Chrome · Chrome for iOS
CVE-2026-14099
UAF in Chrome for iOS
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
ios/chrome/browser/home_customization/ui/home_customization_background_preset_gallery_picker_view_controller.mm
Patch
From 2cb93324a67eb7811a82f257cb341fbb185a9a9c Mon Sep 17 00:00:00 2001
From: Robbie Gibson <rkgibson@google.com>
Date: Tue, 19 May 2026 12:37:13 -0700
Subject: [PATCH] [iOS] Fix thread-safety race condition in home customization
`-prepareForDisplayWithCompletionHandler:`'s completion handler is
called on a private background queue. Thus, the modification to
_inProgressImageFetches should be done back on the main thread.
Also, there was an issue where the parameter for the handler was
omitted, so this CL fixes that too.
Bug: b:513382161
Change-Id: I53a865285e4c08b8576cc53eb6de5e3927e915ad
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7857310
Commit-Queue: Robbie Gibson <rkgibson@google.com>
Reviewed-by: Pier-Alexandre Bouchard <pabouchard@google.com>
Cr-Commit-Position: refs/heads/main@{#1633059}
---
diff --git a/ios/chrome/browser/home_customization/ui/home_customization_background_preset_gallery_picker_view_controller.mm b/ios/chrome/browser/home_customization/ui/home_customization_background_preset_gallery_picker_view_controller.mm
index ea368970..9641dea 100644
--- a/ios/chrome/browser/home_customization/ui/home_customization_background_preset_gallery_picker_view_controller.mm
+++ b/ios/chrome/browser/home_customization/ui/home_customization_background_preset_gallery_picker_view_controller.mm
@@ -434,8 +434,12 @@
}
__weak __typeof(self) weakSelf = self;
- [image prepareForDisplayWithCompletionHandler:^(UIImage*) {
- [weakSelf imagePreparedForDisplay:image itemIdentifier:itemIdentifier];
+ [image prepareForDisplayWithCompletionHandler:^(UIImage* preparedImage) {
+ dispatch_async(dispatch_get_main_queue(), ^{
+ UIImage* finalImage = preparedImage ? preparedImage : image;
+ [weakSelf imagePreparedForDisplay:finalImage
+ itemIdentifier:itemIdentifier];
+ });
}];
}
@@ -449,10 +453,7 @@
[_preparedImageCache setObject:image forKey:itemIdentifier];
- __weak __typeof(self) weakSelf = self;
- dispatch_async(dispatch_get_main_queue(), ^{
- [weakSelf setImage:image forCellWithItemIdentifier:itemIdentifier];
- });
+ [self setImage:image forCellWithItemIdentifier:itemIdentifier];
}
// Updates the cell for the given identifier to the provided image.
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page