Chrome · Network
CVE-2026-17857
Logic Error in Network
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
services/network/pervasive_resources/shared_resource_checker_patterns.h
Patch
From 1098391fa1c3723067997546eae2dc0ec8acfced Mon Sep 17 00:00:00 2001
From: Patrick Meenan <pmeenan@chromium.org>
Date: Tue, 09 Jun 2026 17:10:05 -0700
Subject: [PATCH] Switched the pervasive patterns to use named path segments
This changes the pervasive resource pattern generation to use named
wildcards for individual path segments (which will only match a single
segment instead of an arbitrary string in the middle of the path).
The pattern list has been updated using the new patterns and new tests
have been added to make sure that the named segment pattern matching
works as expected.
Bug: 520186620
Change-Id: I50774f8d7cd8c97cf5beb930a4c57502f282c42a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7904805
Reviewed-by: Adam Rice <ricea@chromium.org>
Commit-Queue: Patrick Meenan <pmeenan@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1644335}
---
diff --git a/services/network/pervasive_resources/shared_resource_checker_patterns.h b/services/network/pervasive_resources/shared_resource_checker_patterns.h
index d48eecb..3c890911 100644
--- a/services/network/pervasive_resources/shared_resource_checker_patterns.h
+++ b/services/network/pervasive_resources/shared_resource_checker_patterns.h
@@ -17,8 +17,8 @@
// This should be set to one year after the list was last updated or validated.
inline constexpr base::Time::Exploded kPervasivePatternsExpiration = {
.year = 2027,
- .month = 5,
- .day_of_month = 23};
+ .month = 6,
+ .day_of_month = 5};
// The uncompressed list of URL patterns is:
// https://a.amxrtb.com/js/cframe.js
@@ -50,26 +50,13 @@
// https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
// https://cdn.id5-sync.com/api/1.0/id5-api.js
// https://cdn.id5-sync.com/api/1.0/id5PrebidModule.js
-// https://cdn.iubenda.com/cookie_solution/iubenda_cs/*/core-*.js
+// https://cdn.iubenda.com/cookie_solution/iubenda_cs/:v/core-*.js
// https://cdn.iubenda.com/cs/iubenda_cs.js
// https://cdn.iubenda.com/iubenda.js
// https://cdn.jsdelivr.net/npm/search-insights@2.2.1
// https://cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/slick.min.js
// https://cdn.jsdelivr.net/npm/swiper@11/swiper-bundle.min.css
// https://cdn.jsdelivr.net/npm/swiper@11/swiper-bundle.min.js
-// https://cdn.shopify.com/extensions/*/assets/index.js
-// https://cdn.shopify.com/extensions/*/assets/loader.js
-// https://cdn.shopify.com/extensions/*/assets/pagefly-general-helper.js
-// https://cdn.shopify.com/extensions/*/assets/pagefly-glider.js
-// https://cdn.shopify.com/extensions/*/assets/pagefly-helper.js
-// https://cdn.shopify.com/extensions/*/assets/pagefly-product-media.js
-// https://cdn.shopify.com/extensions/*/assets/pagefly-product.js
-// https://cdn.shopify.com/extensions/*/assets/pagefly-slideshow-v1-v2.js
-// https://cdn.shopify.com/extensions/*/assets/pagefly-slideshow-v3.js
-// https://cdn.shopify.com/extensions/*/assets/pagefly-slideshow-v4.js
-// https://cdn.shopify.com/extensions/*/assets/pagefly-snap-slider.js
-// https://cdn.shopify.com/extensions/*/assets/shopifyChatV1Widget.js
