High patch-now ✔︎ verified CVSS 8.8 chrome Integer Overflow 📄 Reporter bug report 🔧 Commit mapped

Overview

High

Severity

8.8

CVSS

Exploited ITW

Fixed

Fix Status

ImpactInteger overflow in Fonts

DescriptionInteger overflow in Fonts

ComponentFonts

Sub-componentM138-LTS

Bug ClassInteger Overflow

Action tierpatch-now — corruption primitive, web-reachable in default config (confirmed) — factors set by independent review by AI
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.

Independent review by AIConfirmed
The mapped commit may not contain the whole fix.
Reviewer notes: none false. Omission: 7b7d54e3 alone does not stop the reporter's exact 2^32 input; the add wraps to 0 and breaks, ensure(count) passes, and CUT overflows. Only 708bf4a0's cap stops it. Background ':632' lacks a version label next to 708bf4a0c80b^ cites.
A second, independent AI reviewer (not a human) re-derived this analysis from the fixing commit and the vendor advisory, looking for errors.

Tracker491516670

Fix commit7b7d54e33b8b (harfbuzz (upstream, via Chromium mirror)) +22/-2

Related commits708bf4a0c80b follow-up · harfbuzz (upstream, via Chromium mirror)

CWECWE-472, CWE-190 (Integer overflow)

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA KEVNot listed

CreditedGF, Un3xploitable Of DeadSec

Reported2026-03-11 (per vendor advisory)

Fix landed2026-03-09 (public git)

Disclosed2026-03-23

Patch gap14 days — fix public in source before the advisory

Background

`stch` stretching: An Arabic shaping feature where a glyph is replaced by fixed and repeating tiles, and apply_stch repeats the STCH_REPEATING tiles to fill the width of the surrounding word.
MEASURE / CUT passes: apply_stch runs a for (step = MEASURE; step <= CUT; ...) loop (src/hb-ot-shaper-arabic.cc:501, as shown at 708bf4a0c80b^): MEASURE adds up extra_glyphs_needed, and CUT copies glyphs backwards from write head j = count + extra_glyphs_needed (:506-507).
`buffer->ensure`: The hb_buffer_t growth call that MEASURE uses to make room for count + extra_glyphs_needed glyphs before CUT writes into info[] and pos[] (7b7d54e33b8b^:632).
`hb_unsigned_add_overflows`: A checked-add helper added to src/hb-algs.hh by this fix, which returns true when the unsigned sum wraps but still stores the wrapped sum in *result.

Root Cause Analysis

Verify before building a PoC

This analysis is consistent with the fixing commit but not fully provable from it: part of the vulnerable path lives in code the fix commit does not touch. Confirm the trigger and the sink against the source before relying on it for exploit development.
What the commit does not establish: none false. Omission: 7b7d54e3 alone does not stop the reporter's exact 2^32 input; the add wraps to 0 and breaks, ensure(count) passes, and CUT overflows. Only 708bf4a0's cap stops it. Background ':632' lacks a version label next to 708bf4a0c80b^ cites.

Re-analyzed on 2026-10-03 against the actual fix commit 7b7d54e33b8b. An earlier analysis was withdrawn because it had been written against a dependency roll (93bb0326da63). Fix coverage caveat: On detected overflow #5808 only breaks the per-run loop, leaving a wrapped total, so CUT still runs. The 256-glyph cap blocks the reported trigger; multi-run accumulation stayed exploitable until #5929 (CVE-2026-8558).

