PatchGap
Chrome · PlatformIntegration › Internals>PlatformIntegration

CVE-2026-113133

Memory Corruption in PlatformIntegration (Internals>PlatformIntegration)
Medium chrome Memory Corruption 📄 Reporter bug report 🔧 Commit mapped

Overview

Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactMemory corruption in PlatformIntegration
DescriptionMemory corruption in PlatformIntegration
ComponentPlatformIntegration
Sub-componentInternals>PlatformIntegration
Bug ClassMemory Corruption
Tracker565349184
Fix commit399641915f15 (chromium/src) +107/-6
CISA KEVNot listed
CreditedRoshan Singh
Disclosed2026-10-20

Changed Functions

FunctionChangeNotes
if
ui/shell_dialogs/select_file_dialog_linux_portal.cc
 modified
FakeWindowTreeHost
ui/shell_dialogs/select_file_dialog_linux_portal_unittest.cc
 modified
if
ui/shell_dialogs/select_file_dialog_linux_portal_unittest.cc
 modified
SelectFileDialogLinuxPortalTest
ui/shell_dialogs/select_file_dialog_linux_portal_unittest.cc
 modified
BindOnce
ui/shell_dialogs/select_file_dialog_linux_portal_unittest.cc
 modified

Files Changed

  • ui/shell_dialogs/select_file_dialog_linux_portal_unittest.cc
  • ui/shell_dialogs/select_file_dialog_linux_portal.h
  • ui/ozone/BUILD.gn
  • ui/shell_dialogs/select_file_dialog_linux_portal.cc
  • ui/shell_dialogs/BUILD.gn

Patch

view commit
From 399641915f15c92bf207239eae79d362c8d08fe1 Mon Sep 17 00:00:00 2001
From: Tom Anderson <thomasanderson@chromium.org>
Date: Thu, 24 Sep 2026 18:08:43 -0700
Subject: [PATCH] Fix UAF in SelectFileDialogLinuxPortal::DialogCreatedOnInvoker

Releasing window capture in DialogCreatedOnInvoker() can synchronously
cancel an in-progress cross-window tab drag, deactivate the tab owning
the file chooser, and drop the caller's reference to the
SelectFileDialogLinuxPortal instance before ReleaseCapture() returns.

Hold a stack-scoped scoped_refptr<SelectFileDialogLinuxPortal> across
host_->ReleaseCapture() in DialogCreatedOnInvoker() and re-check host_
afterward before disabling window event handling. Also ensure
ListenerDestroyed() cancels any in-flight portal request and unparents
the dialog immediately, and bind WeakPtrs in OnPortalAvailable() and
SelectFileImplWithParentHandle() so pending callbacks do not extend the
dialog's lifetime past ListenerDestroyed().

Bug: 565349184
Change-Id: I7160e68d0d2a237c4c72241f92b0beef7039f9fd
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8450638
Reviewed-by: Kramer Ge <fangzhoug@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Kramer Ge <fangzhoug@chromium.org>
Auto-Submit: Thomas Anderson <thomasanderson@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1704556}
---
diff --git a/ui/shell_dialogs/select_file_dialog_linux_portal.cc b/ui/shell_dialogs/select_file_dialog_linux_portal.cc
index cf60f909..56a1bc0d 100644
--- a/ui/shell_dialogs/select_file_dialog_linux_portal.cc
+++ b/ui/shell_dialogs/select_file_dialog_linux_portal.cc
@@ -102,6 +102,8 @@
 
 void SelectFileDialogLinuxPortal::ListenerDestroyed() {
   weak_factory_.InvalidateWeakPtrs();
+  file_chooser_request_.reset();
+  UnparentOnInvoker();
   if (fallback_dialog_) {
     fallback_dialog_->ListenerDestroyed();
     fallback_dialog_.reset();
@@ -191,8 +193,9 @@
     delegate->ExportWindowHandle(
         host_->GetAcceleratedWidget(),
         base::BindOnce(
-            &SelectFileDialogLinuxPortal::SelectFileImplWithParentHandle, this,
-            title, default_path, filter_set, default_extension));
+            &SelectFileDialogLinuxPortal::SelectFileImplWithParentHandle,
+            weak_factory_.GetWeakPtr(), title, default_path, filter_set,
+            default_extension));
   } else {
     // No parent or no delegate, so just use a blank parent handle.
     SelectFileImplWithParentHandle(title, default_path, filter_set,
@@ -290,9 +293,10 @@
   invoker_task_runner_->PostTask(
       FROM_HERE,
       base::BindOnce(&SelectFileDialogLinuxPortal::SelectFileImplOnMainThread,
-                     this, std::move(title), std::move(default_path),
-                     default_path_exists, std::move(filter_set),
-                     std::move(default_extension), std::move(parent_handle)));
+                     weak_factory_.GetWeakPtr(), std::move(title),
+                     std::move(default_path), default_path_exists,
+                     std::move(filter_set), std::move(default_extension),
+                     std::move(parent_handle)));
 }
 
