Medium chrome UAF 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactUse after free in Glic
DescriptionUse after free in Glic
ComponentGlic
Bug ClassUAF
Tracker506311914
Fix commit140f34b1d05d (chromium/src) +2/-2
CISA KEVNot listed
CreditedWeipeng Jiang (@Krace) of VRI
Disclosed2026-06-02

Files Changed

  • chrome/browser/ui/webui/skills/skills_dialog_handler.cc
From 140f34b1d05dcf207b694be6f44f47147810d284 Mon Sep 17 00:00:00 2001
From: marissa shen <marissashen@google.com>
Date: Wed, 29 Apr 2026 13:41:12 -0700
Subject: [PATCH] record metrics before closing/deleting dialog to avoid heap-use-after-free

Bug: b:506311914
Change-Id: I5e55470683ff130d974bbd70a2b29a53cf82f7a3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7804170
Reviewed-by: Howard Chang <howardcha@google.com>
Commit-Queue: marissa shen <marissashen@google.com>
Cr-Commit-Position: refs/heads/main@{#1622693}
---

diff --git a/chrome/browser/ui/webui/skills/skills_dialog_handler.cc b/chrome/browser/ui/webui/skills/skills_dialog_handler.cc
index b56bdd59..64396cf 100644
--- a/chrome/browser/ui/webui/skills/skills_dialog_handler.cc
+++ b/chrome/browser/ui/webui/skills/skills_dialog_handler.cc
@@ -118,8 +118,8 @@
                            /*is_edit_mode=*/IsEditMode(&initial_skill_));
   // Triggers toast
   delegate_->OnSkillSaved(response->id);
-  delegate_->CloseDialog();
   RecordSkillsSaveResult(SkillsSaveResult::kSuccess);
+  delegate_->CloseDialog();
   std::move(wrapped_callback).Run(true);
 }
 
@@ -129,9 +129,9 @@
   }
   // Triggers toast
   delegate_->OnSkillDeleted(skill_id);
-  delegate_->CloseDialog();
   RecordSkillsDialogAction(SkillsDialogAction::kDeleted, entrypoint_,
                            /*is_edit_mode=*/true);
+  delegate_->CloseDialog();
 }
 
 void SkillsDialogHandler::CloseDialog() {
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.