Chrome — 2026-W41
Clone-free silent-fix hunt over Chrome (Gerrit-sourced), 2026-10-05 → 2026-10-11. Every candidate
below is cherry-picked from the week’s merged security-relevant commits, triaged on
the patch-now / watch / noise ladder, given a full root-cause writeup, and
put through independent adversarial verification — the same bar as the WebKit
weekly reports.
This week. 25 candidates — 11 patch-now (RCE-class, attacker-reachable in default config), 2 watch (security-relevant but gated / weaker primitive / unproven), 12 noise, 0 duplicate. 11 root-caused · 11 tier-2 verified.
Candidates
Verdict: 🔴 patch-now (RCE-class, attacker-reachable in default config) · 🟡 watch (security-relevant but not confirmed patch-now — gated, weaker primitive, or unproven) · ⚪ noise (structural false positive) · 🔁 dup (cherry-pick). ✔︎verified = passed independent adversarial tier-2 review; ~plausible = tier-2 could not fully confirm from the diff. Conf is confidence the commit is a genuine security fix.
| Verdict | Class | Conf | Sev | CVSS | Component | Commit | Primitive |
|---|---|---|---|---|---|---|---|
| 🔴 patch-now · ✔︎verified | UAF | 0.96 | high | — | content/browser/ |
20ad69f21b |
reentrant DestroySelf()->ReleaseChild() frees Lock C while SetEvictingSubrootLock() still runs, then writes evicting_subroot_lock_ into freed memory |
| 🔴 patch-now · ✔︎verified | UAF | 0.96 | high | — | content/browser/ |
7443fea938 |
reentrant DestroySelf()->ReleaseChild() frees Lock C while SetEvictingSubrootLock() still runs, then writes evicting_subroot_lock_ into freed memory |
| 🔴 patch-now · ✔︎verified | UAF | 0.96 | high | — | content/browser/ |
b6217069e0 |
reentrant DestroySelf()->ReleaseChild() frees Lock C while SetEvictingSubrootLock() still runs, then writes evicting_subroot_lock_ into freed memory |
| 🔴 patch-now · ✔︎verified | UAF | 0.95 | high | — | content/browser/ |
6d93ae61d4 |
heap-UAF write to freed BluetoothDeviceScanningPromptController via prompt_ after synchronous FrameDetach in a nested message loop |
| 🔴 patch-now · ~plausible | UAF | 0.92 | high | — | content/browser/ |
403a04e98d |
dangling base::Unretained(this) deferred binder callbacks in MojoBinderPolicyApplier after broker destroyed before prerender activation -> UAF on activation |
| 🔴 patch-now · ✔︎verified | UAF | 0.9 | high | — | content/browser/ |
2cc38f4761 |
dangling raw_ptr to a destroyed RenderWidgetHostViewInput used during async touch-ack / GestureFlingCancel |
| 🔴 patch-now · ✔︎verified | UAF | 0.82 | medium | — | third_party/blink/renderer/core/ |
0afb939d22 |
use of a GC-invalidated HeapHashMap iterator (it->value) in SVGResource::ResourceContainer/FindCycle |
| 🔴 patch-now · ~plausible | Race | 0.8 | medium | — | third_party/blink/renderer/core/ |
bf298c5fc5 |
single-threaded MailboxTextureBacking bound to the main-thread GPU context used on worker threads |
| 🔴 patch-now · ✔︎verified | UAF | 0.75 | medium | — | third_party/blink/renderer/core/ |
60126f0149 |
dangling unique_ptr& into pattern_map_ slot invalidated when the map is cleared during BuildPatternData -> UAF write |
| 🔴 patch-now · ✔︎verified | UAF | 0.75 | medium | — | third_party/blink/renderer/core/ |
a8a28009b6 |
dangling unique_ptr& into pattern_map_ slot invalidated when the map is cleared during BuildPatternData -> UAF write |
| 🔴 patch-now · ~plausible | Race | 0.65 | medium | — | third_party/blink/renderer/modules/ |
c8af26985b |
TOCTOU race between main-thread SetChannelCount and audio-thread render -> channel-count mismatch -> OOB in PushPullFIFO copy |
| 🟡 watch | UAF | 0.5 | medium | — | gpu/ipc/ |
a7135d0a59 |
dangling thread-local SharedContextState pointer when recreating a directly-lost context |
| 🟡 watch | LogicError | 0.3 | low | — | third_party/blink/renderer/core/ |
7a532b0a86 |
renderer CHECK failure (DoS) in MayHaveHTMLLabel when AX serialized with dirty layout |
| ⚪ noise | NotSecurity | 0.1 | dev | — | third_party/blink/renderer/core/ |
95423aac8b |
none - replaces unreachable null-throw with CHECK invariant |
| ⚪ noise | NotSecurity | 0.08 | low | — | media/ |
2e19496f98 |
none — raw_ptr-in-container hardening of media/gpu/test helpers |
| ⚪ noise | NotSecurity | 0.08 | low | — | third_party/blink/renderer/core/ |
4359510eb6 |
none — reorders cheap checks before origin-trial feature checks |
| ⚪ noise | NotSecurity | 0.07 | low | — | third_party/blink/renderer/core/ |
01a6f96982 |
none — raw_ptr/raw_ref hardening + enabling check-raw-ptr-in-blink flag |
| ⚪ noise | NotSecurity | 0.05 | dev | — | third_party/blink/renderer/core/ |
1f1ed7e434 |
none - behavior-equivalent refactor |
| ⚪ noise | NotSecurity | 0.05 | dev | — | third_party/blink/renderer/modules/ |
66cff27c8c |
none - encapsulation refactor |
| ⚪ noise | NotSecurity | 0.05 | dev | — | third_party/blink/renderer/core/ |
7aacc4a359 |
none - defers a non-fatal CHECK milestone |
| ⚪ noise | NotSecurity | 0.05 | dev | — | third_party/blink/renderer/modules/ |
7cb99e3a2d |
none - UMA code extraction |
| ⚪ noise | NotSecurity | 0.05 | dev | — | third_party/blink/renderer/core/ |
8eddc4af8d |
none - ad-highlight UI feature |
| ⚪ noise | NotSecurity | 0.05 | dev | — | third_party/blink/renderer/core/ |
9190d5cbac |
none - V8 API migration |
| ⚪ noise | NotSecurity | 0.05 | low | — | third_party/blink/renderer/core/ |
c7309abff5 |
none — adds DanglingUntriaged annotation to already-converted raw_ptr fields |
| ⚪ noise | NotSecurity | 0.03 | dev | — | content/browser/ |
dae61c2cda |
none - test-only change |