← Chrome — 2026-W40
e3754d928925bb05ad8b6e80268d3f7ab2ed92b2 Convert ChildFrameCompositor to GarbageCollectedMixin
severity medium
class UAF
confidence 0.65
signal score 8.97
third_party/blink/renderer/core/
Primitive: raw_ptr to non-GCed base of GCed RemoteFrame invisible to Oilpan
Triage note: ChildFrameCompositingHelper held raw_ptr<ChildFrameCompositor> to RemoteFrame (GC-managed); converts to GarbageCollectedMixin+WeakPersistent. Genuine UAF-class hardening, but the comment states ownership keeps the pointer non-null, so no reachable reclamation demonstrated.
Triage note: ChildFrameCompositingHelper held raw_ptr<ChildFrameCompositor> to RemoteFrame (GC-managed); converts to GarbageCollectedMixin+WeakPersistent. Genuine UAF-class hardening, but the comment states ownership keeps the pointer non-null, so no reachable reclamation demonstrated.
Structural signals: smartptr_member_added (+3.0), security_assert (+6.47), area:third_party/blink/renderer/core/ (+2.5)
Commit message
Convert ChildFrameCompositor to GarbageCollectedMixin
Before / after
Loading diff…
On This Page