 void SelectFileDialogLinuxPortal::SelectFileImplOnMainThread(
@@ -502,7 +506,11 @@
   if (!host_) {
     return;
   }
+  scoped_refptr<SelectFileDialogLinuxPortal> hold_this(this);
   host_->ReleaseCapture();
+  if (!host_) {
+    return;
+  }
   reenable_window_event_handling_ =
       static_cast<views::DesktopWindowTreeHostLinux*>(host_.get())
           ->DisableEventListening();
diff --git a/ui/shell_dialogs/select_file_dialog_linux_portal.h b/ui/shell_dialogs/select_file_dialog_linux_portal.h
index af224fd..a352243 100644
--- a/ui/shell_dialogs/select_file_dialog_linux_portal.h
+++ b/ui/shell_dialogs/select_file_dialog_linux_portal.h
@@ -64,6 +64,7 @@
   }
 
  private:
+  friend class TestableSelectFileDialogLinuxPortal;
   // Glob-style patterns are indicated by 0, MIME types by 1. Patterns are
   // case-sensitive.
   using DbusFilterPattern = std::tuple<uint32_t, std::string>;
diff --git a/ui/shell_dialogs/select_file_dialog_linux_portal_unittest.cc b/ui/shell_dialogs/select_file_dialog_linux_portal_unittest.cc
index 051da43..a7bf17e 100644
--- a/ui/shell_dialogs/select_file_dialog_linux_portal_unittest.cc
+++ b/ui/shell_dialogs/select_file_dialog_linux_portal_unittest.cc
@@ -4,12 +4,18 @@
 
 #include "ui/shell_dialogs/select_file_dialog_linux_portal.h"
 
+#include "base/command_line.h"
+#include "base/functional/bind.h"
 #include "base/functional/callback.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/run_loop.h"
 #include "base/test/task_environment.h"
 #include "base/threading/thread.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "ui/aura/env.h"
+#include "ui/aura/window_tree_host_platform.h"
+#include "ui/display/test/test_screen.h"
+#include "ui/ozone/public/ozone_switches.h"
 #include "ui/shell_dialogs/select_file_policy.h"
 
 namespace ui {
@@ -29,6 +35,24 @@
   void FileSelectionCanceled() override {}
 };
 
+class FakeWindowTreeHost : public aura::WindowTreeHostPlatform {
+ public:
+  explicit FakeWindowTreeHost(base::OnceClosure on_release_capture)
+      : on_release_capture_(std::move(on_release_capture)) {
+    window()->Init(ui::LAYER_NOT_DRAWN);
+  }
+  ~FakeWindowTreeHost() override = default;
+
+  void ReleaseCapture() override {
+    if (on_release_capture_) {
+      std::move(on_release_capture_).Run();
+    }
+  }
+
+ private:
+  base::OnceClosure on_release_capture_;
+};
+
 }  // namespace
 
 class SelectFileDialogLinuxPortalTest : public testing::Test {
@@ -37,6 +61,11 @@
   ~SelectFileDialogLinuxPortalTest() override = default;
 
   void SetUp() override {
+    // The test may run without a display server, so use the headless Ozone
+    // platform.
+    base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
+        switches::kOzonePlatform, "headless");
+    env_ = aura::Env::CreateInstance();
     listener_ = std::make_unique<MockSelectFileDialogListener>();
   }
 
