CVE-2026-2441

High chrome UAF ⚠️ Exploited in the wild 📄 Reporter bug report 🔧 Commit mapped

Overview

High

Severity

—

CVSS

Yes

Exploited ITW

Fixed

Fix Status

ImpactUse after free in CSS

DescriptionUse after free in CSS

ComponentCSS

Bug ClassUAF

Tracker483569511

Fix commite045399a1ecb (chromium/src) +65/-10

CISA KEVNot listed

CreditedShaheen Fazim

Disclosed2026-02-13

Background

Use-after-free (UAF): A memory-safety bug where code dereferences a pointer or iterator that refers to memory already freed or relocated.
`CSSFontFeatureValuesMap`: A Blink DOM object exposing a @font-feature-values rule’s alias map (e.g. @styleset) to JavaScript as an iterable maplike interface.
`FontFeatureAliases`: The underlying HashMap storage holding the feature-value alias entries that CSSFontFeatureValuesMap wraps.
`IterationSource`: A Blink helper created per entries()/iterator call whose FetchNextItem is invoked repeatedly to yield successive key/value pairs to script.

Root Cause Analysis

CSSFontFeatureValuesMap::CreateIterationSource constructed a FontFeatureValuesMapIterationSource holding a raw pointer aliases_ to the live FontFeatureAliases HashMap plus a FontFeatureAliases::const_iterator iterator_ bound directly to that map’s storage. Each FetchNextItem call advanced iterator_ and dereferenced it, but nothing prevented script from mutating the map between calls: the standard maplike next() returns control to JavaScript, which could call map.delete() and map.set() and force the HashMap to rehash or reallocate its backing store. Because a HashMap iterator is invalidated by insertion or deletion, the retained iterator_ (and the entry pointers it yields) then referenced freed/relocated memory, violating the invariant that an iterator must outlive no structural modification of its container.

The fix changes the source to store a by-value const FontFeatureAliases aliases_ snapshot (std::move-constructed from a copy) and binds iterator_ to that owned copy, so subsequent script mutations of the original map cannot invalidate the iteration. The obsolete null-pointer guard is removed because a value-typed member can no longer be null.

Key insight

The core mistake was iterating over the live, script-mutable FontFeatureAliases HashMap through a borrowed pointer and iterator that JavaScript could invalidate mid-iteration; the fix copies the map into the IterationSource so iteration proceeds over a stable, privately owned snapshot.

Attack Path

Define a feature-values rule Author a @font-feature-values rule with a populated block such as @styleset { a: 1; b: 2; c: 3; } and obtain its CSSFontFeatureValuesMap via the CSSOM.
Begin iteration Call map.entries() (or otherwise iterate), causing CreateIterationSource to bind iterator_ to the live FontFeatureAliases map.
Mutate mid-iteration Inside the loop, after each iterator.next(), call map.delete(key) and repeatedly map.set(...) to force the HashMap to grow and rehash its backing storage.
Trigger the stale access The next FetchNextItem dereferences the now-invalidated iterator_, reading from freed or relocated memory.
Exploit the freed access Grooming the heap so the reallocated region is attacker-controlled turns the stale read/advance into a controlled use-after-free primitive.

Impact Assessment

An attacker who runs script in a renderer gains a use-after-free on the FontFeatureAliases HashMap backing store, reachable entirely from unprivileged web content with no special permissions. This executes in the renderer process, and with heap grooming it can yield information disclosure or memory corruption suitable for further renderer compromise; the only precondition is the ability to script a page that defines and iterates a @font-feature-values map.

