Chrome · Chrome for iOS
CVE-2026-14067
UAF in Chrome for iOS
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.hios/chrome/browser/cobrowse/model/cobrowse_tab_helper.mm
Patch
From f0f9e117d5679d96bba3ee4441af01cc442192a2 Mon Sep 17 00:00:00 2001
From: Matt Reichhoff <mreichhoff@chromium.org>
Date: Tue, 05 May 2026 08:27:59 -0700
Subject: [PATCH] [iOS] Add weak pointer in cobrowse
Bug: 504069465
Change-Id: I6673efc8bbd93ac491f6641749dca7a6cbb3624c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7810694
Reviewed-by: Stepan Khapugin <stkhapugin@chromium.org>
Commit-Queue: Matt Reichhoff <mreichhoff@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1625447}
---
diff --git a/ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.h b/ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.h
index 02cfe2f..99d5f2e 100644
--- a/ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.h
+++ b/ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.h
@@ -6,6 +6,7 @@
#define IOS_CHROME_BROWSER_COBROWSE_MODEL_COBROWSE_TAB_HELPER_H_
#import "base/memory/raw_ptr.h"
+#import "base/memory/weak_ptr.h"
#import "base/scoped_observation.h"
#import "ios/web/public/web_state_observer.h"
#import "ios/web/public/web_state_user_data.h"
@@ -58,6 +59,9 @@
// Returns whether the assistant should be hidden for `url`.
bool ShouldHideAssistantForURL(const GURL& url);
+ // Triggers the showing of the assistant.
+ void ShowAssistant();
+
// The delegate for this tab helper.
raw_ptr<Delegate> delegate_ = nullptr;
@@ -70,6 +74,8 @@
// Scoped observation for the WebState.
base::ScopedObservation<web::WebState, web::WebStateObserver> observation_{
this};
+
+ base::WeakPtrFactory<CobrowseTabHelper> weak_ptr_factory_{this};
};
#endif // IOS_CHROME_BROWSER_COBROWSE_MODEL_COBROWSE_TAB_HELPER_H_
diff --git a/ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.mm b/ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.mm
index 464f6617..4ed41d4 100644
--- a/ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.mm
+++ b/ios/chrome/browser/cobrowse/model/cobrowse_tab_helper.mm
@@ -51,9 +51,8 @@
// established before showing the assistant. This avoids crashes during
// transitions (e.g., from Tab Grid to Browser).
base::SequencedTaskRunner::GetCurrentDefault()->PostTask(
- FROM_HERE, base::BindOnce(^{
- [scene_handler_ showAssistant];
- }));
+ FROM_HERE, base::BindOnce(&CobrowseTabHelper::ShowAssistant,
+ weak_ptr_factory_.GetWeakPtr()));
}
}
@@ -100,3 +99,7 @@
return false;
}
+
+void CobrowseTabHelper::ShowAssistant() {
+ [scene_handler_ showAssistant];
+}
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page