In the pre-fix MEASURE pass, each stretch run adds n_copies * n_repeating (both int, :565, :527, with n_copies derived from font-controlled advances at :567-577) to the 32-bit unsigned int extra_glyphs_needed with no check (src/hb-ot-shaper-arabic.cc:587), and the buffer is then grown with an equally unchecked buffer->ensure (count + extra_glyphs_needed) (:632). If that total wraps past 2^32, the buffer stays too small, but CUT still starts its write head at j = new_len = count + extra_glyphs_needed (:506-507) and decrements it once for every glyph it copies, including repeat = 1 + n_copies copies of each repeating tile (:598-601, :615). The unsigned j therefore wraps below zero and info[j] = info[k - 1]; pos[j] = pos[k - 1]; (:616-617) writes out of bounds, on the same line as the reporter’s ASan frame hb-ot-shaper-arabic.cc:616, and the assert (j == 0) at :637 runs only after the writes. Commit 7b7d54e3 replaces :587 with hb_unsigned_mul_overflows / hb_unsigned_add_overflows checks that break on overflow, and adds an overflow check on the MEASURE allocation (originally 7b7d54e33b8b^:632 buffer->ensure (count + extra_glyphs_needed)) before calling ensure. On its own, however, 7b7d54e3 does not stop the reporter’s exact input (256 runs of ~2^24 copies each, summing to 2^32): on the final run the checked add detects the wrap, but hb_unsigned_add_overflows has already stored the wrapped sum (0) into extra_glyphs_needed, and its break (708bf4a0c80b^:588-590) exits only the per-run loop at :508, not the step loop. Control then reaches the MEASURE check (708bf4a0c80b^:635-638), which computes count + 0 and so passes ensure(count) on the un-enlarged buffer, after which CUT runs anyway and --j wraps past the buffer at info[j]/pos[j]. The follow-up 708bf4a0 is what actually blocks the reporter’s input: it moves the n_copies/shortfall/excess math to int64_t and clamps n_copies to max_copies, so each run produces at most STCH_MAX_GLYPHS = 256 glyphs and no single run can inflate extra_glyphs_needed. Because the overflow break still leaves a wrapped total behind, a wrap accumulated across a very large number of capped runs stayed possible until #5929 (CVE-2026-8558), even though the 708bf4a0 commit message says the checked accumulation covers “multi-run accumulation cases”.

Key insight

The extra-glyph count comes from font-controlled widths and was added up in unchecked 32-bit arithmetic, so the allocation could come out smaller than what CUT writes. The overflow detection added by 7b7d54e3 does not by itself stop the reported trigger — its break leaves the wrapped total and ensure still passes — so it is 708bf4a0’s 256-glyph per-run cap that blocks the reporter’s input, with a residual multi-run wrap closed later by #5929.

Attack Path

Serve a crafted web font A page loads a font whose stch lookup produces fixed and repeating tiles, with advance widths chosen so that each run’s n_copies (:567-577) is very large; the reporter says the font passes OTS validation (inferred).
Render Arabic text with many stretch runs Blink shapes the text through hb_shape, hb_ot_substitute_post, postprocess_glyphs_arabic and then apply_stch (:652, per the reporter’s ASan stack, unverified).
Wrap the MEASURE total Adding up n_copies * n_repeating over the runs wraps extra_glyphs_needed (:587), so ensure (:632) asks for too little space.
Out-of-bounds write in CUT --j wraps and info[j] / pos[j] are written outside the buffer (:615-617).

Impact Assessment

A malicious web page can cause a heap out-of-bounds write of glyph records in the renderer process that is shaping the text, with no interaction beyond rendering attacker-controlled font and text (per the reporter). Anything beyond a crash, such as controlled memory corruption or code execution inside the sandbox, is not shown (inferred). The vendor rates it high severity, and the advisory does not report in-the-wild exploitation.

Files Changed

src/hb-algs.hh
src/hb-ot-shaper-arabic.cc

Audit Directions

Overflow `break` inside nested loops
When an overflow check breaks, confirm that it aborts the operation that consumes the value (here, the CUT pass) and does not just leave a wrapped value behind for later code to use.
Two-pass size-then-write algorithms
Check that the size pass and the write pass agree on the count even on error paths. Prefer a hard bound check on the write index (e.g. j > 0 before --j) over an assert that runs after the writes.
Font-metric-driven counts
Treat any loop count or allocation size derived from glyph advances or positions as attacker-controlled, and bound it before 32-bit arithmetic.

Patch

view commit

diff --git a/src/hb-algs.hh b/src/hb-algs.hh
index c580496..b28a587 100644
--- a/src/hb-algs.hh
+++ b/src/hb-algs.hh
@@ -1200,6 +1200,21 @@
   return (size > 0) && (count >= ((unsigned int) -1) / size);
 }
 
+static inline bool
+hb_unsigned_add_overflows (unsigned int a, unsigned int b, unsigned *result = nullptr)
+{
+#if hb_has_builtin(__builtin_add_overflow)
+  unsigned stack_result;
+  if (!result)
+    result = &stack_result;
+  return __builtin_add_overflow (a, b, result);
+#endif
+
+  if (result)
+    *result = a + b;
+  return b > (unsigned int) -1 - a;
+}
+
 