Changed Functions

Function	Change	Notes
`if` third_party/blink/renderer/core/css/css_font_feature_values_map.cc	modified
`CreateIterationSource` third_party/blink/renderer/core/css/css_font_feature_values_map.cc	modified
`while` third_party/blink/web_tests/external/wpt/css/css-fonts/font_feature_values_map_iteration.html	modified
`for` third_party/blink/web_tests/external/wpt/css/css-fonts/font_feature_values_map_iteration.html	modified

Files Changed

third_party/blink/renderer/core/css/css_font_feature_values_map.cc
third_party/blink/web_tests/external/wpt/css/css-fonts/font_feature_values_map_iteration.html

Audit Directions

Iterator bound to script-reachable container
Audit every Blink IterationSource/FetchNextItem implementation that retains a raw pointer or iterator into a live collection, since next() yields control to JavaScript that can structurally mutate and invalidate it.
`HashMap`/`Vector` iterator lifetime across yields
Flag any stored const_iterator into a WTF::HashMap or Vector whose owning object survives across a callback or microtask, because insertion or removal reallocates the backing store and invalidates the iterator.
Snapshot-versus-live iteration semantics
Where maplike/setlike DOM interfaces expose mutable maps, verify iteration takes an owned copy or uses stable storage (as tracked in the follow-up crbug.com/483936078), rather than assuming callers will not mutate during enumeration.

Patch

view commit

From e045399a1ecb7ee16e1a7bcbcd8ea59d283dfb07 Mon Sep 17 00:00:00 2001
From: Dominik Röttsches <drott@chromium.org>
Date: Thu, 12 Feb 2026 06:35:36 -0800
Subject: [PATCH] Avoid stale iteration in CSSFontFeatureValuesMap

To avoid invalid iterator state, take a snapshot of the
map when creating the iteration source. This addresses
the immediate problem of iterating while modifying.

Remaining work tracked in https://crbug.com/483936078

Fixed: 483569511
Change-Id: Ie29cfdf7ed94bbe189b44c842a5efce571bb2cee
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7566570
Commit-Queue: Dominik Röttsches <drott@chromium.org>
Reviewed-by: Anders Hartvoll Ruud <andruud@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1583927}
---

diff --git a/third_party/blink/renderer/core/css/css_font_feature_values_map.cc b/third_party/blink/renderer/core/css/css_font_feature_values_map.cc
index 0c59907..2ea2790 100644
--- a/third_party/blink/renderer/core/css/css_font_feature_values_map.cc
+++ b/third_party/blink/renderer/core/css/css_font_feature_values_map.cc
@@ -13,16 +13,15 @@
     : public PairSyncIterable<CSSFontFeatureValuesMap>::IterationSource {
  public:
   FontFeatureValuesMapIterationSource(const CSSFontFeatureValuesMap& map,
-                                      const FontFeatureAliases* aliases)
-      : map_(map), aliases_(aliases), iterator_(aliases->begin()) {}
+                                      const FontFeatureAliases aliases)
+      : map_(map),
+        aliases_(std::move(aliases)),
+        iterator_(aliases_.begin()) {}
 
   bool FetchNextItem(ScriptState* script_state,
                      String& map_key,
                      Vector<uint32_t>& map_value) override {
-    if (!aliases_) {
-      return false;
-    }
-    if (iterator_ == aliases_->end()) {
+    if (iterator_ == aliases_.end()) {
       return false;
     }
     map_key = iterator_->key;
@@ -37,9 +36,13 @@
   }
 
  private:
-  // Needs to be kept alive while we're iterating over it.
   const Member<const CSSFontFeatureValuesMap> map_;
-  const FontFeatureAliases* aliases_;
+  // Create a copy to keep the iterator from becoming invalid if there are
+  // modifications to the aliases HashMap while iterating.
+  // TODO(https://crbug.com/483936078): Implement live/stable iteration over
+  // FontFeatureAliases by changing its storage type, avoiding taking a copy
+  // here.
+  const FontFeatureAliases aliases_;
   FontFeatureAliases::const_iterator iterator_;
 };
 
@@ -49,8 +52,8 @@
 
 PairSyncIterable<CSSFontFeatureValuesMap>::IterationSource*
 CSSFontFeatureValuesMap::CreateIterationSource(ScriptState*) {
-  return MakeGarbageCollected<FontFeatureValuesMapIterationSource>(*this,
-                                                                   aliases_);
+  return MakeGarbageCollected<FontFeatureValuesMapIterationSource>(
+      *this, aliases_ ? *aliases_ : FontFeatureAliases());
 }
 
