High chrome UAF 📄 Reporter bug report 🔧 Commit mapped

Overview

High

Severity

—

CVSS

Exploited ITW

Fixed

Fix Status

ImpactUse after free in Cast

DescriptionUse after free in Cast

ComponentCast

Bug ClassUAF

Tracker502449857

Fix commita1d328a102b5 (chromium/src) +58/-24

CISA KEVNot listed

CreditedKrace

Disclosed2026-04-28

Changed Functions

Function	Change	Notes
`TEST_F` chrome/browser/media/router/providers/cast/cast_activity_manager_unittest.cc	modified

Files Changed

chrome/browser/media/router/providers/cast/cast_activity_manager.cc
chrome/browser/media/router/providers/cast/cast_activity_manager.h
chrome/browser/media/router/providers/cast/cast_activity_manager_unittest.cc

Patch

view commit

From a1d328a102b58e941cab8fdcdc74749358d8084b Mon Sep 17 00:00:00 2001
From: Muyao Xu <muyaoxu@google.com>
Date: Thu, 16 Apr 2026 17:27:56 -0700
Subject: [PATCH] [MediaRouter] Fix UAF in CastActivityManager::AddMirroringActivity

When AddMirroringActivity is called on an existing route ID, it
overwrites the entry in activities_ using insert_or_assign(), destroying
the old CastActivity (which could be an AppActivity). This left the raw
pointer in app_activities_ dangling, causing a Use-After-Free if
accessed later. This CL adds app_activities_.erase() to safely clear
the raw pointer when the owning unique_ptr is replaced.

Bug: 502449857
Change-Id: Id320a57560898dd340760be9f7821512321ace56
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7766193
Reviewed-by: Jordan Bayles <jophba@chromium.org>
Commit-Queue: Muyao Xu <muyaoxu@google.com>
Cr-Commit-Position: refs/heads/main@{#1616219}
---

diff --git a/chrome/browser/media/router/providers/cast/cast_activity_manager.cc b/chrome/browser/media/router/providers/cast/cast_activity_manager.cc
index 2253726..b1fff22 100644
--- a/chrome/browser/media/router/providers/cast/cast_activity_manager.cc
+++ b/chrome/browser/media/router/providers/cast/cast_activity_manager.cc
@@ -561,6 +561,7 @@
   // Use insert_or_assign to avoid Use-After-Free on route ID collision.
   // See crbug.com/500091052.
   activities_.insert_or_assign(route.media_route_id(), std::move(activity));
+  app_activities_.erase(route.media_route_id());
   return activity_ptr;
 }
 
@@ -1183,12 +1184,6 @@
   }
 }
 
-void CastActivityManager::AddMirroringActivityForTest(
-    const MediaRoute::Id& route_id,
-    std::unique_ptr<MirroringActivity> mirroring_activity) {
-  activities_.emplace(route_id, std::move(mirroring_activity));
-}
-
 void CastActivityManager::HandleMissingSinkOnJoin(
     mojom::MediaRouteProvider::JoinRouteCallback callback,
     const std::string& sink_id,
diff --git a/chrome/browser/media/router/providers/cast/cast_activity_manager.h b/chrome/browser/media/router/providers/cast/cast_activity_manager.h
index a5c4edae..232589df 100644
--- a/chrome/browser/media/router/providers/cast/cast_activity_manager.h
+++ b/chrome/browser/media/router/providers/cast/cast_activity_manager.h
@@ -143,15 +143,17 @@
   MirroringActivity* FindMirroringActivityByRouteId(
       const std::string& route_id);
 
-  void AddMirroringActivityForTest(
-      const MediaRoute::Id& route_id,
-      std::unique_ptr<MirroringActivity> mirroring_activity);
+  using ActivityMap =
+      base::flat_map<MediaRoute::Id, std::unique_ptr<CastActivity>>;
+  using AppActivityMap = base::flat_map<MediaRoute::Id, AppActivity*>;
+
+  const ActivityMap& activities_for_testing() const { return activities_; }
+  const AppActivityMap& app_activities_for_testing() const {
+    return app_activities_;
+  }
 
  private:
   friend class CastActivityManagerTest;
-  FRIEND_TEST_ALL_PREFIXES(CastActivityManagerTest, AddAppActivityCollision);
-  FRIEND_TEST_ALL_PREFIXES(CastActivityManagerTest,
-                           AddMirroringActivityCollision);
   FRIEND_TEST_ALL_PREFIXES(CastActivityManagerWithTerminatingTest,
                            LaunchSessionTerminatesExistingSessionOnSink);
   FRIEND_TEST_ALL_PREFIXES(CastActivityManagerTest,
@@ -162,10 +164,6 @@
   FRIEND_TEST_ALL_PREFIXES(CastActivityManagerTest,
                            StartSessionAndRemoveExistingSessionOnSink);
 
-  using ActivityMap =
-      base::flat_map<MediaRoute::Id, std::unique_ptr<CastActivity>>;
-  using AppActivityMap = base::flat_map<MediaRoute::Id, AppActivity*>;
-
   void SendRouteJsonMessage(const std::string& media_route_id,
                             const std::string& message,
                             data_decoder::DataDecoder::ValueOrError result);
diff --git a/chrome/browser/media/router/providers/cast/cast_activity_manager_unittest.cc b/chrome/browser/media/router/providers/cast/cast_activity_manager_unittest.cc
index 668c134..f41a272 100644
--- a/chrome/browser/media/router/providers/cast/cast_activity_manager_unittest.cc
+++ b/chrome/browser/media/router/providers/cast/cast_activity_manager_unittest.cc
@@ -181,6 +181,20 @@
     CastActivityManager::SetActitityFactoryForTest(nullptr);
   }
 