@@ -57,6 +86,9 @@
   base::test::TaskEnvironment task_environment_{
       base::test::TaskEnvironment::MainThreadType::UI,
       base::test::TaskEnvironment::ThreadPoolExecutionMode::ASYNC};
+  display::test::TestScreen test_screen_{/*create_display=*/true,
+                                         /*register_screen=*/true};
+  std::unique_ptr<aura::Env> env_;
   std::unique_ptr<MockSelectFileDialogListener> listener_;
 
  private:
@@ -80,10 +112,15 @@
  public:
   explicit TestableSelectFileDialogLinuxPortal(Listener* listener)
       : SelectFileDialogLinuxPortal(listener,
-                                    std::unique_ptr<ui::SelectFilePolicy>()) {}
+                                    std::unique_ptr<ui::SelectFilePolicy>()) {
+    invoker_task_runner_ = base::SequencedTaskRunner::GetCurrentDefault();
+  }
 
+  using SelectFileDialogLinuxPortal::DialogCreatedOnInvoker;
+  using SelectFileDialogLinuxPortal::host_;
   using SelectFileDialogLinuxPortal::listener_;
   using SelectFileDialogLinuxPortal::ListenerDestroyed;
+  using SelectFileDialogLinuxPortal::reenable_window_event_handling_;
 
   base::WeakPtr<SelectFileDialogLinuxPortal> GetWeakPtrForTesting() {
     return SelectFileDialogLinuxPortal::GetWeakPtrForTesting();
@@ -121,6 +158,10 @@
   auto dialog = base::MakeRefCounted<TestableSelectFileDialogLinuxPortal>(
       listener_.get());
 
+  bool reenabled_events = false;
+  dialog->reenable_window_event_handling_ =
+      base::BindOnce([](bool* flag) { *flag = true; }, &reenabled_events);
+
   base::WeakPtr<SelectFileDialogLinuxPortal> weak_ptr =
       dialog->GetWeakPtrForTesting();
   EXPECT_TRUE(weak_ptr);
@@ -130,6 +171,7 @@
 
   EXPECT_FALSE(weak_ptr);
   EXPECT_FALSE(dialog->listener_);
+  EXPECT_TRUE(reenabled_events);
 }
 
 // Tests that weak pointer invalidation prevents callbacks from multiple racing
@@ -169,4 +211,49 @@
   dbus_thread_2.Stop();
 }
 
+// Regression test for crbug.com/565349184: Releasing capture in
+// DialogCreatedOnInvoker() can synchronously cancel a tab drag, deactivate the
+// tab, and destroy the dialog before ReleaseCapture() returns.
+TEST_F(SelectFileDialogLinuxPortalTest,
+       DialogDestroyedDuringReleaseCaptureInDialogCreatedOnInvoker) {
+  auto dialog = base::MakeRefCounted<TestableSelectFileDialogLinuxPortal>(
+      listener_.get());
+  base::WeakPtr<SelectFileDialogLinuxPortal> weak_dialog =
+      dialog->GetWeakPtrForTesting();
+
+  FakeWindowTreeHost host(base::BindOnce(
+      [](scoped_refptr<TestableSelectFileDialogLinuxPortal>* dialog_ref) {
+        (*dialog_ref)->ListenerDestroyed();
+        dialog_ref->reset();
+      },
+      &dialog));
+  dialog->host_ = host.GetWeakPtr();
+
+  TestableSelectFileDialogLinuxPortal* raw_dialog = dialog.get();
+  raw_dialog->DialogCreatedOnInvoker();
+
+  EXPECT_FALSE(dialog);
+  EXPECT_FALSE(weak_dialog);
+}
+
+// Tests that if the WindowTreeHost is destroyed synchronously during
+// ReleaseCapture(), DialogCreatedOnInvoker() safely returns without
+// dereferencing a null host pointer.
+TEST_F(SelectFileDialogLinuxPortalTest,
+       HostDestroyedDuringReleaseCaptureInDialogCreatedOnInvoker) {
+  auto dialog = base::MakeRefCounted<TestableSelectFileDialogLinuxPortal>(
+      listener_.get());
+
+  std::unique_ptr<FakeWindowTreeHost> host;
+  host = std::make_unique<FakeWindowTreeHost>(base::BindOnce(
+      [](std::unique_ptr<FakeWindowTreeHost>* host_ptr) { host_ptr->reset(); },
+      &host));
+  dialog->host_ = host->GetWeakPtr();
+
+  dialog->DialogCreatedOnInvoker();
+
+  EXPECT_FALSE(host);
+  EXPECT_FALSE(dialog->host_);
+}
+
 }  // namespace ui
diff --git a/ui/ozone/BUILD.gn b/ui/ozone/BUILD.gn
index 11081246..4a3e485 100644
--- a/ui/ozone/BUILD.gn
+++ b/ui/ozone/BUILD.gn
@@ -276,6 +276,7 @@
     "//media/mojo/services",
     "//ui/base/clipboard:clipboard_test",
     "//ui/display:display_unittests",
+    "//ui/shell_dialogs:shell_dialogs_unittests",
   ]
 }
 