 bool CSSFontFeatureValuesMap::GetMapEntry(ScriptState*,
diff --git a/third_party/blink/web_tests/external/wpt/css/css-fonts/font_feature_values_map_iteration.html b/third_party/blink/web_tests/external/wpt/css/css-fonts/font_feature_values_map_iteration.html
new file mode 100644
index 0000000..eac7198
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/css/css-fonts/font_feature_values_map_iteration.html
@@ -0,0 +1,52 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>CSSFontFeatureValuesMap Iteration and Modification</title>
+    <link
+      rel="help"
+      href="https://drafts.csswg.org/css-fonts-4/#om-fontfeaturevalues"
+    />
+    <meta
+      name="assert"
+      content="Iteration while modifying CSSFontFeatureValuesMap does not crash."
+    />
+    <script type="text/javascript" src="/resources/testharness.js"></script>
+    <script
+      type="text/javascript"
+      src="/resources/testharnessreport.js"
+    ></script>
+  </head>
+  <body>
+    <style>
+      @font-feature-values TestFont {
+        @styleset {
+          a: 1;
+          b: 2;
+          c: 3;
+        }
+      }
+    </style>
+    <script>
+      test(() => {
+        const rule = document.styleSheets[0].cssRules[0];
+        const map = rule.styleset;
+        const iterator = map.entries();
+        let count = 0;
+
+        while (count < 10) {
+          const { value: entry, done } = iterator.next();
+          if (done) break;
+
+          const [key, value] = entry;
+
+          map.delete(key);
+          for (let i = 0; i < 100; i++) {
+            map.set(`newkey_${count}_${i}`, i);
+          }
+
+          count++;
+        }
+      }, "Iteration of the CSSFontFeatureValuesMap does not crash.");
+    </script>
+  </body>
+</html>

Loading diff…

Regression Test / PoC

shipped with the fix

diff --git a/third_party/blink/web_tests/external/wpt/css/css-fonts/font_feature_values_map_iteration.html b/third_party/blink/web_tests/external/wpt/css/css-fonts/font_feature_values_map_iteration.html
new file mode 100644
index 0000000..eac7198
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/css/css-fonts/font_feature_values_map_iteration.html
@@ -0,0 +1,52 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>CSSFontFeatureValuesMap Iteration and Modification</title>
+    <link
+      rel="help"
+      href="https://drafts.csswg.org/css-fonts-4/#om-fontfeaturevalues"
+    />
+    <meta
+      name="assert"
+      content="Iteration while modifying CSSFontFeatureValuesMap does not crash."
+    />
+    <script type="text/javascript" src="/resources/testharness.js"></script>
+    <script
+      type="text/javascript"
+      src="/resources/testharnessreport.js"
+    ></script>
+  </head>
+  <body>
+    <style>
+      @font-feature-values TestFont {
+        @styleset {
+          a: 1;
+          b: 2;
+          c: 3;
+        }
+      }
+    </style>
+    <script>
+      test(() => {
+        const rule = document.styleSheets[0].cssRules[0];
+        const map = rule.styleset;
+        const iterator = map.entries();
+        let count = 0;
+
+        while (count < 10) {
+          const { value: entry, done } = iterator.next();
+          if (done) break;
+
+          const [key, value] = entry;
+
+          map.delete(key);
+          for (let i = 0; i < 100; i++) {
+            map.set(`newkey_${count}_${i}`, i);
+          }
+
+          count++;
+        }
+      }, "Iteration of the CSSFontFeatureValuesMap does not crash.");
+    </script>
+  </body>
+</html>

Loading diff…

Original Bug Report

reported by fa...@gmail.com

Heap-use-after-free in blink::FontFeatureValuesMapIterationSource::FetchNextItem

=================================================================
==14716==ERROR: AddressSanitizer: heap-use-after-free on address 0x1299338070a0 at pc 0x7fff28a19313 bp 0x00e5f864bca0 sp 0x00e5f864bce8
READ of size 8 at 0x1299338070a0 thread T78
    #0 0x7fff28a19312 in blink::String::operator= C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\wtf\text\wtf_string.h:110
    #1 0x7fff3d30e3f9 in blink::FontFeatureValuesMapIterationSource::FetchNextItem C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\css_font_feature_values_map.cc:28
    #2 0x7fff3f3b49c9 in blink::bindings::PairSyncIterationSource<blink::IDLStringBase<0>,blink::IDLSequence<blink::IDLIntegerTypeBase<unsigned int,0> >,blink::String,blink::Vector<unsigned int,0,blink::PartitionAllocator> >::ForEach C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\bindings\core\v8\iterable.h:107
    #3 0x7fff3f3b2457 in blink::`anonymous namespace'::v8_css_font_feature_values_map::ForEachOperationCallback C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\blink\renderer\bindings\core\v8\v8_css_font_feature_values_map.cc:224
    #4 0x7ea89b690de4  (<unknown module>)

