Chrome · Layout › Layout
CVE-2026-118344
UAF in Layout (Layout)
Overview
Critical
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
has_shape_exclusionsthird_party/blink/renderer/core/layout/exclusions/exclusion_space.h |
modified |
Files Changed
third_party/blink/renderer/core/layout/exclusions/exclusion_space.hthird_party/blink/renderer/core/layout/exclusions/exclusion_space.cc
Patch
From 5173a94262b618f50810938fa3d50b8a36a68886 Mon Sep 17 00:00:00 2001
From: Ian Kilpatrick <ikilpatrick@chromium.org>
Date: Thu, 22 Oct 2026 15:29:38 -0700
Subject: [PATCH] [layout] Add move constructor and assignment operator to Shelf.
This adds the missing move constructor & assignment operator to the
Shelf data-type.
Additionally adds the copy assignment operator for completeness.
Fixed: 574852698
Change-Id: Ief97ee317f7aba8d86b3c6cf920cb362efc679c5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8633358
Reviewed-by: David Grogan <dgrogan@chromium.org>
Commit-Queue: Ian Kilpatrick <ikilpatrick@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1725253}
---
diff --git a/third_party/blink/renderer/core/layout/exclusions/exclusion_space.cc b/third_party/blink/renderer/core/layout/exclusions/exclusion_space.cc
index e2f5e2b5..e17476b3 100644
--- a/third_party/blink/renderer/core/layout/exclusions/exclusion_space.cc
+++ b/third_party/blink/renderer/core/layout/exclusions/exclusion_space.cc
@@ -615,7 +615,7 @@
? LayoutUnit::Max()
: shelf_copy->line_right;
- shelves_.insert(i + 1, new_shelf);
+ shelves_.insert(i + 1, std::move(new_shelf));
}
// It's safe to early exit out of this loop now. This exclusion won't
diff --git a/third_party/blink/renderer/core/layout/exclusions/exclusion_space.h b/third_party/blink/renderer/core/layout/exclusions/exclusion_space.h
index 2260e12..f61f28058 100644
--- a/third_party/blink/renderer/core/layout/exclusions/exclusion_space.h
+++ b/third_party/blink/renderer/core/layout/exclusions/exclusion_space.h
@@ -322,7 +322,8 @@
: nullptr),
has_shape_exclusions(false) {}
- // The copy constructor explicitly copies the shape_exclusions member.
+ // The copy constructor and copy assignment operator explicitly copy the
+ // shape_exclusions member.
Shelf(const Shelf& other)
: block_offset(other.block_offset),
line_left(other.line_left),
@@ -334,6 +335,22 @@
*other.shape_exclusions)
: nullptr),
has_shape_exclusions(other.has_shape_exclusions) {}
+ Shelf(Shelf&&) noexcept = default;
+
+ Shelf& operator=(const Shelf& other) {
+ block_offset = other.block_offset;
+ line_left = other.line_left;
+ line_right = other.line_right;
+ line_left_edges = other.line_left_edges;
+ line_right_edges = other.line_right_edges;
+ shape_exclusions =
+ other.shape_exclusions
+ ? MakeGarbageCollected<ShapeExclusions>(*other.shape_exclusions)
+ : nullptr;
+ has_shape_exclusions = other.has_shape_exclusions;
+ return *this;
+ }
+ Shelf& operator=(Shelf&&) noexcept = default;
void Trace(Visitor* visitor) const { visitor->Trace(shape_exclusions); }
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page