diff --git a/ui/shell_dialogs/BUILD.gn b/ui/shell_dialogs/BUILD.gn
index e918ada..b113be51 100644
--- a/ui/shell_dialogs/BUILD.gn
+++ b/ui/shell_dialogs/BUILD.gn
@@ -181,6 +181,10 @@
       "//components/dbus",
       "//dbus",
       "//dbus:test_support",
+      "//ui/aura",
+      "//ui/display:test_support",
+      "//ui/ozone:ozone_switches",
+      "//ui/platform_window",
     ]
   }
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/ui/shell_dialogs/select_file_dialog_linux_portal_unittest.cc b/ui/shell_dialogs/select_file_dialog_linux_portal_unittest.cc
index 051da43..a7bf17e 100644
--- a/ui/shell_dialogs/select_file_dialog_linux_portal_unittest.cc
+++ b/ui/shell_dialogs/select_file_dialog_linux_portal_unittest.cc
@@ -4,12 +4,18 @@
 
 #include "ui/shell_dialogs/select_file_dialog_linux_portal.h"
 
+#include "base/command_line.h"
+#include "base/functional/bind.h"
 #include "base/functional/callback.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/run_loop.h"
 #include "base/test/task_environment.h"
 #include "base/threading/thread.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "ui/aura/env.h"
+#include "ui/aura/window_tree_host_platform.h"
+#include "ui/display/test/test_screen.h"
+#include "ui/ozone/public/ozone_switches.h"
 #include "ui/shell_dialogs/select_file_policy.h"
 
 namespace ui {
@@ -29,6 +35,24 @@
   void FileSelectionCanceled() override {}
 };
 
+class FakeWindowTreeHost : public aura::WindowTreeHostPlatform {
+ public:
+  explicit FakeWindowTreeHost(base::OnceClosure on_release_capture)
+      : on_release_capture_(std::move(on_release_capture)) {
+    window()->Init(ui::LAYER_NOT_DRAWN);
+  }
+  ~FakeWindowTreeHost() override = default;
+
+  void ReleaseCapture() override {
+    if (on_release_capture_) {
+      std::move(on_release_capture_).Run();
+    }
+  }
+
+ private:
+  base::OnceClosure on_release_capture_;
+};
+
 }  // namespace
 
 class SelectFileDialogLinuxPortalTest : public testing::Test {
@@ -37,6 +61,11 @@
   ~SelectFileDialogLinuxPortalTest() override = default;
 
   void SetUp() override {
+    // The test may run without a display server, so use the headless Ozone
+    // platform.
+    base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
+        switches::kOzonePlatform, "headless");
+    env_ = aura::Env::CreateInstance();
     listener_ = std::make_unique<MockSelectFileDialogListener>();
   }
 
@@ -57,6 +86,9 @@
   base::test::TaskEnvironment task_environment_{
       base::test::TaskEnvironment::MainThreadType::UI,
       base::test::TaskEnvironment::ThreadPoolExecutionMode::ASYNC};
+  display::test::TestScreen test_screen_{/*create_display=*/true,
+                                         /*register_screen=*/true};
+  std::unique_ptr<aura::Env> env_;
   std::unique_ptr<MockSelectFileDialogListener> listener_;
 
  private:
@@ -80,10 +112,15 @@
  public:
   explicit TestableSelectFileDialogLinuxPortal(Listener* listener)
       : SelectFileDialogLinuxPortal(listener,
-                                    std::unique_ptr<ui::SelectFilePolicy>()) {}
+                                    std::unique_ptr<ui::SelectFilePolicy>()) {
+    invoker_task_runner_ = base::SequencedTaskRunner::GetCurrentDefault();
+  }
 