0x1299338070a0 is located 32 bytes inside of 256-byte region [0x129933807080,0x129933807180)
freed by thread T78 here:
    #0 0x7fff9cadc83f in _asan_wrap_memcpy+0x62f (C:\Users\Admin\Desktop\chrome-fuzzer\chrome-asan\clang_rt.asan_dynamic-x86_64.dll+0x18004c83f)
    #1 0x7fff1afb23a3 in _free_base C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_malloc_win_thunk.cpp:52
    #2 0x7fff3c9f3e73 in blink::HashTable<blink::AtomicString,blink::KeyValuePair<blink::AtomicString,blink::FeatureIndicesWithPriority>,blink::KeyValuePairExtractor,blink::HashMapValueTraits<blink::HashTraits<blink::AtomicString>,blink::HashTraits<blink::FeatureIndicesWithPriority> >,blink::HashTraits<blink::AtomicString>,blink::PartitionAllocator>::clear C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\wtf\hash_table.h:1801
    #3 0x7fff3c9f36b8 in blink::HashTable<blink::AtomicString,blink::KeyValuePair<blink::AtomicString,blink::FeatureIndicesWithPriority>,blink::KeyValuePairExtractor,blink::HashMapValueTraits<blink::HashTraits<blink::AtomicString>,blink::HashTraits<blink::FeatureIndicesWithPriority> >,blink::HashTraits<blink::AtomicString>,blink::PartitionAllocator>::RehashTo C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\wtf\hash_table.h:1736
    #4 0x7fff3c9f32bf in blink::HashTable<blink::AtomicString,blink::KeyValuePair<blink::AtomicString,blink::FeatureIndicesWithPriority>,blink::KeyValuePairExtractor,blink::HashMapValueTraits<blink::HashTraits<blink::AtomicString>,blink::HashTraits<blink::FeatureIndicesWithPriority> >,blink::HashTraits<blink::AtomicString>,blink::PartitionAllocator>::Expand C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\wtf\hash_table.h:1626
    #5 0x7fff3c9f42b6 in blink::HashTable<blink::AtomicString,blink::KeyValuePair<blink::AtomicString,blink::FeatureIndicesWithPriority>,blink::KeyValuePairExtractor,blink::HashMapValueTraits<blink::HashTraits<blink::AtomicString>,blink::HashTraits<blink::FeatureIndicesWithPriority> >,blink::HashTraits<blink::AtomicString>,blink::PartitionAllocator>::insert<blink::HashMapTranslator<blink::HashTraits<blink::AtomicString>,blink::HashMapValueTraits<blink::HashTraits<blink::AtomicString>,blink::HashTraits<blink::FeatureIndicesWithPriority> > >,blink::AtomicString &,blink::FeatureIndicesWithPriority> C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\wtf\hash_table.h:1280
    #6 0x7fff3d30c2dc in blink::CSSFontFeatureValuesMap::set C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\css_font_feature_values_map.cc:76
    #7 0x7fff3f3b0bb8 in blink::`anonymous namespace'::v8_css_font_feature_values_map::SetOperationCallback C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\blink\renderer\bindings\core\v8\v8_css_font_feature_values_map.cc:104
    #8 0x7ea89b690de4  (<unknown module>)