-// https://cdn.shopify.com/extensions/*/assets/style.css
// https://cdn.shopify.com/shopifycloud/arrive-server/pay/vite-pay/assets/constants-*.js
// https://cdnjs.cloudflare.com/ajax/libs/OwlCarousel2/2.3.4/owl.carousel.min.js
// https://cdnjs.cloudflare.com/ajax/libs/animate.css/4.1.1/animate.min.css
@@ -87,46 +74,54 @@
// https://code.jquery.com/jquery-3.7.1.min.js
// https://connect.facebook.net/en_US/fbevents.js
// https://consent.cookiebot.com/uc.js
-// https://definitions.sqspcdn.com/website-component-definition/static-assets/*/*.js
-// https://embed.tawk.to/_s/v4/app/*/js/twk-runtime.js
-// https://embed.tawk.to/_s/v4/app/*/js/twk-vendor.js
+// https://definitions.sqspcdn.com/website-component-definition/static-assets/:v1/:v2/*.js
+// https://embed.tawk.to/_s/v4/app/:v/js/twk-runtime.js
+// https://embed.tawk.to/_s/v4/app/:v/js/twk-vendor.js
// https://img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/bs-defaultSocialIconPack-a2c518b6.js
// https://img1.wsimg.com/blobby/go/static/radpack/@wsb/guac-widget-shared/lib/components/Carousel-7574d33c.js
// https://img1.wsimg.com/blobby/go/static/radpack/@wsb/guac-widget-shared/lib/components/DynamicFontScaler-6cccd626.js
// https://img1.wsimg.com/ceph-p3-01/website-builder-data-prod/static/widgets/UX.4.5*.js
// https://invitejs.trustpilot.com/tp.min.js
// https://m.stripe.network/out-4.5.45.js
-// https://maps.google.com/maps-api-v3/api/js/*/common.js
-// https://maps.google.com/maps-api-v3/api/js/*/util.js
-// https://maps.googleapis.com/maps-api-v3/api/js/*/common.js
-// https://maps.googleapis.com/maps-api-v3/api/js/*/controls.js
-// https://maps.googleapis.com/maps-api-v3/api/js/*/geocoder.js
-// https://maps.googleapis.com/maps-api-v3/api/js/*/geometry.js
-// https://maps.googleapis.com/maps-api-v3/api/js/*/infowindow.js
-// https://maps.googleapis.com/maps-api-v3/api/js/*/log.js
-// https://maps.googleapis.com/maps-api-v3/api/js/*/main.js
-// https://maps.googleapis.com/maps-api-v3/api/js/*/map.js
-// https://maps.googleapis.com/maps-api-v3/api/js/*/marker.js
-// https://maps.googleapis.com/maps-api-v3/api/js/*/onion.js
-// https://maps.googleapis.com/maps-api-v3/api/js/*/places_impl.js
-// https://maps.googleapis.com/maps-api-v3/api/js/*/search.js
-// https://maps.googleapis.com/maps-api-v3/api/js/*/search_impl.js
-// https://maps.googleapis.com/maps-api-v3/api/js/*/util.js
+// https://maps.google.com/maps-api-v3/api/js/:v1/:v2/common.js
+// https://maps.google.com/maps-api-v3/api/js/:v1/:v2/util.js
+// https://maps.googleapis.com/maps-api-v3/api/js/:v1/:v2/common.js
+// https://maps.googleapis.com/maps-api-v3/api/js/:v1/:v2/controls.js
+// https://maps.googleapis.com/maps-api-v3/api/js/:v1/:v2/geocoder.js
+// https://maps.googleapis.com/maps-api-v3/api/js/:v1/:v2/geometry.js
+// https://maps.googleapis.com/maps-api-v3/api/js/:v1/:v2/infowindow.js
+// https://maps.googleapis.com/maps-api-v3/api/js/:v1/:v2/intl/:v3/common.js
+// https://maps.googleapis.com/maps-api-v3/api/js/:v1/:v2/intl/:v3/geometry.js
+// https://maps.googleapis.com/maps-api-v3/api/js/:v1/:v2/intl/:v3/main.js
+// https://maps.googleapis.com/maps-api-v3/api/js/:v1/:v2/intl/:v3/map.js
+// https://maps.googleapis.com/maps-api-v3/api/js/:v1/:v2/intl/:v3/onion.js