+  AppActivity* AddAppActivity(const MediaRoute& route,
+                              const std::string& app_id) {
+    return manager_->AddAppActivity(route, app_id);
+  }
+
+  CastActivity* AddMirroringActivity(
+      const MediaRoute& route,
+      const std::string& app_id,
+      content::FrameTreeNodeId frame_tree_node_id,
+      const CastSinkExtraData& cast_data) {
+    return manager_->AddMirroringActivity(route, app_id, frame_tree_node_id,
+                                          cast_data);
+  }
+
   // from CastActivityFactoryForTest
   std::unique_ptr<AppActivity> MakeAppActivity(
       const MediaRoute& route,
@@ -992,20 +1006,21 @@
                    true);
 
   // First call to AddAppActivity should succeed.
-  AppActivity* activity1 = manager_->AddAppActivity(route, kAppId1);
+  AppActivity* activity1 = AddAppActivity(route, kAppId1);
   ASSERT_TRUE(activity1);
   EXPECT_EQ(1u, manager_->GetRoutes().size());
 
   // Second call with same route_id should overwrite the existing activity
   // instead of creating a dangling pointer.
-  AppActivity* activity2 = manager_->AddAppActivity(route, kAppId1);
+  AppActivity* activity2 = AddAppActivity(route, kAppId1);
   ASSERT_TRUE(activity2);
   EXPECT_NE(activity1, activity2);
   EXPECT_EQ(1u, manager_->GetRoutes().size());
 
   // Verify that the pointer in app_activities_ has been updated to the new
   // activity.
-  EXPECT_EQ(activity2, manager_->app_activities_[route.media_route_id()]);
+  EXPECT_EQ(activity2,
+            manager_->app_activities_for_testing().at(route.media_route_id()));
 }
 
 // Regression test for crbug.com/500091052.
@@ -1016,20 +1031,46 @@
   route.set_controller_type(RouteControllerType::kMirroring);
 
   // First call to AddMirroringActivity should succeed.
-  CastActivity* activity1 = manager_->AddMirroringActivity(
+  CastActivity* activity1 = AddMirroringActivity(
       route, cast_streaming_app_id_, kFrameTreeNodeId, sink_.cast_data());
   ASSERT_TRUE(activity1);
-  EXPECT_EQ(1u, manager_->activities_.size());
+  EXPECT_EQ(1u, manager_->activities_for_testing().size());
 
   // Second call with same route_id should overwrite the existing activity.
-  CastActivity* activity2 = manager_->AddMirroringActivity(
+  CastActivity* activity2 = AddMirroringActivity(
       route, cast_streaming_app_id_, kFrameTreeNodeId, sink_.cast_data());
   ASSERT_TRUE(activity2);
   EXPECT_NE(activity1, activity2);
-  EXPECT_EQ(1u, manager_->activities_.size());
+  EXPECT_EQ(1u, manager_->activities_for_testing().size());
 
   // Verify that activities_ map has been updated to the new activity.
-  EXPECT_EQ(activity2, manager_->activities_[route.media_route_id()].get());
+  EXPECT_EQ(
+      activity2,
+      manager_->activities_for_testing().at(route.media_route_id()).get());
+}
+
+TEST_F(CastActivityManagerTest, AddMirroringActivityOverwritesAppActivity) {
+  MediaSource source = MediaSource::ForTab(123);
+  MediaRoute route(kPresentationId, source, sink_.sink().id(), "description",
+                   true);
+  route.set_controller_type(RouteControllerType::kGeneric);
+
+  AppActivity* activity1 = AddAppActivity(route, kAppId1);
+  ASSERT_TRUE(activity1);
+  EXPECT_EQ(1u, manager_->activities_for_testing().size());
+  EXPECT_EQ(activity1,
+            manager_->app_activities_for_testing().at(route.media_route_id()));
+
+  // Adding a mirroring activity with the same route ID should overwrite the app
+  // activity and remove it from app_activities_.
+  CastActivity* activity2 = AddMirroringActivity(
+      route, cast_streaming_app_id_, kFrameTreeNodeId, sink_.cast_data());
+  ASSERT_TRUE(activity2);
+  EXPECT_NE(activity1, activity2);
+  EXPECT_EQ(1u, manager_->activities_for_testing().size());
+  EXPECT_TRUE(
+      manager_->app_activities_for_testing().find(route.media_route_id()) ==
+      manager_->app_activities_for_testing().end());
 }
 
 }  // namespace media_router

Loading diff…

Regression Test / PoC

shipped with the fix

diff --git a/chrome/browser/media/router/providers/cast/cast_activity_manager_unittest.cc b/chrome/browser/media/router/providers/cast/cast_activity_manager_unittest.cc
index 668c134..f41a272 100644
--- a/chrome/browser/media/router/providers/cast/cast_activity_manager_unittest.cc
+++ b/chrome/browser/media/router/providers/cast/cast_activity_manager_unittest.cc
@@ -181,6 +181,20 @@
     CastActivityManager::SetActitityFactoryForTest(nullptr);
   }
 