previously allocated by thread T78 here:
    #0 0x7fff9cadc94f in _asan_wrap_memcpy+0x73f (C:\Users\Admin\Desktop\chrome-fuzzer\chrome-asan\clang_rt.asan_dynamic-x86_64.dll+0x18004c94f)
    #1 0x7fff1afb23c3 in _malloc_base C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_malloc_win_thunk.cpp:64
    #2 0x7fff2f49729d in partition_alloc::PartitionRoot::Alloc<0> C:\b\s\w\ir\cache\builder\src\base\allocator\partition_allocator\src\partition_alloc\partition_root.h:532
    #3 0x7fff3c9f172c in blink::HashTable<blink::AtomicString,blink::KeyValuePair<blink::AtomicString,blink::FeatureIndicesWithPriority>,blink::KeyValuePairExtractor,blink::HashMapValueTraits<blink::HashTraits<blink::AtomicString>,blink::HashTraits<blink::FeatureIndicesWithPriority> >,blink::HashTraits<blink::AtomicString>,blink::PartitionAllocator>::HashTable C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\wtf\hash_table.h:1835
    #4 0x7fff3c9ed25b in blink::FontFeatureValuesStorage::FontFeatureValuesStorage C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\style_rule_font_feature_values.cc:48
    #5 0x7fff3c9f00d8 in blink::StyleRuleFontFeatureValues::StyleRuleFontFeatureValues C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\style_rule_font_feature_values.cc:145
    #6 0x7fff3cec9c63 in cppgc::MakeGarbageCollectedTrait<blink::StyleRuleFontFeatureValues>::Call<blink::Vector<blink::AtomicString,0,blink::PartitionAllocator>,blink::HashMap<blink::AtomicString,blink::FeatureIndicesWithPriority,blink::HashTraits<blink::AtomicString>,blink::HashTraits<blink::FeatureIndicesWithPriority>,blink::PartitionAllocator> &,blink::HashMap<blink::AtomicString,blink::FeatureIndicesWithPriority,blink::HashTraits<blink::AtomicString>,blink::HashTraits<blink::FeatureIndicesWithPriority>,blink::PartitionAllocator> &,blink::HashMap<blink::AtomicString,blink::FeatureIndicesWithPriority,blink::HashTraits<blink::AtomicString>,blink::HashTraits<blink::FeatureIndicesWithPriority>,blink::PartitionAllocator> &,blink::HashMap<blink::AtomicString,blink::FeatureIndicesWithPriority,blink::HashTraits<blink::AtomicString>,blink::HashTraits<blink::FeatureIndicesWithPriority>,blink::PartitionAllocator> &,blink::HashMap<blink::AtomicString,blink::FeatureIndicesWithPriority,blink::HashTraits<blink::AtomicString>,blink::HashTraits<blink::FeatureIndicesWithPriority>,blink::PartitionAllocator> &,blink::HashMap<blink::AtomicString,blink::FeatureIndicesWithPriority,blink::HashTraits<blink::AtomicString>,blink::HashTraits<blink::FeatureIndicesWithPriority>,blink::PartitionAllocator> &> C:\b\s\w\ir\cache\builder\src\v8\include\cppgc\allocation.h:239
    #7 0x7fff3ce99851 in blink::CSSParserImpl::ConsumeFontFeatureValuesRule C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\parser\css_parser_impl.cc:1807
    #8 0x7fff3ce92319 in blink::CSSParserImpl::ConsumeAtRuleContents C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\parser\css_parser_impl.cc:894
    #9 0x7fff3ce88050 in blink::CSSParserImpl::ParseStyleSheet C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\parser\css_parser_impl.cc:497
    #10 0x7fff3c9c4c76 in blink::StyleSheetContents::ParseString C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\style_sheet_contents.cc:510
    #11 0x7fff3ca6b07b in blink::StyleEngine::CreateSheet C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\style_engine.cc:1191
    #12 0x7fff3cabd301 in blink::StyleElement::CreateSheetOrModule C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\style_element.cc:246
    #13 0x7fff3cabc6bd in blink::StyleElement::FinishParsingChildren C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\style_element.cc:149
    #14 0x7fff3b7d9504 in blink::HTMLStyleElement::FinishParsingChildren C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\html\html_style_element.cc:69
    #15 0x7fff3e4a4464 in blink::HTMLElementStack::PopCommon C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\html\parser\html_element_stack.cc:512
    #16 0x7fff3e41cf9a in blink::HTMLTreeBuilder::ProcessEndTag C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\html\parser\html_tree_builder.cc:2328
    #17 0x7fff3e41ab56 in blink::HTMLTreeBuilder::ProcessToken C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\html\parser\html_tree_builder.cc:464
    #18 0x7fff3e418987 in blink::HTMLTreeBuilder::ConstructTree C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\html\parser\html_tree_builder.cc:416
    #19 0x7fff3e53db2b in blink::HTMLDocumentParser::PumpTokenizer C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\html\parser\html_document_parser.cc:761
    #20 0x7fff3e53b843 in blink::HTMLDocumentParser::PumpTokenizerIfPossible C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\html\parser\html_document_parser.cc:625
    #21 0x7fff3e549b30 in blink::HTMLDocumentParser::FinishAppend C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\html\parser\html_document_parser.cc:1028
    #22 0x7fff3e54a1e3 in blink::HTMLDocumentParser::CommitPreloadedData C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\html\parser\html_document_parser.cc:1043
    #23 0x7fff3a652cb6 in blink::DocumentLoader::StartLoadingResponse C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\loader\document_loader.cc:2140
    #24 0x7fff3a6631f8 in blink::DocumentLoader::CommitNavigation C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\loader\document_loader.cc:3184
    #25 0x7fff3a4ab314 in blink::FrameLoader::CommitDocumentLoader C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\loader\frame_loader.cc:1450
    #26 0x7fff3a4b7582 in blink::FrameLoader::CommitNavigation C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\loader\frame_loader.cc:1262
    #27 0x7fff3bcbc059 in blink::WebLocalFrameImpl::CommitNavigation C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\web_local_frame_impl.cc:2815

