Critical chrome UAF 🔧 Commit mapped

Overview

Critical
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactUse after free in Layout
DescriptionUse after free in Layout
ComponentLayout
Sub-componentLayout
Bug ClassUAF
Tracker574852698
Fix commit5173a94262b6 (chromium/src) +19/-2
CISA KEVNot listed
CreditedXinyang Ge
Disclosed2026-10-27

Changed Functions

FunctionChangeNotes
has_shape_exclusions
third_party/blink/renderer/core/layout/exclusions/exclusion_space.h
modified

Files Changed

  • third_party/blink/renderer/core/layout/exclusions/exclusion_space.h
  • third_party/blink/renderer/core/layout/exclusions/exclusion_space.cc
From 5173a94262b618f50810938fa3d50b8a36a68886 Mon Sep 17 00:00:00 2001
From: Ian Kilpatrick <ikilpatrick@chromium.org>
Date: Thu, 22 Oct 2026 15:29:38 -0700
Subject: [PATCH] [layout] Add move constructor and assignment operator to Shelf.

This adds the missing move constructor & assignment operator to the
Shelf data-type.

Additionally adds the copy assignment operator for completeness.

Fixed: 574852698
Change-Id: Ief97ee317f7aba8d86b3c6cf920cb362efc679c5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8633358
Reviewed-by: David Grogan <dgrogan@chromium.org>
Commit-Queue: Ian Kilpatrick <ikilpatrick@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1725253}
---
diff --git a/third_party/blink/renderer/core/layout/exclusions/exclusion_space.cc b/third_party/blink/renderer/core/layout/exclusions/exclusion_space.cc
index e2f5e2b5..e17476b3 100644
--- a/third_party/blink/renderer/core/layout/exclusions/exclusion_space.cc
+++ b/third_party/blink/renderer/core/layout/exclusions/exclusion_space.cc
@@ -615,7 +615,7 @@
                                    ? LayoutUnit::Max()
                                    : shelf_copy->line_right;
 
-        shelves_.insert(i + 1, new_shelf);
+        shelves_.insert(i + 1, std::move(new_shelf));
       }
 
       // It's safe to early exit out of this loop now. This exclusion won't
diff --git a/third_party/blink/renderer/core/layout/exclusions/exclusion_space.h b/third_party/blink/renderer/core/layout/exclusions/exclusion_space.h
index 2260e12..f61f28058 100644
--- a/third_party/blink/renderer/core/layout/exclusions/exclusion_space.h
+++ b/third_party/blink/renderer/core/layout/exclusions/exclusion_space.h
@@ -322,7 +322,8 @@
                                : nullptr),
           has_shape_exclusions(false) {}
 
-    // The copy constructor explicitly copies the shape_exclusions member.
+    // The copy constructor and copy assignment operator explicitly copy the
+    // shape_exclusions member.
     Shelf(const Shelf& other)
         : block_offset(other.block_offset),
           line_left(other.line_left),
@@ -334,6 +335,22 @@
                                      *other.shape_exclusions)
                                : nullptr),
           has_shape_exclusions(other.has_shape_exclusions) {}
+    Shelf(Shelf&&) noexcept = default;
+
+    Shelf& operator=(const Shelf& other) {
+      block_offset = other.block_offset;
+      line_left = other.line_left;
+      line_right = other.line_right;
+      line_left_edges = other.line_left_edges;
+      line_right_edges = other.line_right_edges;
+      shape_exclusions =
+          other.shape_exclusions
+              ? MakeGarbageCollected<ShapeExclusions>(*other.shape_exclusions)
+              : nullptr;
+      has_shape_exclusions = other.has_shape_exclusions;
+      return *this;
+    }
+    Shelf& operator=(Shelf&&) noexcept = default;
 
     void Trace(Visitor* visitor) const { visitor->Trace(shape_exclusions); }
 
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.