+  AppActivity* AddAppActivity(const MediaRoute& route,
+                              const std::string& app_id) {
+    return manager_->AddAppActivity(route, app_id);
+  }
+
+  CastActivity* AddMirroringActivity(
+      const MediaRoute& route,
+      const std::string& app_id,
+      content::FrameTreeNodeId frame_tree_node_id,
+      const CastSinkExtraData& cast_data) {
+    return manager_->AddMirroringActivity(route, app_id, frame_tree_node_id,
+                                          cast_data);
+  }
+
   // from CastActivityFactoryForTest
   std::unique_ptr<AppActivity> MakeAppActivity(
       const MediaRoute& route,
@@ -992,20 +1006,21 @@
                    true);
 
   // First call to AddAppActivity should succeed.
-  AppActivity* activity1 = manager_->AddAppActivity(route, kAppId1);
+  AppActivity* activity1 = AddAppActivity(route, kAppId1);
   ASSERT_TRUE(activity1);
   EXPECT_EQ(1u, manager_->GetRoutes().size());
 
   // Second call with same route_id should overwrite the existing activity
   // instead of creating a dangling pointer.
-  AppActivity* activity2 = manager_->AddAppActivity(route, kAppId1);
+  AppActivity* activity2 = AddAppActivity(route, kAppId1);
   ASSERT_TRUE(activity2);
   EXPECT_NE(activity1, activity2);
   EXPECT_EQ(1u, manager_->GetRoutes().size());
 
   // Verify that the pointer in app_activities_ has been updated to the new
   // activity.
-  EXPECT_EQ(activity2, manager_->app_activities_[route.media_route_id()]);
+  EXPECT_EQ(activity2,
+            manager_->app_activities_for_testing().at(route.media_route_id()));
 }
 
 // Regression test for crbug.com/500091052.
@@ -1016,20 +1031,46 @@
   route.set_controller_type(RouteControllerType::kMirroring);
 
   // First call to AddMirroringActivity should succeed.
-  CastActivity* activity1 = manager_->AddMirroringActivity(
+  CastActivity* activity1 = AddMirroringActivity(
       route, cast_streaming_app_id_, kFrameTreeNodeId, sink_.cast_data());
   ASSERT_TRUE(activity1);
-  EXPECT_EQ(1u, manager_->activities_.size());
+  EXPECT_EQ(1u, manager_->activities_for_testing().size());
 
   // Second call with same route_id should overwrite the existing activity.
-  CastActivity* activity2 = manager_->AddMirroringActivity(
+  CastActivity* activity2 = AddMirroringActivity(
       route, cast_streaming_app_id_, kFrameTreeNodeId, sink_.cast_data());
   ASSERT_TRUE(activity2);
   EXPECT_NE(activity1, activity2);
-  EXPECT_EQ(1u, manager_->activities_.size());
+  EXPECT_EQ(1u, manager_->activities_for_testing().size());
 
   // Verify that activities_ map has been updated to the new activity.
-  EXPECT_EQ(activity2, manager_->activities_[route.media_route_id()].get());
+  EXPECT_EQ(
+      activity2,
+      manager_->activities_for_testing().at(route.media_route_id()).get());
+}
+
+TEST_F(CastActivityManagerTest, AddMirroringActivityOverwritesAppActivity) {
+  MediaSource source = MediaSource::ForTab(123);
+  MediaRoute route(kPresentationId, source, sink_.sink().id(), "description",
+                   true);
+  route.set_controller_type(RouteControllerType::kGeneric);
+
+  AppActivity* activity1 = AddAppActivity(route, kAppId1);
+  ASSERT_TRUE(activity1);
+  EXPECT_EQ(1u, manager_->activities_for_testing().size());
+  EXPECT_EQ(activity1,
+            manager_->app_activities_for_testing().at(route.media_route_id()));
+
+  // Adding a mirroring activity with the same route ID should overwrite the app
+  // activity and remove it from app_activities_.
+  CastActivity* activity2 = AddMirroringActivity(
+      route, cast_streaming_app_id_, kFrameTreeNodeId, sink_.cast_data());
+  ASSERT_TRUE(activity2);
+  EXPECT_NE(activity1, activity2);
+  EXPECT_EQ(1u, manager_->activities_for_testing().size());
+  EXPECT_TRUE(
+      manager_->app_activities_for_testing().find(route.media_route_id()) ==
+      manager_->app_activities_for_testing().end());
 }
 
 }  // namespace media_router

Loading diff…

Original Bug Report

reported by me...@gmail.com

Security: Heap-use-after-free in CastActivityManager::FindActivityForSessionJoin

Steps to reproduce the problem

Apply change.txt to Chromium and compile with ASAN enabled.
Start the mDNS advertisement: python3 fake_cast.py
Start the fake Cast receiver: python3 fake_castd.py
Launch Chrome: ./out/asan/chrome –remote-debugging-port=9222 –user-data-dir=/tmp/noexist poc.html
In a separate terminal, run the CDP trigger: python3 cdp_trigger.py
The browser process crashes with UAF.