+// https://maps.googleapis.com/maps-api-v3/api/js/:v1/:v2/intl/:v3/search.js
+// https://maps.googleapis.com/maps-api-v3/api/js/:v1/:v2/intl/:v3/search_impl.js
+// https://maps.googleapis.com/maps-api-v3/api/js/:v1/:v2/intl/:v3/util.js
+// https://maps.googleapis.com/maps-api-v3/api/js/:v1/:v2/log.js
+// https://maps.googleapis.com/maps-api-v3/api/js/:v1/:v2/main.js
+// https://maps.googleapis.com/maps-api-v3/api/js/:v1/:v2/map.js
+// https://maps.googleapis.com/maps-api-v3/api/js/:v1/:v2/marker.js
+// https://maps.googleapis.com/maps-api-v3/api/js/:v1/:v2/onion.js
+// https://maps.googleapis.com/maps-api-v3/api/js/:v1/:v2/places_impl.js
+// https://maps.googleapis.com/maps-api-v3/api/js/:v1/:v2/search.js
+// https://maps.googleapis.com/maps-api-v3/api/js/:v1/:v2/search_impl.js
+// https://maps.googleapis.com/maps-api-v3/api/js/:v1/:v2/util.js
// https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
// https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
// https://maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css
// https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
// https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js
-// https://pagead2.googlesyndication.com/pagead/managed/js/adsense/*/reactive_library_fy2021.js
-// https://pagead2.googlesyndication.com/pagead/managed/js/adsense/*/show_ads_impl_fy2021.js
+// https://pagead2.googlesyndication.com/pagead/managed/js/adsense/:v/reactive_library_fy2021.js
+// https://pagead2.googlesyndication.com/pagead/managed/js/adsense/:v/show_ads_impl_fy2021.js
// https://platform-api.sharethis.com/js/sharethis.js
// https://platform.twitter.com/widgets.js
// https://s.yimg.jp/images/listing/tool/cv/ytag.js
// https://s3.amazonaws.com/downloads.mailchimp.com/js/mc-validate.js
// https://sc-static.net/scevent.min.js
// https://script.crazyegg.com/pages/scripts/0129/6552.js
-// https://securepubads.g.doubleclick.net/pagead/managed/dict/*/gpt
-// https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/*/pubads_impl.js
+// https://securepubads.g.doubleclick.net/pagead/managed/dict/:v/gpt
+// https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/:v/pubads_impl.js
// https://ssl.google-analytics.com/ga.js
// https://ssl.gstatic.com/accounts/o/2580342461-postmessagerelay.js
// https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
@@ -134,8 +129,8 @@
// https://static.cloudflareinsights.com/beacon.min.js
// https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
// https://static.criteo.net/js/ld/publishertag.ids.js
-// https://static.parastorage.com/services/chat-widget/*/chat-widget.bundle.min.js
-// https://static.parastorage.com/services/chat-widget/*/chat-widget.min.css
+// https://static.parastorage.com/services/chat-widget/:v/chat-widget.bundle.min.js
+// https://static.parastorage.com/services/chat-widget/:v/chat-widget.min.css
// https://static.parastorage.com/services/cookie-consent-banner-for-uou/1.819.0//app.bundle.min.js
// https://static.parastorage.com/services/editor-elements-library/dist/thunderbolt/rb_wixui.thunderbolt[*Section].*.bundle.min.js
// https://static.parastorage.com/services/editor-elements-library/dist/thunderbolt/rb_wixui.thunderbolt[AppWidget_Classic].92255d46.bundle.min.js