 /*
  * Sort and search.
diff --git a/src/hb-ot-shaper-arabic.cc b/src/hb-ot-shaper-arabic.cc
index 69320eb..44a8b63 100644
--- a/src/hb-ot-shaper-arabic.cc
+++ b/src/hb-ot-shaper-arabic.cc
@@ -584,7 +584,10 @@
 
       if (step == MEASURE)
       {
-	extra_glyphs_needed += n_copies * n_repeating;
+	unsigned int added_glyphs = 0;
+	if (unlikely (hb_unsigned_mul_overflows (n_copies, n_repeating, &added_glyphs) ||
+		      hb_unsigned_add_overflows (extra_glyphs_needed, added_glyphs, &extra_glyphs_needed)))
+	  break;
 	DEBUG_MSG (ARABIC, nullptr, "will add extra %d copies of repeating tiles", n_copies);
       }
       else
@@ -629,7 +632,9 @@
 
     if (step == MEASURE)
     {
-      if (unlikely (!buffer->ensure (count + extra_glyphs_needed)))
+      unsigned int total_glyphs = 0;
+      if (unlikely (hb_unsigned_add_overflows (count, extra_glyphs_needed, &total_glyphs) ||
+		    !buffer->ensure (total_glyphs)))
 	break;
     }
     else

Loading diff…

Original Bug Report

reported by pw...@gmail.com

Integer overflow in HarfBuzz apply_stch() causes heap OOB write via crafted font + Arabic text

Steps to reproduce the problem

Download poc.html
Download win32-release_x64_asan-win32-release_x64-1596789.zip(https://www.googleapis.com/download/storage/v1/b/chromium-browser-asan/o/win32-release_x64%2Fasan-win32-release_x64-1596789.zip)
In cmd, run chrome.exe --no-sandbox poc.html

Problem Description

Overview

HarfBuzz’s Arabic shaper function apply_stch() in third_party/harfbuzz-ng/src/src/hb-ot-shaper-arabic.cc has an integer overflow that causes a heap out-of-bounds write. The function uses a 32-bit unsigned int to accumulate the number of extra glyphs needed across all “stch” (stretching) spans. By crafting a font with specific glyph advances and supplying Arabic text with enough spans, an attacker can make this counter wrap to zero at exactly 2^32, causing the buffer to not be enlarged. The subsequent copy pass then writes past the buffer boundary.

The vulnerability has existed since HarfBuzz 1.1.0 (November 2015, commit 6e6f82b6f) and affects all Chromium versions shipping HarfBuzz with the stch feature enabled.

Root Cause

apply_stch() implements a two-pass algorithm:

MEASURE pass — iterates over all stch spans and accumulates extra glyphs needed:

unsigned int extra_glyphs_needed = 0;          // line 498: 32-bit
// per span:
extra_glyphs_needed += n_copies * n_repeating; // line 587: no overflow check

Buffer allocation — uses the (now-zero) counter:

buffer->ensure(count + extra_glyphs_needed);   // line 632: ensure(count + 0)

CUT pass — copies glyphs including n_copies duplicates per span. The write index j (unsigned int) starts at count and decrements. After count decrements it reaches 0, then wraps to 0xFFFFFFFF. The write info[0xFFFFFFFF] accesses memory out of the buffer, hitting unmapped memory and causing SIGSEGV.

Crafted Font Design

The font uses upem=16384 (power of 2) to ensure exact arithmetic with Chromium’s 16.16 fixed-point scaling (SkiaScalarToHarfBuzzPosition() in skia_text_metrics.cc):

ALEF (U+0627): advance = 16384 -> HB position = 1,048,576 (at 16px)
REPEATING tile: advance = 1 -> HB position = 64
GSUB stch feature: MultipleSubst substitutes BEH -> [FIXED, REPEATING]

Per span (BEH + 1024 ALEFs + TEH):

w_total = 1024 × 1,048,576 + 64 = 1,073,741,888 (fits int32)
n_copies = 1,073,741,888 / 64 - 1 = 16,777,216

256 spans: 256 × 16,777,216 = 4,294,967,296 = 2^32 -> wraps to 0

Attack Vector

A malicious web page can trigger this by:

Embedding a crafted font via @font-face (passes OTS validation)
Rendering Arabic text with the specific character pattern

No user interaction beyond visiting the page is required. The font passes OTS validation because the stch GSUB feature and MultipleSubst lookups are valid OpenType structures.