+  using SelectFileDialogLinuxPortal::DialogCreatedOnInvoker;
+  using SelectFileDialogLinuxPortal::host_;
   using SelectFileDialogLinuxPortal::listener_;
   using SelectFileDialogLinuxPortal::ListenerDestroyed;
+  using SelectFileDialogLinuxPortal::reenable_window_event_handling_;
 
   base::WeakPtr<SelectFileDialogLinuxPortal> GetWeakPtrForTesting() {
     return SelectFileDialogLinuxPortal::GetWeakPtrForTesting();
@@ -121,6 +158,10 @@
   auto dialog = base::MakeRefCounted<TestableSelectFileDialogLinuxPortal>(
       listener_.get());
 
+  bool reenabled_events = false;
+  dialog->reenable_window_event_handling_ =
+      base::BindOnce([](bool* flag) { *flag = true; }, &reenabled_events);
+
   base::WeakPtr<SelectFileDialogLinuxPortal> weak_ptr =
       dialog->GetWeakPtrForTesting();
   EXPECT_TRUE(weak_ptr);
@@ -130,6 +171,7 @@
 
   EXPECT_FALSE(weak_ptr);
   EXPECT_FALSE(dialog->listener_);
+  EXPECT_TRUE(reenabled_events);
 }
 
 // Tests that weak pointer invalidation prevents callbacks from multiple racing
@@ -169,4 +211,49 @@
   dbus_thread_2.Stop();
 }
 
+// Regression test for crbug.com/565349184: Releasing capture in
+// DialogCreatedOnInvoker() can synchronously cancel a tab drag, deactivate the
+// tab, and destroy the dialog before ReleaseCapture() returns.
+TEST_F(SelectFileDialogLinuxPortalTest,
+       DialogDestroyedDuringReleaseCaptureInDialogCreatedOnInvoker) {
+  auto dialog = base::MakeRefCounted<TestableSelectFileDialogLinuxPortal>(
+      listener_.get());
+  base::WeakPtr<SelectFileDialogLinuxPortal> weak_dialog =
+      dialog->GetWeakPtrForTesting();
+
+  FakeWindowTreeHost host(base::BindOnce(
+      [](scoped_refptr<TestableSelectFileDialogLinuxPortal>* dialog_ref) {
+        (*dialog_ref)->ListenerDestroyed();
+        dialog_ref->reset();
+      },
+      &dialog));
+  dialog->host_ = host.GetWeakPtr();
+
+  TestableSelectFileDialogLinuxPortal* raw_dialog = dialog.get();
+  raw_dialog->DialogCreatedOnInvoker();
+
+  EXPECT_FALSE(dialog);
+  EXPECT_FALSE(weak_dialog);
+}
+
+// Tests that if the WindowTreeHost is destroyed synchronously during
+// ReleaseCapture(), DialogCreatedOnInvoker() safely returns without
+// dereferencing a null host pointer.
+TEST_F(SelectFileDialogLinuxPortalTest,
+       HostDestroyedDuringReleaseCaptureInDialogCreatedOnInvoker) {
+  auto dialog = base::MakeRefCounted<TestableSelectFileDialogLinuxPortal>(
+      listener_.get());
+
+  std::unique_ptr<FakeWindowTreeHost> host;
+  host = std::make_unique<FakeWindowTreeHost>(base::BindOnce(
+      [](std::unique_ptr<FakeWindowTreeHost>* host_ptr) { host_ptr->reset(); },
+      &host));
+  dialog->host_ = host->GetWeakPtr();
+
+  dialog->DialogCreatedOnInvoker();
+
+  EXPECT_FALSE(host);
+  EXPECT_FALSE(dialog->host_);
+}
+
 }  // namespace ui
Loading diff…

Original Bug Report

reported by ro...@gmail.com

Browser-process heap-use-after-free in the Linux portal file chooser during tab drag

Report description

Browser-process heap-use-after-free in the Linux portal file chooser during tab drag

Bug location

Where do you want to report your vulnerability?

