PatchGap
Chrome · WebUI

CVE-2026-113058

UAF in WebUI
High chrome UAF 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactUse after free in WebUI
DescriptionUse after free in WebUI
ComponentWebUI
Bug ClassUAF
Tracker551059870
Fix commit738f50bbfc2b (chromium/src) +707/-50
CISA KEVNot listed
CreditedOGINOME Tomohito
Disclosed2026-10-20

Files Changed

  • chrome/test/base/web_ui_test_data_source.cc
  • chrome/browser/ui/webui/ash/settings/pages/multidevice/multidevice_section_unittest.cc
  • chrome/browser/chrome_content_browser_client.h
  • content/browser/webui/web_ui_data_source_impl.cc
  • content/browser/webui/shared_resources_data_source.cc
  • content/browser/webui/web_ui_data_source_impl.h
  • content/browser/renderer_host/render_frame_host_impl.cc
  • chrome/browser/devtools/devtools_ui_bindings.cc
  • content/browser/download/save_file_manager.cc
  • chrome/browser/ui/webui/theme_source.cc
  • content/browser/download/download_manager_impl.cc
  • chrome/browser/chrome_content_browser_client.cc
  • content/browser/webui/web_ui_url_loader_factory_unittest.cc
  • content/browser/webui/web_ui_security_browsertest.cc
  • extensions/browser/guest_view/web_view/web_ui/web_ui_url_fetcher.cc
  • content/public/browser/web_ui_url_loader_factory.h
  • chromecast/browser/cast_content_browser_client.cc
  • chrome/browser/ui/webui/favicon_source.cc
  • content/browser/webui/web_ui_data_source_unittest.cc
  • content/browser/loader/navigation_url_loader_impl.cc
  • chrome/browser/ui/webui/theme_source_unittest.cc
  • content/browser/webui/web_ui_url_loader_factory.cc
  • content/browser/worker_host/worker_script_fetcher.cc
  • content/public/browser/web_ui_data_source.h
  • chrome/browser/ui/webui/favicon_source.h

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
On This Page