Thread T78 created by T0 here:
    #0 0x7fff9caedc94 in _asan_wrap_CreateThread+0x64 (C:\Users\Admin\Desktop\chrome-fuzzer\chrome-asan\clang_rt.asan_dynamic-x86_64.dll+0x18005dc94)
    #1 0x7fff2f0f71db in base::`anonymous namespace'::CreateThreadInternal C:\b\s\w\ir\cache\builder\src\base\threading\platform_thread_win.cc:178
    #2 0x7fff2f1d2568 in base::Thread::StartWithOptions C:\b\s\w\ir\cache\builder\src\base\threading\thread.cc:228
    #3 0x7fff25c8f623 in content::RenderProcessHostImpl::Init C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_process_host_impl.cc:1916
    #4 0x7fff256ff021 in content::AgentSchedulingGroupHost::Init C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\agent_scheduling_group_host.cc:244
    #5 0x7fff25c51dc3 in content::RenderFrameHostManager::InitRenderView C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_frame_host_manager.cc:4724
    #6 0x7fff25c3fa4e in content::RenderFrameHostManager::ReinitializeMainRenderFrame C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_frame_host_manager.cc:4976
    #7 0x7fff25c38198 in content::RenderFrameHostManager::GetFrameHostForNavigation C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_frame_host_manager.cc:2130
    #8 0x7fff25c351a9 in content::RenderFrameHostManager::DidCreateNavigationRequest C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_frame_host_manager.cc:1596
    #9 0x7fff257da730 in content::FrameTreeNode::TakeNavigationRequest C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\frame_tree_node.cc:628
    #10 0x7fff25aa75aa in content::Navigator::Navigate C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\navigator.cc:988
    #11 0x7fff2599339d in content::NavigationControllerImpl::NavigateWithoutEntry C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\navigation_controller_impl.cc:4132
    #12 0x7fff25991737 in content::NavigationControllerImpl::LoadURLWithParams C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\navigation_controller_impl.cc:1569
    #13 0x7fff4634ecdb in Navigate C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\browser_navigator.cc:815
    #14 0x7fff2af1720f in StartupBrowserCreatorImpl::OpenTabsInBrowser C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\startup\startup_browser_creator_impl.cc:383
    #15 0x7fff2af197ad in StartupBrowserCreatorImpl::RestoreOrCreateBrowser C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\startup\startup_browser_creator_impl.cc:702
    #16 0x7fff2af15bdd in StartupBrowserCreatorImpl::DetermineURLsAndLaunch C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\startup\startup_browser_creator_impl.cc:501
    #17 0x7fff2af14ca5 in StartupBrowserCreatorImpl::Launch C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\startup\startup_browser_creator_impl.cc:221
    #18 0x7fff2af0ccc5 in StartupBrowserCreator::LaunchBrowser C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\startup\startup_browser_creator.cc:730
    #19 0x7fff2af0d60d in `anonymous namespace'::OpenNewWindowForFirstRun C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\startup\startup_browser_creator.cc:472
    #20 0x7fff2af1392f in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(const base::CommandLine &, Profile *, const base::FilePath &, const std::__Cr::vector<GURL,std::__Cr::allocator<GURL> > &, chrome::startup::IsProcessStartup, chrome::startup::IsFirstRun, bool),base::CommandLine &&,Profile *&&,base::FilePath &&,std::__Cr::vector<GURL,std::__Cr::allocator<GURL> > &&,chrome::startup::IsProcessStartup &&,chrome::startup::IsFirstRun &&>,base::internal::BindState<0,1,0,void (*)(const base::CommandLine &, Profile *, const base::FilePath &, const std::__Cr::vector<GURL,std::__Cr::allocator<GURL> > &, chrome::startup::IsProcessStartup, chrome::startup::IsFirstRun, bool),base::CommandLine,base::internal::UnretainedWrapper<Profile,base::unretained_traits::MayNotDangle,0>,base::FilePath,std::__Cr::vector<GURL,std::__Cr::allocator<GURL> >,chrome::startup::IsProcessStartup,chrome::startup::IsFirstRun>,void (bool)>::RunOnce C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:982
