Chrome — 2026-W38
Clone-free silent-fix hunt over Chrome (Gerrit-sourced), 2026-09-14 → 2026-09-20. Every candidate
below is cherry-picked from the week’s merged security-relevant commits, triaged on
the patch-now / watch / noise ladder, given a full root-cause writeup, and
put through independent adversarial verification — the same bar as the WebKit
weekly reports.
This week. 18 candidates — 7 patch-now (RCE-class, attacker-reachable in default config), 9 watch (security-relevant but gated / weaker primitive / unproven), 2 noise, 0 duplicate. 18 root-caused · 18 tier-2 verified.
Candidates
Verdict: 🔴 patch-now (RCE-class, attacker-reachable in default config) · 🟡 watch (security-relevant but not confirmed patch-now — gated, weaker primitive, or unproven) · ⚪ noise (structural false positive) · 🔁 dup (cherry-pick). ✔︎verified = passed independent adversarial tier-2 review; ~plausible = tier-2 could not fully confirm from the diff. Conf is confidence the commit is a genuine security fix.
| Verdict | Class | Conf | Sev | CVSS | Component | Commit | Primitive |
|---|---|---|---|---|---|---|---|
| 🔴 patch-now · ✔︎verified | UAF | 0.9 | high | 8.8 | content/browser/locks |
e8c064e9c3 |
SharedWorkerHost outlives its renderer process, leaving a dangling observer in LockManager::client_observer_map_ that a later lock-contention notification dereferences. |
| 🔴 patch-now · ✔︎verified | UAF | 0.85 | high | 8.8 | third_party/blink/renderer |
6814ac2453 |
Re-entrant slot-assignment recalc (depth>=2) clears assigned_nodes_ during iteration -> use-after-free in the renderer. |
| 🔴 patch-now · ✔︎verified | OOB-write | 0.85 | high | 8.8 | gpu/command_buffer/service |
db684a2d12 |
Attacker-forged AHardwareBuffer dimensions bypass odd-dimension checks; dest sized widthheight3/2 (floor) vs libyuv NV12Copy (ceil) -> ~1.3MB OOB write of renderer-controlled bytes in the GPU process. |
| 🔴 patch-now · ✔︎verified | UAF | 0.82 | high | 8.0 | content/browser/web_contents |
8068cdd59a |
ForSecurityDropFullscreen() runs observers that can destroy the initiating RenderFrameHostImpl; the raw pointer is then dereferenced -> browser-process heap-UAF. |
| 🔴 patch-now · ✔︎verified | UAF | 0.82 | high | 8.0 | content/browser/bluetooth |
8c794651ad |
Showing the BT scanning prompt drops fullscreen, spinning a nested loop where a FrameDetach IPC destroys the RFHI and BluetoothDeviceScanningPromptController; assigning prompt_ afterward is a UAF write. |
| 🔴 patch-now · ✔︎verified | UAF | 0.8 | high | 8.0 | third_party/blink/renderer |
fff1540a69 |
AdapterRef::~AdapterRef on the signaling thread runs main-thread disposal (MediaStreamVideoTrack::RemoveSink) unsynchronized -> data race and UAF. |
| 🔴 patch-now · ✔︎verified | UAF | 0.55 | medium | 6.0 | gpu/command_buffer/service |
f3958d766c |
ReadPixelsCallbackThreadSafe could invoke a callback after the caller returned early on context loss -> potential stack use-after-free. |
| 🟡 watch · ✔︎verified | UAF | 0.6 | medium | 5.0 | net/proxy_resolution/configured_proxy_resolution_request.cc |
121d438314 |
QueryComplete calls QueryDidComplete before removing this from pending_requests_; on PAC termination SetReady() re-dispatches the still-listed request -> re-entrant QueryComplete destroys this -> UAF. |
| 🟡 watch · ✔︎verified | Spoofing | 0.6 | medium | 5.0 | content/browser/renderer_host |
6ab025cb13 |
A compromised renderer could position select/date/color popups above the top-level main frame’s view, over browser UI including the omnibox -> address-bar spoofing. |
| 🟡 watch · ✔︎verified | UAF | 0.6 | medium | 4.5 | content/browser/devtools |
e0dc8587bb |
In-loop detachment synchronously destroys sibling DevToolsAgentHosts; fix collects strong refs first. |
| 🟡 watch · ✔︎verified | InputValidation | 0.5 | medium | 5.5 | media/gpu/android |
48e2c97586 |
Renderer-supplied spatial_layers had no upper bound at the Mojo boundary; fix rejects >kMaxSpatialLayers and adds CHECK_LE in encoder backends. |
| 🟡 watch · ✔︎verified | Race | 0.45 | low | 4.0 | services/audio/output_controller.cc |
3e92f02010 |
snoopers_ was searched (contains/find) without holding snooper_lock_ against concurrent OnMoreData reads on the real-time audio thread. |
| 🟡 watch · ✔︎verified | PolicyBypass | 0.4 | low | 3.1 | content/browser/renderer_host |
7a0ece0c74 |
PDF documents are denied their origin’s stored data; the factory is no longer installed at commit so a PDF has no filesystem: loader at all. |
| 🟡 watch · ✔︎verified | UAF | 0.4 | low | 3.5 | third_party/blink/renderer |
d3c3b2604c |
Script that synchronously detaches the frame during plugin destruction would cause a UAF; the CL forbids script during destruction. |
| 🟡 watch · ✔︎verified | UAF | 0.35 | low | 3.1 | content/browser/renderer_host |
119decf26f |
observers_ was UncheckedAndDanglingUntriaged; switched to CheckedObserver to prevent future teardown dangling-pointer errors. |
| 🟡 watch · ✔︎verified | Race | 0.35 | low | 2.5 | mojo/core/channel_fuchsia.cc |
e25025bb32 |
ChannelFuchsia::ShutDownOnIOThread didn’t set reject_writes_, so concurrent Write() could race handle reset and write to ZX_HANDLE_INVALID. |
| ⚪ noise | NotSecurity | 0.15 | dev | 0.0 | third_party/blink/renderer |
cb4a2c66da |
getUniformIndices returned an empty array on validation failure; WebGL2 requires null. |
| ⚪ noise | NotSecurity | 0.1 | dev | 0.0 | third_party/blink/renderer |
cf760f0d28 |
Adds an IsPaintable() guard to GetPaintCanvas() const as step 1 of decoupling recorder_ lifetime. |