Summary

Integer overflow in HarfBuzz apply_stch() causes heap OOB write via crafted font + Arabic text

Custom Questions

Type of crash:

tab

Crash state:

[24344:18108:0311/102150.774:ERROR:components\device_event_log\device_event_log_impl.cc:202] [10:21:50.775] USB: usb_device_win.cc:66 Failed to open \?\usb#root_hub30#4&5375334&0&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}: Access is denied. (0x5) [24344:20808:0311/102151.566:ERROR:google_apis\gcm\engine\registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT

==25032==ERROR: AddressSanitizer: access-violation on unknown address 0x12b8fa1e17ec (pc 0x7ffc610cdc31 bp 0x00b6c8dfa660 sp 0x00b6c8dfa5d8 T0) ==25032==The signal is caused by a WRITE memory access. ==25032==*** WARNING: Failed to initialize DbgHelp! *** ==25032==*** Most likely this means that the app is already *** ==25032==*** using DbgHelp, possibly with incompatible flags. *** ==25032==*** Due to technical reasons, symbolization might crash *** ==25032==*** or produce wrong results. *** #0 0x7ffc610cdc30 (C:\WINDOWS\System32\ucrtbase.dll+0x1800edc30) #1 0x7ffbf2a0b4d2 (C:\Users\winwin\Desktop\win32-release_x64_asan-win32-release_x64-1587431\clang_rt.asan_dynamic-x86_64.dll+0x18004b4d2) #2 0x7ffb84d95e77 in apply_stch C:\b\s\w\ir\cache\builder\src\third_party\harfbuzz-ng\src\src\hb-ot-shaper-arabic.cc:616 #3 0x7ffb84d95e77 in postprocess_glyphs_arabic C:\b\s\w\ir\cache\builder\src\third_party\harfbuzz-ng\src\src\hb-ot-shaper-arabic.cc:652:3 #4 0x7ffb84de3846 in hb_ot_substitute_post C:\b\s\w\ir\cache\builder\src\third_party\harfbuzz-ng\src\src\hb-ot-shape.cc:967 #5 0x7ffb84de3846 in hb_ot_shape_internal C:\b\s\w\ir\cache\builder\src\third_party\harfbuzz-ng\src\src\hb-ot-shape.cc:1199 #6 0x7ffb84de3846 in _hb_ot_shape C:\b\s\w\ir\cache\builder\src\third_party\harfbuzz-ng\src\src\hb-ot-shape.cc:1217:3 #7 0x7ffb84ddb182 in _hb_shape_plan_execute_internal C:\b\s\w\ir\cache\builder\src\third_party\harfbuzz-ng\src\src\hb-shaper-list.hh:47 #8 0x7ffb84ddb182 in hb_shape_plan_execute C:\b\s\w\ir\cache\builder\src\third_party\harfbuzz-ng\src\src\hb-shape-plan.cc:452:14 #9 0x7ffb860c240a in hb_shape_full C:\b\s\w\ir\cache\builder\src\third_party\harfbuzz-ng\src\src\hb-shape.cc:150:19 #10 0x7ffb860c24a1 in hb_shape C:\b\s\w\ir\cache\builder\src\third_party\harfbuzz-ng\src\src\hb-shape.cc:194:3 #11 0x7ffb91e3acf4 in blink::anonymous namespace'::ShapeRange C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\fonts\shaping\harfbuzz_shaper.cc:339:3 #12 0x7ffb91e38805 in blink::HarfBuzzShaper::ShapeSegment(struct blink::RangeContext *, struct blink::RunSegmenter::RunSegmenterRange const &, class blink::ShapeResult *) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\fonts\shaping\harfbuzz_shaper.cc:1024:10 #13 0x7ffb91e3cb05 in blink::HarfBuzzShaper::Shape(class blink::Font const *, enum blink::TextDirection, unsigned int, unsigned int, struct blink::RunSegmenter::RunSegmenterRange, struct blink::ShapeOptions) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\fonts\shaping\harfbuzz_shaper.cc:1148:3 #14 0x7ffb8eaa0e91 in blink::anonymous namespace’::ReusingTextShaper::Reshape C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\inline\inline_node.cc:308 #15 0x7ffb8eaa0e91 in blink::anonymous namespace'::ReusingTextShaper::ShapeWithoutCache C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\inline\inline_node.cc:186 #16 0x7ffb8eaa0e91 in blink::anonymous namespace’::ReusingTextShaper::Shape::<lambda_1>::operator() C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\inline\inline_node.cc:169:14 #17 0x7ffb8ea84d91 in blink::NGShapeCache::GetOrCreate C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\fonts\shaping\ng_shape_cache.h:112 #18 0x7ffb8ea84d91 in blink::anonymous namespace'::ReusingTextShaper::Shape C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\inline\inline_node.cc:172 #19 0x7ffb8ea84d91 in blink::InlineNode::ShapeText(struct blink::InlineItemsData *, class blink::String const *, class blink::BasicHeapVector<1, class cppgc::internal::BasicMember<class blink::InlineItem, class cppgc::internal::StrongMemberTag, struct cppgc::internal::DijkstraWriteBarrierPolicy, class cppgc::internal::DisabledCheckingPolicy, class cppgc::internal::CompressedPointer>, 0> const *, class blink::Font const *) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\inline\inline_node.cc:1658:16 #20 0x7ffb8ea71512 in blink::InlineNode::ShapeTextIncludingFirstLine(struct blink::InlineNodeData *, class blink::String const *, class blink::BasicHeapVector<1, class cppgc::internal::BasicMember<class blink::InlineItem, class cppgc::internal::StrongMemberTag, struct cppgc::internal::DijkstraWriteBarrierPolicy, class cppgc::internal::DisabledCheckingPolicy, class cppgc::internal::CompressedPointer>, 0> const *) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\inline\inline_node.cc:1803:3 #21 0x7ffb8ea70134 in blink::InlineNode::PrepareLayout(struct blink::InlineNodeData *) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\inline\inline_node.cc:664:3 #22 0x7ffb8ea6fae5 in blink::InlineNode::PrepareLayoutIfNeeded(void) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\inline\inline_node.cc:648:3 #23 0x7ffb8ea7a476 in blink::InlineNode::EnsureData(void) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\inline\inline_node.cc:1042:3 #24 0x7ffb8ef6f0af in blink::InlineNode::IsBlockLevel C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\inline\inline_node.h:106 #25 0x7ffb8ef6f0af in blink::BlockNode::FirstChild(void) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:1156:20 #26 0x7ffb8ef70313 in blink::BlockNode::IsInlineFormattingContextRoot(class blink::InlineNode *) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:1303:35 #27 0x7ffb8ef8d7e1 in blink::BlockLayoutAlgorithm::Layout(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:599:14 #28 0x7ffb8ef768ae in blink::anonymous namespace’::LayoutWithAlgorithm::<lambda_1>::operator() C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:197 #29 0x7ffb8ef768ae in blink::anonymous namespace'::CreateAlgorithmAndRun<blink::BlockLayoutAlgorithm,lambda at ....\third_party\blink\renderer\core\layout\block_node.cc:196:28’> C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:109:3 #30 0x7ffb8ef61ddc in blink::anonymous namespace'::LayoutWithAlgorithm C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:195 #31 0x7ffb8ef61ddc in blink::BlockNode::Layout(class blink::ConstraintSpace const &, class blink::BlockBreakToken const *, class blink::EarlyBreak const *, class blink::ColumnSpannerPath const *) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:553:21 #32 0x7ffb8efa1448 in blink::anonymous namespace’::LayoutBlockChild C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:119 #33 0x7ffb8efa1448 in blink::BlockLayoutAlgorithm::LayoutNewFormattingContext(class blink::LayoutInputNode, class blink::BlockBreakToken const *, struct blink::InflowChildData const &, struct blink::BfcOffset, bool, struct blink::BfcOffset *, struct blink::BoxStrut *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:2166:41 #34 0x7ffb8ef9e7e4 in blink::BlockLayoutAlgorithm::HandleNewFormattingContext(class blink::LayoutInputNode, class blink::BlockBreakToken const *, struct blink::PreviousInflowPosition *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:1941:39 #35 0x7ffb8ef8ff56 in blink::BlockLayoutAlgorithm::Layout(class blink::InlineChildLayoutContext *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:1084:18 #36 0x7ffb8ef8d801 in blink::BlockLayoutAlgorithm::Layout(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:602:14 #37 0x7ffb8ef768ae in blink::anonymous namespace'::LayoutWithAlgorithm::<lambda_1>::operator() C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:197 #38 0x7ffb8ef768ae in blink::anonymous namespace’::CreateAlgorithmAndRun<blink::BlockLayoutAlgorithm,lambda at ..\..\third_party\blink\renderer\core\layout\block_node.cc:196:28'> C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:109:3 #39 0x7ffb8ef61ddc in blink::anonymous namespace’::LayoutWithAlgorithm C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:195 #40 0x7ffb8ef61ddc in blink::BlockNode::Layout(class blink::ConstraintSpace const &, class blink::BlockBreakToken const *, class blink::EarlyBreak const *, class blink::ColumnSpannerPath const *) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:553:21 #41 0x7ffb8efb0aae in blink::anonymous namespace'::LayoutBlockChild C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:119 #42 0x7ffb8efb0aae in blink::anonymous namespace’::LayoutInflow C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:134:10 #43 0x7ffb8efafd47 in blink::BlockLayoutAlgorithm::HandleInflow(class blink::LayoutInputNode, class blink::BreakToken const *, struct blink::PreviousInflowPosition *, class blink::InlineChildLayoutContext *, class blink::InlineBreakToken const **) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:2350:7 #44 0x7ffb8ef8ffca in blink::BlockLayoutAlgorithm::Layout(class blink::InlineChildLayoutContext *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:1089:18 #45 0x7ffb8ef8d801 in blink::BlockLayoutAlgorithm::Layout(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:602:14 #46 0x7ffb8ef768ae in blink::anonymous namespace'::LayoutWithAlgorithm::<lambda_1>::operator() C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:197 #47 0x7ffb8ef768ae in blink::anonymous namespace’::CreateAlgorithmAndRun<blink::BlockLayoutAlgorithm,lambda at ..\..