Problem Description

Introduction

The root cause is that AddMirroringActivity() calls activities_.insert_or_assign(route_id, unique_ptr<MirroringActivity>) which destroys any existing AppActivity stored under the same route ID via unique_ptr reset, but never erases the stale raw pointer from app_activities_. FindActivityForSessionJoin() subsequently iterates app_activities_ and dereferences entry.second->session_id() on every entry — including the now-freed AppActivity — producing a heap-use-after-free. By contrast, AddAppActivity() (the symmetric operation that goes in the other direction) was separately patched against route-ID collision via a comment referencing crbug.com/500091052, but AddMirroringActivity() was left unprotected against the cross-type collision where a mirroring session overwrites an app session.

Note: change.txt for this PoC contains two patches:

cast_activity_manager.cc: artificially forces the cross-type collision in DoLaunchSession by calling AddAppActivity then AddMirroringActivity for the same route when the source is a streaming app, then immediately calls FindActivityForSessionJoin to produce the crash. This exposes the latent bug — in production the same race can be reached via AddNonLocalActivity or a session type change on a live route.
cast_auth_util.cc: bypasses Cast device certificate verification so that the Python fake receiver (fake_castd.py) is accepted as a valid Cast sink without requiring real Chromecast hardware.

Additional Comments

Analysis

Vulnerability Summary

CastActivityManager maintains two parallel data structures [1]:

// Owns all activity objects.
base::flat_map<MediaRoute::Id, std::unique_ptr<CastActivity>> activities_;

// Subset of activities_ that are AppActivity instances; raw pointers only.
std::map<MediaRoute::Id, AppActivity*> app_activities_;

AddAppActivity() [2] registers an entry in both maps:

AppActivity* CastActivityManager::AddAppActivity(const MediaRoute& route,
                                                 const std::string& app_id) {
  auto activity = std::make_unique<AppActivity>(route, app_id, ...);
  auto* const activity_ptr = activity.get();
  activities_.insert_or_assign(route.media_route_id(), std::move(activity));
  app_activities_[route.media_route_id()] = activity_ptr;  // [A] raw ptr stored
  return activity_ptr;
}

AddMirroringActivity() [3] replaces the entry in activities_ but never touches app_activities_:

CastActivity* CastActivityManager::AddMirroringActivity(...) {
  auto activity = std::make_unique<MirroringActivity>(route, app_id, ...);
  activities_.insert_or_assign(route.media_route_id(), std::move(activity));
  // [B] insert_or_assign destroys the old unique_ptr<AppActivity> → FREE
  // [C] app_activities_[route_id] is NEVER erased → dangling raw pointer
  return activity_ptr;
}

FindActivityForSessionJoin() [4] iterates app_activities_ and dereferences every entry:

AppActivity* CastActivityManager::FindActivityForSessionJoin(
    const CastMediaSource& cast_source,
    const std::string& presentation_id) {
  ...
  auto it = std::ranges::find(
      app_activities_, session_id,
      [](const auto& entry) { return entry.second->session_id(); }); // [D] UAF: reads freed AppActivity
  ...
}

If AddMirroringActivity is called for a route that already has an AppActivity registered via AddAppActivity, the sequence [A] → [B] → [C] → [D] produces a heap-use-after-free at step [D].

Production Reachability via AddNonLocalActivity

The PoC patch forces the collision synchronously inside DoLaunchSession, but the same condition is reachable in unmodified Chrome via AddNonLocalActivity() [5], which is invoked from OnSessionAddedOrUpdated() whenever the Cast receiver reports a session update over the Cast channel.

The route ID is a deterministic string derived from presentation_id, sink_id, and source_id. Consider the following sequence on an unpatched build:

A tab-streaming session is initiated locally. DoLaunchSession dispatches ContainsStreamingApp() == false for the initial source type and calls AddAppActivity(route, app_id), storing the AppActivity* in both activities_ and app_activities_.
The receiver transitions the session to a mirroring type (e.g. the app on the receiver side switches its session type), and sends a session-updated message. Chrome’s OnSessionAddedOrUpdated [5] receives this, classifies the updated session as a mirroring session, and calls AddMirroringActivity for the same route ID.
AddMirroringActivity calls activities_.insert_or_assign(route_id, std::move(mirroring_activity)), which destroys the old unique_ptr<AppActivity> and frees the AppActivity object. The entry in app_activities_ is not erased — it now holds a dangling pointer to freed memory.
Any subsequent call to FindActivityForSessionJoin — triggered when a second Cast source attempts to join an existing session by presentation ID — iterates app_activities_ and dereferences entry.second->session_id() on the freed object, producing the heap-use-after-free.

The cross-type transition in step 2 is a normal part of the Cast session lifecycle and does not require attacker control beyond the ability to influence the session type reported by the receiver (e.g. via a rogue Cast device on the local network, since Cast sink discovery is unauthenticated at the mDNS level).