    #21 0x7fff2af2d00b in FirstRunService::OpenFirstRunInternal C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\startup\first_run_service.cc:271
    #22 0x7fff2af2df40 in base::internal::Invoker<base::internal::FunctorTraits<void (FirstRunService::*&&)(),base::WeakPtr<FirstRunService> &&>,base::internal::BindState<1,1,0,void (FirstRunService::*)(),base::WeakPtr<FirstRunService> >,void ()>::RunOnce C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:982
    #23 0x7fff2f4416e2 in base::ScopedClosureRunner::~ScopedClosureRunner C:\b\s\w\ir\cache\builder\src\base\functional\callback_helpers.cc:27
    #24 0x7fff2af2b83a in FirstRunService::TryMarkFirstRunAlreadyFinished C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\startup\first_run_service.cc:182
    #25 0x7fff2af2cc0f in FirstRunService::OpenFirstRunIfNeeded C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\startup\first_run_service.cc:260
    #26 0x7fff2af0cc64 in StartupBrowserCreator::LaunchBrowser C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\startup\startup_browser_creator.cc:722
    #27 0x7fff2af0dc99 in StartupBrowserCreator::LaunchBrowserForLastProfiles C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\startup\startup_browser_creator.cc:824
    #28 0x7fff2af0c397 in StartupBrowserCreator::ProcessCmdLineImpl C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\startup\startup_browser_creator.cc:1310
    #29 0x7fff2af0a0ef in StartupBrowserCreator::Start C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\startup\startup_browser_creator.cc:684
    #30 0x7fff2edab62d in ChromeBrowserMainParts::PreMainMessageLoopRunImpl C:\b\s\w\ir\cache\builder\src\chrome\browser\chrome_browser_main.cc:1998
    #31 0x7fff2edaa38b in ChromeBrowserMainParts::PreMainMessageLoopRun C:\b\s\w\ir\cache\builder\src\chrome\browser\chrome_browser_main.cc:1416
    #32 0x7fff2471e572 in content::BrowserMainLoop::PreMainMessageLoopRun C:\b\s\w\ir\cache\builder\src\content\browser\browser_main_loop.cc:1017
    #33 0x7fff24725cf4 in base::internal::Invoker<base::internal::FunctorTraits<int (content::BrowserMainLoop::*&&)(),content::BrowserMainLoop *>,base::internal::BindState<1,1,0,int (content::BrowserMainLoop::*)(),base::internal::UnretainedWrapper<content::BrowserMainLoop,base::unretained_traits::MayNotDangle,0> >,int ()>::RunOnce C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:982
    #34 0x7fff261bbc6e in content::StartupTaskRunner::RunAllTasksNow C:\b\s\w\ir\cache\builder\src\content\browser\startup_task_runner.cc:49
    #35 0x7fff2471d40c in content::BrowserMainLoop::CreateStartupTasks C:\b\s\w\ir\cache\builder\src\content\browser\browser_main_loop.cc:923
    #36 0x7fff24728790 in content::BrowserMainRunnerImpl::Initialize C:\b\s\w\ir\cache\builder\src\content\browser\browser_main_runner_impl.cc:138
    #37 0x7fff247179b9 in content::BrowserMain C:\b\s\w\ir\cache\builder\src\content\browser\browser_main.cc:28
    #38 0x7fff2af4561a in content::RunBrowserProcessMain C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:696
    #39 0x7fff2af48b75 in content::ContentMainRunnerImpl::RunBrowser C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1312
    #40 0x7fff2af4813c in content::ContentMainRunnerImpl::Run C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1145
    #41 0x7fff2af3c0cf in content::RunContentProcess C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:358
    #42 0x7fff2af3c872 in content::ContentMain C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:371
    #43 0x7fff1afb2b06 in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:191
    #44 0x7ff7fd1d4807 in MainDllLoader::Launch C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:204
    #45 0x7ff7fd1d2074 in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:351
    #46 0x7ff7fd6c9bbf in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    #47 0x7ff82703e8d6 in BaseThreadInitThunk+0x16 (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e8d6)
    #48 0x7ff828fac40b in RtlUserThreadStart+0x2b (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18008c40b)