@@ -165,7 +160,7 @@
// https://static.parastorage.com/services/fonts-data/dist/google.kuw5gk7jh0nwy00zmif1.css
// https://static.parastorage.com/services/fonts-data/dist/wixMadefor.j95mkaziqjnrn77aekr8.css
// https://static.parastorage.com/services/js-sdk/1.640.0/js/wix-private.min.js
-// https://static.parastorage.com/services/profile-card-tpa-ooi/*/ProfileCardViewerWidgetNoCss.bundle.min.js
+// https://static.parastorage.com/services/profile-card-tpa-ooi/:v/ProfileCardViewerWidgetNoCss.bundle.min.js
// https://static.parastorage.com/services/santa-resources/dist/viewer/user-site-fonts/v19/languages.css
// https://static.parastorage.com/services/tag-manager-client/1.1028.0/siteTags.bundle.min.js
// https://static.parastorage.com/services/third-party/fonts/Helvetica/fontFace.css
@@ -188,317 +183,313 @@
// https://static.wikia.nocookie.net/silversurfer/prod/latest/sdk-cross-domain.js
// https://static.wikia.nocookie.net/silversurfer/prod/latest/sdk.js
// https://static.zdassets.com/web_widget/messenger/latest/web-widget-*.js
-// https://static1.squarespace.com/static/vta/5c5a519771c10ba3470d8101/versioned-assets/*/static.css
+// https://static1.squarespace.com/static/vta/5c5a519771c10ba3470d8101/versioned-assets/:v/static.css
// https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
-// https://tpc.googlesyndication.com/pagead/js/*/r20110914/abg_lite_fy2021.js
-// https://tpc.googlesyndication.com/pagead/js/*/r20110914/client/qs_click_protection_fy2021.js
-// https://tpc.googlesyndication.com/pagead/js/*/r20110914/client/window_focus_fy2021.js
-// https://tpc.googlesyndication.com/pagead/js/*/r20110914/elements/html/fullscreen_api_adapter_fy2021.js
-// https://tpc.googlesyndication.com/pagead/js/*/r20110914/elements/html/interstitial_ad_frame_fy2021.js
-// https://translate.googleapis.com/_/translate_http/_/js/*/d=1/exm=el_conf/ed=1/*/m=el_main
+// https://tpc.googlesyndication.com/pagead/js/:v/r20110914/abg_lite_fy2021.js
+// https://tpc.googlesyndication.com/pagead/js/:v/r20110914/client/qs_click_protection_fy2021.js
+// https://tpc.googlesyndication.com/pagead/js/:v/r20110914/client/window_focus_fy2021.js
+// https://tpc.googlesyndication.com/pagead/js/:v/r20110914/elements/html/fullscreen_api_adapter_fy2021.js
+// https://tpc.googlesyndication.com/pagead/js/:v/r20110914/elements/html/interstitial_ad_frame_fy2021.js
+// https://translate.googleapis.com/_/translate_http/_/js/:v1/:v2/d=1/exm=el_conf/ed=1/:v3/m=el_main
// https://unpkg.com/aos@2.3.1/dist/aos.css
// https://unpkg.com/aos@2.3.1/dist/aos.js
-// https://wsv3cdn.audioeye.com/static-scripts/m/audioeye-scanner-esm/*/audioeye-scanner-esm.js
-// https://wsv3cdn.audioeye.com/static-scripts/v2/*/compliance.bundle.js
-// https://wsv3cdn.audioeye.com/static-scripts/v2/*/fullCSS.bundle.css
-// https://wsv3cdn.audioeye.com/static-scripts/v2/*/launcher.bundle.js
-// https://wsv3cdn.audioeye.com/static-scripts/v2/*/startup.bundle.js
-// https://wsv3cdn.audioeye.com/static-scripts/v2/*/tangoEngine.bundle.js
+// https://wsv3cdn.audioeye.com/static-scripts/m/audioeye-scanner-esm/:v/audioeye-scanner-esm.js
+// https://wsv3cdn.audioeye.com/static-scripts/v2/:v/compliance.bundle.js