References

[1] https://source.chromium.org/chromium/chromium/src/+/main:chrome/browser/media/router/providers/cast/cast_activity_manager.h

[2] https://source.chromium.org/chromium/chromium/src/+/main:chrome/browser/media/router/providers/cast/cast_activity_manager.cc;l=534

[3] https://source.chromium.org/chromium/chromium/src/+/main:chrome/browser/media/router/providers/cast/cast_activity_manager.cc;l=550

[4] https://source.chromium.org/chromium/chromium/src/+/main:chrome/browser/media/router/providers/cast/cast_activity_manager.cc;l=272

[5] https://source.chromium.org/chromium/chromium/src/+/main:chrome/browser/media/router/providers/cast/cast_activity_manager.cc;l=789

Summary

Security: Heap-use-after-free in CastActivityManager::FindActivityForSessionJoin

Custom Questions

Type of crash:

browser

Crash state:

================================================================= ==261776==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c85a4c80ce0 at pc 0x558e10f07224 bp 0x7b25912464f0 sp 0x7b25912464e8 READ of size 1 at 0x7c85a4c80ce0 thread T12 (Chrome_IOThread) #0 0x558e10f07223 in media_router::CastActivityManager::FindActivityForSessionJoin(media_router::CastMediaSource const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&) gen/third_party/libc++/src/include/optional:447:96 #1 0x558e10f04c0f in media_router::CastActivityManager::DoLaunchSession(media_router::CastActivityManager::DoLaunchSessionParams) chrome/browser/media/router/providers/cast/cast_activity_manager.cc:240:5 #2 0x558e10f041c4 in media_router::CastActivityManager::LaunchSessionParsed(media_router::CastMediaSource const&, media_router::MediaSinkInternal const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, url::Origin const&, base::IdType<content::FrameTreeNodeIdTag, int, -1, 1, 0>, base::OnceCallback<void (std::__Cr::optional<media_router::MediaRoute> const&, mojo::StructPtr<media_router::mojom::RoutePresentationConnection>, std::__Cr::optional<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>> const&, media_router::mojom::RouteRequestResultCode)>, base::expected<base::Value, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>>) chrome/browser/media/router/providers/cast/cast_activity_manager.cc:208:3 #3 0x558e10f0311a in media_router::CastActivityManager::LaunchSession(media_router::CastMediaSource const&, media_router::MediaSinkInternal const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, url::Origin const&, base::IdType<content::FrameTreeNodeIdTag, int, -1, 1, 0>, base::OnceCallback<void (std::__Cr::optional<media_router::MediaRoute> const&, mojo::StructPtr<media_router::mojom::RoutePresentationConnection>, std::__Cr::optional<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>> const&, media_router::mojom::RouteRequestResultCode)>) chrome/browser/media/router/providers/cast/cast_activity_manager.cc:138:5 #4 0x558e10efa0df in media_router::CastMediaRouteProvider::CreateRoute(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, url::Origin const&, int, base::TimeDelta, base::OnceCallback<void (std::__Cr::optional<media_router::MediaRoute> const&, mojo::StructPtr<media_router::mojom::RoutePresentationConnection>, std::__Cr::optional<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>> const&, media_router::mojom::RouteRequestResultCode)>) chrome/browser/media/router/providers/cast/cast_media_route_provider.cc:215:22 #5 0x558e08910317 in media_router::mojom::MediaRouteProviderStubDispatch::AcceptWithResponder(media_router::mojom::MediaRouteProvider*, mojo::Message*, std::__Cr::unique_ptr<mojo::MessageReceiverWithStatus, std::__Cr::default_deletemojo::MessageReceiverWithStatus>) gen/components/media_router/common/mojom/media_router.mojom.cc:3005:13 #6 0x7f2628eb1fee in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1036:56 #7 0x7f2628ec93eb in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #8 0x7f2628eb78f4 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20 #9 0x7f2628ed89ce in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1204:42 #10 0x7f2628ed71fd in mojo::internal::MultiplexRouter::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/multiplex_router.cc:790:7 #11 0x7f2628ec93eb in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #12 0x7f2628e9dc8f in mojo::Connector::DispatchMessage(mojo::ScopedHandleBasemojo::MessageHandle) mojo/public/cpp/bindings/lib/connector.cc:567:49 #13 0x7f2628e9f4de in mojo::Connector::ReadAllAvailableMessages() mojo/public/cpp/bindings/lib/connector.cc:628:14 #14 0x7f2628e9ef77 in mojo::Connector::OnWatcherHandleReady(char const*, unsigned int) mojo/public/cpp/bindings/lib/connector.cc:453:3 #15 0x7f2628ea1b51 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::Connector::* const&)(char const*, unsigned int), mojo::Connector*, char const* const&>, base::internal::BindState<true, true, false, void (mojo::Connector::)(char const, unsigned int), base::internal::UnretainedWrapper<mojo::Connector, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<char const, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int) base/functional/bind_internal.h:740:12 #16 0x7f2628ea11fe in base::RepeatingCallback<void (unsigned int)>::Run(unsigned int) const & base/functional/callback.h:346:12 #17 0x7f2628ea0fb4 in base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&>, base::internal::BindState<false, true, false, void ()(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)>>, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase, unsigned int, mojo::HandleSignalsState const&) base/functional/bind_internal.h:673:12 #18 0x7f262710c450 in base::RepeatingCallback<void (unsigned int, mojo::HandleSignalsState const&)>::Run(unsigned int, mojo::HandleSignalsState const&) const & base/functional/callback.h:346:12 #19 0x7f262710be2b in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) mojo/public/cpp/system/simple_watcher.cc:286:14 #20 0x7f262710ce94 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::SimpleWatcher::&&)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtrmojo::SimpleWatcher&&, int&&, unsigned int&&, mojo::HandleSignalsState&&>, base::internal::BindState<true, true, false, void (mojo::SimpleWatcher::)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtrmojo::SimpleWatcher, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #21 0x7f2628714209 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #22 0x7f262878e750 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #23 0x7f262878d726 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #24 0x7f262893e6c1 in base::MessagePumpEpoll::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_epoll.cc:224:55 #25 0x7f262878fda3 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12 #26 0x7f262867f652 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #27 0x7f2628827ca2 in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:356:13 #28 0x7f260a29fe3f in content::BrowserProcessIOThread::IOThreadRun(base::RunLoop*) content/browser/browser_process_io_thread.cc:104:11 #29 0x7f2628828205 in base::Thread::ThreadMain() base/threading/thread.cc:426:3 #30 0x7f262888cfdc in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13 #31 0x558e04792486 in asan_thread_start(void*) asan_interceptors.cpp

