alpha conversion | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
befb9aa803 |
[M154] [PeerConnection] Disable WebRtcGenerateRemoteTrackIds feature | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
f694563691 |
dom: Avoid re-hashing key in TreeOrderedMap::Get() miss path |