+// https://wsv3cdn.audioeye.com/static-scripts/v2/:v/fullCSS.bundle.css
+// https://wsv3cdn.audioeye.com/static-scripts/v2/:v/launcher.bundle.js
+// https://wsv3cdn.audioeye.com/static-scripts/v2/:v/startup.bundle.js
+// https://wsv3cdn.audioeye.com/static-scripts/v2/:v/tangoEngine.bundle.js
// https://www.blogger.com/static/v1/v-css/828616780-lightbox_bundle.css
// https://www.blogger.com/static/v1/widgets/3772415480-widget_css_mobile_2_bundle.css
// https://www.google-analytics.com/analytics.js
// https://www.google-analytics.com/ga.js
// https://www.google-analytics.com/plugins/ua/ec.js
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/services/network/pervasive_resources/shared_resource_checker_unittest.cc b/services/network/pervasive_resources/shared_resource_checker_unittest.cc
index 6ec53d3..ff847106 100644
--- a/services/network/pervasive_resources/shared_resource_checker_unittest.cc
+++ b/services/network/pervasive_resources/shared_resource_checker_unittest.cc
@@ -70,21 +70,24 @@
// Zstandard-compressed list of newline-delimited URL patterns:
// https://www.example.test/exact
// https://www.example.test/wildcard/end/*
-// https://www.example.test/wildcard/*/middle
+// https://www.example.test/wildcard/:v/middle
+// https://www.example.test/wildcard/:v1/:v2/two
// https://www2.example.test/exact
static constexpr uint8_t kTestUrlPatternsZstd[] = {
- 0x28, 0xb5, 0x2f, 0xfd, 0x24, 0x91, 0xfd, 0x01, 0x00, 0x62, 0x83,
- 0x0b, 0x10, 0xb0, 0xeb, 0xc0, 0x6a, 0xcf, 0x90, 0x83, 0xa5, 0x91,
- 0xf1, 0x43, 0x89, 0xcd, 0xae, 0x12, 0x03, 0xe3, 0xc9, 0x46, 0xaa,
- 0x21, 0xd4, 0xeb, 0x75, 0x2b, 0xc6, 0x09, 0x25, 0x40, 0x53, 0xde,
- 0x8b, 0xee, 0x28, 0x9e, 0x98, 0x2a, 0xef, 0x22, 0x33, 0x5b, 0xe2,
- 0x18, 0xe2, 0x09, 0x04, 0x00, 0x76, 0x48, 0x84, 0x53, 0x1c, 0x67,
- 0x29, 0x52, 0x2d, 0x16, 0xe5, 0x04, 0xd5, 0xee, 0x35, 0x49};
+ 0x28, 0xb5, 0x2f, 0xfd, 0x24, 0xc0, 0x55, 0x02, 0x00, 0x12, 0x84,
+ 0x0d, 0x11, 0xa0, 0xed, 0x08, 0xda, 0xf8, 0xd1, 0x4b, 0x91, 0xd6,
+ 0x3f, 0xaa, 0xed, 0x81, 0xfd, 0xeb, 0x61, 0x05, 0x39, 0x58, 0xf3,
+ 0x07, 0x24, 0x17, 0x9b, 0x54, 0x91, 0x3a, 0x24, 0xe1, 0xba, 0xf6,
+ 0xea, 0x8a, 0xd1, 0x84, 0x1a, 0xb0, 0x29, 0x71, 0xcf, 0x6f, 0x39,
+ 0x37, 0x35, 0x55, 0xe2, 0x66, 0x77, 0xff, 0xe4, 0x35, 0xe6, 0x13,
+ 0x05, 0x00, 0x25, 0xe3, 0xe1, 0xa8, 0xb8, 0xe3, 0xa9, 0xe7, 0xb0,
+ 0x14, 0xa9, 0x16, 0x8b, 0x72, 0x02, 0x80, 0xa1, 0x96, 0xdb};
static const char* kPatternMatches[] = {
"https://www.example.test/exact",
"https://www.example.test/wildcard/end/match",
"https://www.example.test/wildcard/match/middle",
+ "https://www.example.test/wildcard/match/both/two",
"https://www2.example.test/exact"};
static const char* kPatternMatchFails[] = {
@@ -93,6 +96,8 @@
"https://www.example.test/exact2",
"https://www.example.test/wildcard/end",
"https://www.example.test/wildcard/not/middl",
+ "https://www.example.test/wildcard/match/not/middle",
+ "https://www.example.test/wildcard/match/not/three/two",
"https://www2.example.test/exac",
"https://www3.example.test/exact",
"http://www.example.test/exact",
Loading diff…
Original Bug Report
reported by vm...@google.com
Cache partitioning bypass via over-broad URLPattern wildcard in SharedResourceChecker
Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.