0x7c85a4c80ce0 is located 352 bytes inside of 640-byte region [0x7c85a4c80b80,0x7c85a4c80e00) freed by thread T12 (Chrome_IOThread) here: #0 0x558e047ce842 in operator delete(void*, unsigned long) (/home/krace/fuzz/chromium/src/out/ui/chrome+0x67e9842) (BuildId: 2d2b77c81d15022a) #1 0x558e10f1070c in std::__Cr::pair<std::__Cr::__wrap_iter<std::__Cr::pair<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, std::__Cr::unique_ptr<media_router::CastActivity, std::__Cr::default_delete<media_router::CastActivity>>>>, bool> base::flat_map<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, std::__Cr::unique_ptr<media_router::CastActivity, std::__Cr::default_delete<media_router::CastActivity>>, std::__Cr::less<void>, std::__Cr::vector<std::__Cr::pair<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, std::__Cr::unique_ptr<media_router::CastActivity, std::__Cr::default_delete<media_router::CastActivity>>>, std::__Cr::allocator<std::__Cr::pair<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, std::__Cr::unique_ptr<media_router::CastActivity, std::__Cr::default_delete<media_router::CastActivity>>>>>>::insert_or_assign<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, std::__Cr::unique_ptr<media_router::MirroringActivity, std::__Cr::default_delete<media_router::MirroringActivity>>>(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, std::__Cr::unique_ptr<media_router::MirroringActivity, std::__Cr::default_delete<media_router::MirroringActivity>>&&) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #2 0x558e10f06d2f in media_router::CastActivityManager::AddMirroringActivity(media_router::MediaRoute const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, base::IdType<content::FrameTreeNodeIdTag, int, -1, 1, 0>, media_router::CastSinkExtraData const&) chrome/browser/media/router/providers/cast/cast_activity_manager.cc:576:15 #3 0x558e10f04b61 in media_router::CastActivityManager::DoLaunchSession(media_router::CastActivityManager::DoLaunchSessionParams) chrome/browser/media/router/providers/cast/cast_activity_manager.cc:232:9 #4 0x558e10f041c4 in media_router::CastActivityManager::LaunchSessionParsed(media_router::CastMediaSource const&, media_router::MediaSinkInternal const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, url::Origin const&, base::IdType<content::FrameTreeNodeIdTag, int, -1, 1, 0>, base::OnceCallback<void (std::__Cr::optional<media_router::MediaRoute> const&, mojo::StructPtr<media_router::mojom::RoutePresentationConnection>, std::__Cr::optional<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>> const&, media_router::mojom::RouteRequestResultCode)>, base::expected<base::Value, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>>) chrome/browser/media/router/providers/cast/cast_activity_manager.cc:208:3 #5 0x558e10f0311a in media_router::CastActivityManager::LaunchSession(media_router::CastMediaSource const&, media_router::MediaSinkInternal const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, url::Origin const&, base::IdType<content::FrameTreeNodeIdTag, int, -1, 1, 0>, base::OnceCallback<void (std::__Cr::optional<media_router::MediaRoute> const&, mojo::StructPtr<media_router::mojom::RoutePresentationConnection>, std::__Cr::optional<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>> const&, media_router::mojom::RouteRequestResultCode)>) chrome/browser/media/router/providers/cast/cast_activity_manager.cc:138:5 #6 0x558e10efa0df in media_router::CastMediaRouteProvider::CreateRoute(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, url::Origin const&, int, base::TimeDelta, base::OnceCallback<void (std::__Cr::optional<media_router::MediaRoute> const&, mojo::StructPtr<media_router::mojom::RoutePresentationConnection>, std::__Cr::optional<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>> const&, media_router::mojom::RouteRequestResultCode)>) chrome/browser/media/router/providers/cast/cast_media_route_provider.cc:215:22 #7 0x558e08910317 in media_router::mojom::MediaRouteProviderStubDispatch::AcceptWithResponder(media_router::mojom::MediaRouteProvider, mojo::Message*, std::__Cr::unique_ptr<mojo::MessageReceiverWithStatus, std::__Cr::default_deletemojo::MessageReceiverWithStatus>) gen/components/media_router/common/mojom/media_router.mojom.cc:3005:13 #8 0x7f2628eb1fee in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1036:56 #9 0x7f2628ec93eb in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #10 0x7f2628eb78f4 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20 #11 0x7f2628ed89ce in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1204:42 #12 0x7f2628ed71fd in mojo::internal::MultiplexRouter::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/multiplex_router.cc:790:7 #13 0x7f2628ec93eb in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #14 0x7f2628e9dc8f in mojo::Connector::DispatchMessage(mojo::ScopedHandleBasemojo::MessageHandle) mojo/public/cpp/bindings/lib/connector.cc:567:49 #15 0x7f2628e9f4de in mojo::Connector::ReadAllAvailableMessages() mojo/public/cpp/bindings/lib/connector.cc:628:14 #16 0x7f2628e9ef77 in mojo::Connector::OnWatcherHandleReady(char const*, unsigned int) mojo/public/cpp/bindings/lib/connector.cc:453:3 #17 0x7f2628ea1b51 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::Connector::* const&)(char const*, unsigned int), mojo::Connector*, char const* const&>, base::internal::BindState<true, true, false, void (mojo::Connector::)(char const, unsigned int), base::internal::UnretainedWrapper<mojo::Connector, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<char const, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int) base/functional/bind_internal.h:740:12 #18 0x7f2628ea11fe in base::RepeatingCallback<void (unsigned int)>::Run(unsigned int) const & base/functional/callback.h:346:12 #19 0x7f2628ea0fb4 in base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&>, base::internal::BindState<false, true, false, void ()(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)>>, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase, unsigned int, mojo::HandleSignalsState const&) base/functional/bind_internal.h:673:12 #20 0x7f262710c450 in base::RepeatingCallback<void (unsigned int, mojo::HandleSignalsState const&)>::Run(unsigned int, mojo::HandleSignalsState const&) const & base/functional/callback.h:346:12 #21 0x7f262710be2b in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) mojo/public/cpp/system/simple_watcher.cc:286:14 #22 0x7f262710ce94 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::SimpleWatcher::&&)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtrmojo::SimpleWatcher&&, int&&, unsigned int&&, mojo::HandleSignalsState&&>, base::internal::BindState<true, true, false, void (mojo::SimpleWatcher::)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtrmojo::SimpleWatcher, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #23 0x7f2628714209 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #24 0x7f262878e750 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #25 0x7f262878d726 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #26 0x7f262893e6c1 in base::MessagePumpEpoll::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_epoll.cc:224:55 #27 0x7f262878fda3 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12 #28 0x7f262867f652 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #29 0x7f2628827ca2 in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:356:13