Chrome VRP – Report security issues affecting the Chrome browser. See program rules

Which URL (or repository) have you found the vulnerability in?

https://chromium.googlesource.com/chromium/src/

The problem

Please describe the technical details of the vulnerability

On Linux/X11, SelectFileDialogLinuxPortal::DialogCreatedOnInvoker() calls host_->ReleaseCapture() and then continues using the dialog object. Capture loss can synchronously cancel a cross-window tab drag, deactivate the tab that owns the file chooser, and release the final reference to the portal dialog before ReleaseCapture() returns. Execution then resumes in DialogCreatedOnInvoker() and reads the freed object while evaluating host_.get().

A page reaches this sequence by scheduling input.click() after a user click. During the delay, the user drags that tab into a second Chrome window and keeps the mouse button held until the chooser opens. Releasing capture reverts the drag, deactivates the chooser-owning tab, destroys the dialog, and produces a browser-process ASAN heap-use-after-free.

Reproduction

Keep the four attached files in one directory, set CHROME_BIN to a Linux ASAN Chrome binary, and run:

chmod +x run_standalone_poc.sh
dbus-run-session -- env CHROME_BIN=/path/to/asan/chrome ./run_standalone_poc.sh

The runner uses Xvfb, Openbox, xdotool, an isolated D-Bus session, and a fresh temporary Chrome profile. The sandbox remains enabled. The small fake portal records OpenFile and keeps the request pending; it never selects or reads a file. No extension, MojoJS, test-only browser interface, existing profile, system keychain, or --no-sandbox is used.

Representative ASAN result:

ERROR: AddressSanitizer: heap-use-after-free
READ of size 8 on thread T0 (chrome)
    #0 base::internal::WeakReference::IsValid() const
    #1 ui::SelectFileDialogLinuxPortal::DialogCreatedOnInvoker()

Address is 112 bytes inside a freed 192-byte region.
Free stack includes:
    FileSelectHelper::RunFileChooserEnd()
    tabs::TabModel::WillDeactivate(...)
    TabDragController::RevertDrag()
    TabDragController::EndDragImpl(...)
    TabDragController::EndDrag(...)
    ui::SelectFileDialogLinuxPortal::DialogCreatedOnInvoker()

MiraclePtr Status: NOT PROTECTED

The attached ASAN log contains the complete trace. The unmodified build reproduced in three consecutive runs.

Affected version

Reproduced on Linux x86-64/X11 in an ASAN Chrome build from Chromium revision 86cee6df69e0463a839c0cc8435c9d4c259434d3, version 153.0.8010.0. The unsafe sequence is present unchanged in Chrome Stable 153.0.8010.52 at revision 78e5e45d4bb41035e17ea4da2cc257f496416ac9; that exact Stable tag was verified by source inspection but was not used for the end-to-end ASAN run.

Root cause and suggested fix

The method checks host_ before the reentrant capture-release call but does not protect its own lifetime across that call. Capturing a WeakPtr before ReleaseCapture() and rechecking both the dialog and host_ afterward prevents the stale access. The guarded build completed the same sequence without ASAN errors in three consecutive control runs.

Prior automated intake

Issue 565342563 contained the same finding but was automatically closed under #sheepdog-wontfix-limits because the report and attachment set exceeded intake limits. It was not reviewed on technical merit. This resubmission is shortened and contains only the minimal PoC and one complete ASAN trace.

Impact analysis

A malicious or compromised page can trigger an unprotected browser-process use-after-free after a user clicks a button and performs the synchronized cross-window tab-drag sequence above. The demonstrated result is a reliable browser-process crash. I did not demonstrate controlled memory disclosure, arbitrary read/write, code execution, or a sandbox escape.

The cause

What version of Chrome have you found the security issue in?

153.0.8010.0 ASAN dev build at revision 86cee6df69e0463a839c0cc8435c9d4c259434d3 on Linux x86-64/X11. Vulnerable source confirmed unchanged in Stable 153.0.8010.52 at revision 78e5e45d4bb41035e17ea4da2cc257f496416ac9 by source inspection; the exact Stable tag was not used for the end-to-end ASAN run.

Yes, it is related to a crash.

Choose the type of vulnerability

Memory Corruption (in a non-sandboxed process)

How would you like to be publicly acknowledged for your report?

Roshan Singh

View on issue tracker
Links in the report
On This Page