Overview: A potential discrepancy in how the SharedResourceChecker compiles pervasive resource patterns allows a bare wildcard ‘*’ to match across directory boundaries. This over-broad pattern matching on multi-tenant CDNs (such as cdn.shopify.com) can cause low-popularity tenant assets to bypass Network Isolation Key cache partitioning. A malicious site could potentially leverage this to perform cross-site cache-timing attacks (XS-Leaks) and infer a user’s browsing history.
Affected files:
services/network/pervasive_resources/shared_resource_checker.ccservices/network/pervasive_resources/shared_resource_checker_patterns.htools/pervasive_resources/pervasive.pynet/http/http_cache.ccthird_party/liburlpattern/parse.ccthird_party/liburlpattern/utils.h
Estimated timestamp from git blame: 2026-01-29
Description
The SharedResourceChecker (in services/network/pervasive_resources/shared_resource_checker.cc) is designed to classify highly popular, pervasive web resources so they can skip HTTP Cache partitioning (omitting the NetworkIsolationKey double-key prefix), reducing redundant downloads of common scripts.
However, a discrepancy exists between how patterns are compiled by the generator and how they are parsed at runtime:
- The generator script (
tools/pervasive_resources/pervasive.py) replaces single differing path segments with*and assumes that the wildcard will strictly match a single segment. - At runtime, the checker compiles each entry via
SimpleUrlPatternMatcher::Create(), which adheres to URLPattern constructor-string semantics. In this grammar, a bare*is parsed as a full wildcard (PartType::kFullWildcard, which compiles to the RE2 regular expression.*). Under standard pathname options, this full wildcard matches across/directory boundaries.
As a result, a pattern like https://cdn.shopify.com/extensions/*/assets/index.js (curated to match single-segment differences) is interpreted by the browser as matching /extensions/<arbitrary>/<depth>/<segments>/assets/index.js recursively.
This over-broad match enables multi-tenant hosting paths (where users can register custom subdirectories, regardless of popularity) to qualify for single-keyed caching. A malicious site can exploit this behavior to perform a cross-site history leak (XS-Leak) via cache timing.
Potential Attack Steps
Note: The following are suggested potential steps to trigger the issue, as our tooling does not currently have the capability to execute a live proof of concept.
- An attacker registers a custom Shopify Extension hosted at
https://cdn.shopify.com/extensions/{ATTACKER_UUID}/{VERSION}/assets/index.js. - The attacker targets a low-popularity Shopify Extension
PROBElocated athttps://cdn.shopify.com/extensions/{TARGET_UUID}/{VERSION}/assets/index.jsand wishes to find out if the victim has visited the merchant site using this extension. - The victim navigates to
https://attacker.example/(this main-frame navigation satisfies the user gesture/navigation tracking gate in theSharedResourceChecker). - The attacker’s page programmatically loads
PROBE(e.g. via<script src="...">) and measures the load time viaPerformanceResourceTiming. - Because of the wildcard bug, the pattern matcher matches the nested subdirectory. If the victim visited the target merchant earlier, the unpartitioned cache entry exists and is loaded instantly (Cache Hit). Otherwise, it fetches over the network (Cache Miss), leaking one bit of visited-site history.
Suggested Fix
- Modify the offline pattern generator (
tools/pervasive_resources/pervasive.py) to emit a named segment wildcard (e.g.,:v) rather than a bare*for single path segments, which will restrict matching to a single directory level. - Alternatively, adjust
SharedResourceCheckerto escape bare*wildcards or translate them into segment-matching patterns before passing them toSimpleUrlPatternMatcher::Create().
Evaluated with Chrome root at commit: d8b226a3be7c9c1ac9240c09e14698866c82e4ac
Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:
- If you are familiar with the severity guidelines, you may adjust the severity.
- If this is a false positive, and there’s no work to be done, please close as WAI.
- If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.
Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.
References
On This Page