\third_party\blink\renderer\core\layout\block_node.cc:196:28'> C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:109:3 #48 0x7ffb8ef61ddc in blink::anonymous namespace’::LayoutWithAlgorithm C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:195 #49 0x7ffb8ef61ddc in blink::BlockNode::Layout(class blink::ConstraintSpace const &, class blink::BlockBreakToken const *, class blink::EarlyBreak const *, class blink::ColumnSpannerPath const *) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:553:21 #50 0x7ffb8efb0aae in blink::anonymous namespace'::LayoutBlockChild C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:119 #51 0x7ffb8efb0aae in blink::anonymous namespace’::LayoutInflow C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:134:10 #52 0x7ffb8efafd47 in blink::BlockLayoutAlgorithm::HandleInflow(class blink::LayoutInputNode, class blink::BreakToken const *, struct blink::PreviousInflowPosition *, class blink::InlineChildLayoutContext *, class blink::InlineBreakToken const **) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:2350:7 #53 0x7ffb8ef8ffca in blink::BlockLayoutAlgorithm::Layout(class blink::InlineChildLayoutContext *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:1089:18 #54 0x7ffb8ef8d801 in blink::BlockLayoutAlgorithm::Layout(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:602:14 #55 0x7ffb8ef768ae in blink::anonymous namespace'::LayoutWithAlgorithm::<lambda_1>::operator() C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:197 #56 0x7ffb8ef768ae in blink::anonymous namespace’::CreateAlgorithmAndRun<blink::BlockLayoutAlgorithm,lambda at ..\..\third_party\blink\renderer\core\layout\block_node.cc:196:28'> C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:109:3 #57 0x7ffb8ef61ddc in blink::anonymous namespace’::LayoutWithAlgorithm C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:195 #58 0x7ffb8ef61ddc in blink::BlockNode::Layout(class blink::ConstraintSpace const &, class blink::BlockBreakToken const *, class blink::EarlyBreak const *, class blink::ColumnSpannerPath const *) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:553:21 #59 0x7ffb8efa1448 in blink::anonymous namespace'::LayoutBlockChild C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:119 #60 0x7ffb8efa1448 in blink::BlockLayoutAlgorithm::LayoutNewFormattingContext(class blink::LayoutInputNode, class blink::BlockBreakToken const *, struct blink::InflowChildData const &, struct blink::BfcOffset, bool, struct blink::BfcOffset *, struct blink::BoxStrut *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:2166:41 #61 0x7ffb8ef9e7e4 in blink::BlockLayoutAlgorithm::HandleNewFormattingContext(class blink::LayoutInputNode, class blink::BlockBreakToken const *, struct blink::PreviousInflowPosition *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:1941:39 #62 0x7ffb8ef8ff56 in blink::BlockLayoutAlgorithm::Layout(class blink::InlineChildLayoutContext *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:1084:18 #63 0x7ffb8ef8d801 in blink::BlockLayoutAlgorithm::Layout(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:602:14 #64 0x7ffb8ef768ae in blink::anonymous namespace’::LayoutWithAlgorithm::<lambda_1>::operator() C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:197 #65 0x7ffb8ef768ae in blink::anonymous namespace'::CreateAlgorithmAndRun<blink::BlockLayoutAlgorithm,lambda at ....\third_party\blink\renderer\core\layout\block_node.cc:196:28’> C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:109:3 #66 0x7ffb8ef61ddc in blink::anonymous namespace'::LayoutWithAlgorithm C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:195 #67 0x7ffb8ef61ddc in blink::BlockNode::Layout(class blink::ConstraintSpace const &, class blink::BlockBreakToken const *, class blink::EarlyBreak const *, class blink::ColumnSpannerPath const *) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:553:21 #68 0x7ffb8e80155b in blink::LayoutView::LayoutRoot(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\layout_view.cc:908:19 #69 0x7ffb8fdc83b1 in blink::LocalFrameView::PerformLayout(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:791:24 #70 0x7ffb8fdca936 in blink::LocalFrameView::UpdateLayout(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:848:3 #71 0x7ffb8fdea028 in blink::LocalFrameView::UpdateStyleAndLayoutInternal(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:3427:7 #72 0x7ffb8fdd43ef in blink::LocalFrameView::UpdateStyleAndLayout(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:3353:18 #73 0x7ffb927f7f7d in blink::Document::UpdateStyleAndLayout(enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\document.cc:3092:17 #74 0x7ffb9043baca in blink::FrameSelection::SetSelectionFromNone(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\editing\frame_selection.cc:1291:17 #75 0x7ffb9043b572 in blink::FrameSelection::FocusedOrActiveStateChanged(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\editing\frame_selection.cc:1065:5 #76 0x7ffb7bf0c9d2 in blink::mojom::blink::FrameWidgetStubDispatch::Accept(class blink::mojom::blink::FrameWidget *, class mojo::Message *) C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\blink\public\mojom\page\widget.mojom-blink.cc:2608:13 #77 0x7ffb82f170f4 in mojo::InterfaceEndpointClient::HandleValidatedMessage(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc:1085:54 #78 0x7ffb82f13e3d in mojo::MessageDispatcher::Accept(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\message_dispatcher.cc:44:19 #79 0x7ffb82f1d7de in mojo::InterfaceEndpointClient::HandleIncomingMessage(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc:747:20 #80 0x7ffb8694a5f6 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread C:\b\s\w\ir\cache\builder\src\ipc\ipc_mojo_bootstrap.cc:1199:24 #81 0x7ffb8694cb11 in base::internal::DecayedFunctorTraits<void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::anonymous namespace’::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::anonymous namespace'::ScopedUrgentMessageNotification &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:740 #82 0x7ffb8694cb11 in base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::anonymous namespace’::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::anonymous namespace'::ScopedUrgentMessageNotification &&>,void,0,1,2>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:932 #83 0x7ffb8694cb11 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::anonymous namespace’::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::anonymous namespace'::ScopedUrgentMessageNotification &&>,base::internal::BindState<1,1,0,void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::anonymous namespace’::ScopedUrgentMessageNotification),scoped_refptrIPC::ChannelAssociatedGroupController,mojo::Message,IPC::anonymous namespace'::ScopedUrgentMessageNotification>,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1069 #84 0x7ffb8694cb11 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::anonymous namespace’::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::anonymous namespace'::ScopedUrgentMessageNotification &&>,base::internal::BindState<1,1,0,void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::anonymous namespace’::ScopedUrgentMessageNotification),scoped_refptrIPC::ChannelAssociatedGroupController,mojo::Message,IPC::`anonymous namespace’::ScopedUrgentMessageNotification>,void ()>::RunOnce C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:982:12 #85 0x7ffb831ef9d8 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:155 #86 0x7ffb831ef9d8 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:229:34 #87 0x7ffb831bfe21 in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:112 #88 0x7ffb831bfe21 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(class base::LazyNow *) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:475:23 #89 0x7ffb831bec83 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork(void) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:346:40 #90 0x7ffb83329920 in base::MessagePumpDefault::Run(class base::MessagePump::Delegate ) C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:42:55 #91 0x7ffb831c1b6f in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, class base::TimeDelta) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:650:12 #92 0x7ffb832675fc in base::RunLoop::Run(class base::Location const &) C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:135:14 #93 0x7ffb8d7baa93 in content::RendererMain(struct content::MainFunctionParams) C:\b\s\w\ir\cache\builder\src\content\renderer\renderer_main.cc:364:16 #94 0x7ffb7edf6a16 in content::RunOtherNamedProcessTypeMain(class std::__Cr::basic_string<char, struct std::__Cr::char_traits<char>, class std::Cr::allocator<char>> const &, struct content::MainFunctionParams, class content::ContentMainDelegate *) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:762:14 #95 0x7ffb7edf917b in content::ContentMainRunnerImpl::Run(void) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1152:10 #96 0x7ffb7edecf7f in content::RunContentProcess(struct content::ContentMainParams, class content::ContentMainRunner *) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:358:36 #97 0x7ffb7eded722 in content::ContentMain(struct content::ContentMainParams) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:371:10 #98 0x7ffb6ed42b06 in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:191:12 #99 0x7ff6fcd24807 in MainDllLoader::Launch(struct HINSTANCE, class base::TimeTicks) C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:204:12 #100 0x7ff6fcd22074 in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:351:20 #101 0x7ff6fd21ce7f in invoke_main D:\a_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78 #102 0x7ff6fd21ce7f in __scrt_common_main_seh D:\a_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288 #103 0x7ffc62f6e8d6 (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e8d6) #104 0x7ffc6478c40b (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18008c40b)