previously allocated by thread T12 (Chrome_IOThread) here: #0 0x558e047cdc3d in operator new(unsigned long) (/home/krace/fuzz/chromium/src/out/ui/chrome+0x67e8c3d) (BuildId: 2d2b77c81d15022a) #1 0x558e10f060e5 in media_router::CastActivityManager::AddAppActivity(media_router::MediaRoute const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26 #2 0x558e10f04b27 in media_router::CastActivityManager::DoLaunchSession(media_router::CastActivityManager::DoLaunchSessionParams) chrome/browser/media/router/providers/cast/cast_activity_manager.cc:229:5 #3 0x558e10f041c4 in media_router::CastActivityManager::LaunchSessionParsed(media_router::CastMediaSource const&, media_router::MediaSinkInternal const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, url::Origin const&, base::IdType<content::FrameTreeNodeIdTag, int, -1, 1, 0>, base::OnceCallback<void (std::__Cr::optional<media_router::MediaRoute> const&, mojo::StructPtr<media_router::mojom::RoutePresentationConnection>, std::__Cr::optional<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>> const&, media_router::mojom::RouteRequestResultCode)>, base::expected<base::Value, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>>) chrome/browser/media/router/providers/cast/cast_activity_manager.cc:208:3 #4 0x558e10f0311a in media_router::CastActivityManager::LaunchSession(media_router::CastMediaSource const&, media_router::MediaSinkInternal const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, url::Origin const&, base::IdType<content::FrameTreeNodeIdTag, int, -1, 1, 0>, base::OnceCallback<void (std::__Cr::optional<media_router::MediaRoute> const&, mojo::StructPtr<media_router::mojom::RoutePresentationConnection>, std::__Cr::optional<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>> const&, media_router::mojom::RouteRequestResultCode)>) chrome/browser/media/router/providers/cast/cast_activity_manager.cc:138:5 #5 0x558e10efa0df in media_router::CastMediaRouteProvider::CreateRoute(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, url::Origin const&, int, base::TimeDelta, base::OnceCallback<void (std::__Cr::optional<media_router::MediaRoute> const&, mojo::StructPtr<media_router::mojom::RoutePresentationConnection>, std::__Cr::optional<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>> const&, media_router::mojom::RouteRequestResultCode)>) chrome/browser/media/router/providers/cast/cast_media_route_provider.cc:215:22 #6 0x558e08910317 in media_router::mojom::MediaRouteProviderStubDispatch::AcceptWithResponder(media_router::mojom::MediaRouteProvider*, mojo::Message*, std::__Cr::unique_ptr<mojo::MessageReceiverWithStatus, std::__Cr::default_deletemojo::MessageReceiverWithStatus>) gen/components/media_router/common/mojom/media_router.mojom.cc:3005:13 #7 0x7f2628eb1fee in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1036:56 #8 0x7f2628ec93eb in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #9 0x7f2628eb78f4 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20 #10 0x7f2628ed89ce in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1204:42 #11 0x7f2628ed71fd in mojo::internal::MultiplexRouter::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/multiplex_router.cc:790:7 #12 0x7f2628ec93eb in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #13 0x7f2628e9dc8f in mojo::Connector::DispatchMessage(mojo::ScopedHandleBasemojo::MessageHandle) mojo/public/cpp/bindings/lib/connector.cc:567:49 #14 0x7f2628e9f4de in mojo::Connector::ReadAllAvailableMessages() mojo/public/cpp/bindings/lib/connector.cc:628:14 #15 0x7f2628e9ef77 in mojo::Connector::OnWatcherHandleReady(char const*, unsigned int) mojo/public/cpp/bindings/lib/connector.cc:453:3 #16 0x7f2628ea1b51 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::Connector::* const&)(char const*, unsigned int), mojo::Connector*, char const* const&>, base::internal::BindState<true, true, false, void (mojo::Connector::)(char const, unsigned int), base::internal::UnretainedWrapper<mojo::Connector, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<char const, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int) base/functional/bind_internal.h:740:12 #17 0x7f2628ea11fe in base::RepeatingCallback<void (unsigned int)>::Run(unsigned int) const & base/functional/callback.h:346:12 #18 0x7f2628ea0fb4 in base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&>, base::internal::BindState<false, true, false, void ()(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)>>, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase, unsigned int, mojo::HandleSignalsState const&) base/functional/bind_internal.h:673:12 #19 0x7f262710c450 in base::RepeatingCallback<void (unsigned int, mojo::HandleSignalsState const&)>::Run(unsigned int, mojo::HandleSignalsState const&) const & base/functional/callback.h:346:12 #20 0x7f262710be2b in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) mojo/public/cpp/system/simple_watcher.cc:286:14 #21 0x7f262710ce94 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::SimpleWatcher::&&)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtrmojo::SimpleWatcher&&, int&&, unsigned int&&, mojo::HandleSignalsState&&>, base::internal::BindState<true, true, false, void (mojo::SimpleWatcher::)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtrmojo::SimpleWatcher, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #22 0x7f2628714209 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #23 0x7f262878e750 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #24 0x7f262878d726 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #25 0x7f262893e6c1 in base::MessagePumpEpoll::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_epoll.cc:224:55 #26 0x7f262878fda3 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12 #27 0x7f262867f652 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #28 0x7f2628827ca2 in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:356:13 #29 0x7f260a29fe3f in content::BrowserProcessIOThread::IOThreadRun(base::RunLoop*) content/browser/browser_process_io_thread.cc:104:11