SUMMARY: AddressSanitizer: heap-use-after-free C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\wtf\text\wtf_string.h:110 in blink::String::operator=
Shadow bytes around the buggy address:
  0x129933806e00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x129933806e80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x129933806f00: fa fa fa fa fa fa f7 fa fd fd fd fd fd fd fd fd
  0x129933806f80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x129933807000: fd fd fd fd fd fd fd fd fa fa fa fa fa fa f7 fa
=>0x129933807080: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd
  0x129933807100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x129933807180: fa fa fa fa fa fa f7 fa fd fd fd fd fd fd fd fd
  0x129933807200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x129933807280: fd fd fd fd fd fd fd fd fa fa fa fa fa fa f7 fa
  0x129933807300: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==14716==ADDITIONAL INFO

==14716==Note: Please include this section with the ASan report.
Task trace:
    #0 0x7fff329ed269 in IPC::ChannelAssociatedGroupController::Accept C:\b\s\w\ir\cache\builder\src\ipc\ipc_mojo_bootstrap.cc:1138
    #1 0x7fff2f8d745b in mojo::SimpleWatcher::Context::Notify C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\system\simple_watcher.cc:103
    #2 0x7fff2f8d745b in mojo::SimpleWatcher::Context::Notify C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\system\simple_watcher.cc:103
    #3 0x7fff310e4dd4 in net::TCPSocketDefaultWin::ReadIfReady C:\b\s\w\ir\cache\builder\src\net\socket\tcp_socket_win.cc:724


Command line: `"C:\Users\Admin\Desktop\chrome-fuzzer\chrome-asan\chrome.exe" --single-process --user-data-dir="C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp0soadlxc_" --flag-switches-begin --flag-switches-end --gpu-preferences=SAAAAAAAAADoAQAEAAAAAAAAAAAAAMAAAwAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --lang=en-GB --num-raster-threads=4 --enable-main-frame-before-activation --file-url-path-alias="/gen=C:\Users\Admin\Desktop\chrome-fuzzer\chrome-asan\gen" http://127.0.0.1:8080/poc.html`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==14716==END OF ADDITIONAL INFO

==14716==ABORTING

VERSION

Version 146.0.7677.0 (Developer Build) (64-bit)

REPRODUCTION CASE

Build: win32-release_x64%2Fasan-win32-release_x64-1581412

Run: ./chrome.exe --single-process poc.html

Reporter credit: Shaheen Fazim

View on issue tracker

Links in the report

References

Vendor advisory Fix commit Bug tracker NVD

On This Page