==25032==Register values: rax = 12b8fa1e17ec rbx = 12b8fa1e17ec rcx = 12b8fa1e17ec rdx = 12a4fa6e53d8 rdi = 12a4fa6e53d8 rsi = 14 rbp = b6c8dfa660 rsp = b6c8dfa5d8 r8 = 14 r9 = 2571f43c2ff r10 = 7ffc60fe0000 r11 = 0 r12 = 1000000 r13 = 12a4fad053d8 r14 = ffffffff r15 = ffffffffffffffd3 AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: access-violation (C:\WINDOWS\System32\ucrtbase.dll+0x1800edc30)

==25032==ADDITIONAL INFO

==25032==Note: Please include this section with the ASan report. Task trace: #0 0x7ffb86944419 in IPC::ChannelAssociatedGroupController::Accept(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\ipc\ipc_mojo_bootstrap.cc:1138:13

Command line: "C:\Users\winwin\Desktop\win32-release_x64_asan-win32-release_x64-1587431\chrome.exe" --type=renderer --unsafely-treat-insecure-origin-as-secure=http://172.30.1.200:8888 --no-pre-read-main-dll --no-sandbox --enable-unsafe-webgpu --file-url-path-alias="/gen=C:\Users\winwin\Desktop\win32-release_x64_asan-win32-release_x64-1587431\gen" --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1772769509573503 --launch-time-ticks=422601159186 --metrics-shmem-handle=4316,i,16590150145926551397,3420061095256368019,2097152 --field-trial-handle=1848,i,9800470822139892438,6761809189957616281,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,8348267116812909868,17333413211753954901,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4036 /prefetch:1

==25032==END OF ADDITIONAL INFO

==25032==ABORTING

Reporter credit:

pwn2addr

Additional Data

Category: Security
Chrome Channel: Not sure
Regression: N/A \

View on issue tracker

Links in the report

References

Vendor advisory Fix commit Bug tracker NVD

On This Page

AI-generated — this data may be wrong

CVE-2026-4679

Overview

Background

Root Cause Analysis

Verify before building a PoC

Attack Path

Impact Assessment

Files Changed

Audit Directions

Patch

Original Bug Report

Steps to reproduce the problem

Problem Description

Overview

Root Cause

Crafted Font Design

Attack Vector

Summary

Custom Questions

Type of crash:

Crash state:

Reporter credit:

Additional Data

References