Thread T12 (Chrome_IOThread) created by T0 (chrome) here: #0 0x558e047782b1 in pthread_create (/home/krace/fuzz/chromium/src/out/ui/chrome+0x67932b1) (BuildId: 2d2b77c81d15022a) #1 0x7f262888c69c in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13 #2 0x7f262882652b in base::Thread::StartWithOptions(base::Thread::Options) base/threading/thread.cc:232:26 #3 0x7f260baa1340 in content::BrowserTaskExecutor::CreateIOThread() content/browser/scheduler/browser_task_executor.cc:304:19 #4 0x7f260d739653 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1282:42 #5 0x7f260d7383d6 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1150:12 #6 0x7f260d732af3 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36 #7 0x7f260d732e7a in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10 #8 0x558e047cfb95 in ChromeMain chrome/app/chrome_main.cc:194:12 #9 0x7f25b429f082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-use-after-free gen/third_party/libc++/src/include/optional:447:96 in media_router::CastActivityManager::FindActivityForSessionJoin(media_router::CastMediaSource const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&) Shadow bytes around the buggy address: 0x7c85a4c80a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7c85a4c80a80: 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa fa 0x7c85a4c80b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa 0x7c85a4c80b80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c85a4c80c00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x7c85a4c80c80: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd 0x7c85a4c80d00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c85a4c80d80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c85a4c80e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa 0x7c85a4c80e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7c85a4c80f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb

==261776==ADDITIONAL INFO

==261776==Note: Please include this section with the ASan report. Task trace: #0 0x7f262710c84a in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) mojo/public/cpp/system/simple_watcher.cc:103:13 #1 0x7f260a524687 in content::ServerWrapper::OnWebSocketMessage(int, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>) content/browser/devtools/devtools_http_handler.cc:531:7

Command line: ./out/ui/chrome --remote-debugging-port=9222 --flag-switches-begin --enable-experimental-web-platform-features --flag-switches-end --ozone-platform=x11 tmp/finding10.html

MiraclePtr Status: NOT PROTECTED No raw_ptr<T> access to this region was detected prior to this crash. This crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==261776==END OF ADDITIONAL INFO

==261776==ABORTING

Reporter credit:

Krace

Additional Data

Category: Security
Chrome Channel: Not sure
Regression: N/A \

View on issue tracker

Links in the report

References

Vendor advisory Fix commit Bug tracker NVD

On This Page

CVE-2026-7338

Overview

Changed Functions

Files Changed

Patch

Regression Test / PoC

Original Bug Report

Steps to reproduce the problem

Problem Description

Introduction

Additional Comments

Analysis

Vulnerability Summary

Production Reachability via AddNonLocalActivity

References

Summary

Custom Questions

Type of crash:

Crash state:

Reporter credit:

Additional Data

References