PatchGap
Chrome · Parser

CVE-2026-79073

Input Validation in Parser
Medium watch CVSS 8.8 chrome Input Validation 🔧 Commit mapped

Overview

Medium
Severity
8.8
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactImproper state validation in Parser
DescriptionImproper state validation in Parser
ComponentParser
Bug ClassInput Validation
Action tierwatch — dos-class only — no demonstrated corruption path
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.
Tracker536662911
Fix commit5d50303b9695 (chromium/src) +131/-1
CWECWE-754
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA KEVNot listed
CreditedGoogle
Reported2026-07-20 (per vendor advisory)
Fix landed2026-07-20 (public git)
Disclosed2026-08-25
Patch gap36 days — fix public in source before the advisory

Background

Adoption agency algorithm (AAA)
the HTML tree-builder step that handles misnested formatting elements such as <b>…<p>…</b> by cloning formatting elements and moving already-parsed nodes (the “furthest block” and its relatives) to new parents.
`kInsertAlreadyParsedChild` task
an HTMLConstructionSiteTask operation that HTMLConstructionSite queues to re-parent a node already in the DOM. AAA uses it through HTMLConstructionSite::InsertAlreadyParsedChild.
Foster parenting
when the target parent is a table-related element (CausesFosterParenting()), the node is inserted at a “foster site” found by FindFosterSite (normally just before the <table>), which may be a different parent entirely.
Script-driven DOM drift
inline <script> blocks run during parsing and can move nodes still on the parser’s stack of open elements, so the DOM no longer matches the tree builder’s view: for example, an ancestor becomes a descendant, a node moves into a template or shadow root, or a <table> moves into another Document.

Root Cause Analysis

The tree builder’s AAA trusts its stack of open elements when choosing a new parent for an already-parsed node. Script that runs mid-parse can change the real DOM relationships first. In the regression tests, script appends the “furthest block” fb to body and then appends the “common ancestor” ca into fb, either directly, through a shadow root, or through template.content. AAA then asks to insert fb under ca, but ca is now inside fb, so the move would create a cycle. In the document-target test, the <table> is moved into a Document that has no root element, so the foster site’s parent is a Document.

Before the fix, the executor for kInsertAlreadyParsedChild tasks called Insert(task) without checking either case. In addition, InsertAlreadyParsedChild foster-parented through the generic FosterParent path instead of an already-parsed-child task.

The fix adds two checks before Insert(task). If the parent is a Document that already has a documentElement(), the node is dropped. If task.child->ContainsIncludingHostElements(*task.parent) is true, which also covers cycles through shadow hosts and template hosts, the node is dropped. “Dropped” means it is removed from its current parent with ParserRemoveChild and not reinserted.

The fix also adds FosterParentAlreadyParsedChild, which queues a kInsertAlreadyParsedChild task, so foster-parented AAA moves now pass through these checks too.

Key insight
The AAA re-parenting path assumed that the parser’s stack still matches the DOM. It inserted nodes without checking whether the move would create an ancestor cycle or give a Document a second element child. The fix checks both cases at the point of insertion, drops nodes that cannot be reinserted legally (following whatwg/html PR #12709), and sends foster-parented AAA moves through the same check.

Attack Path

  1. Misnested markup a page serves HTML whose misnested formatting element triggers AAA, such as <div id=ca><b><p id=fb>…</b></div>. Ordinary web content can do this with no flags.
  2. Mid-parse DOM rearrangement an inline <script>, run while those elements are still open, moves nodes so that the AAA “common ancestor” becomes a descendant of the “furthest block” (directly, via a shadow root, or via template.content), or moves a <table> into a separate Document with no root element.
  3. AAA queues an illegal move when the closing tag (</b>) runs AAA, InsertAlreadyParsedChild queues a re-parent of fb under ca, or under the foster site’s Document. Before the fix, nothing checked whether that move was legal.
  4. Inconsistent tree Insert(task) would create a node cycle or an invalid Document child list. The tests show this ends in a crash; any memory-corruption consequence beyond that, such as use-after-free while walking a cyclic tree, is (inferred).

Impact Assessment

A web page with inline script can drive the renderer’s HTML parser into building a structurally invalid DOM: a cycle, or a Document with an extra element child. At minimum this crashes the renderer process, as the regression tests show. The vendor advisory rates this medium severity and does not report in-the-wild exploitation; NVD scores it CVSS 8.8. Any exploitable memory corruption that follows from the invalid tree is (inferred), and the impact stays inside the sandboxed renderer. The only requirements are loading attacker-controlled HTML with script enabled; no user gesture, flag or compromised renderer is needed.

Changed Functions

FunctionChangeNotes
if
third_party/blink/web_tests/fast/parser/adoption-agency-cycle-crash.html
 modified
if
third_party/blink/web_tests/fast/parser/adoption-agency-document-target-crash.html
 modified
if
third_party/blink/web_tests/fast/parser/adoption-agency-inner-loop-cycle-crash.html
 modified
if
third_party/blink/web_tests/fast/parser/adoption-agency-shadow-cycle-crash.html
 modified
if
third_party/blink/web_tests/fast/parser/adoption-agency-template-cycle-crash.html
 modified

Files Changed

  • third_party/blink/web_tests/fast/parser/adoption-agency-cycle-crash.html
  • third_party/blink/web_tests/fast/parser/adoption-agency-template-cycle-crash.html
  • third_party/blink/web_tests/fast/parser/adoption-agency-template-cycle-crash-expected.txt
  • third_party/blink/renderer/core/html/parser/html_construction_site.cc
  • third_party/blink/renderer/core/html/parser/html_construction_site.h
  • third_party/blink/web_tests/fast/parser/adoption-agency-cycle-crash-expected.txt
  • third_party/blink/web_tests/fast/parser/adoption-agency-document-target-crash.html
  • third_party/blink/web_tests/fast/parser/adoption-agency-inner-loop-cycle-crash-expected.txt
  • third_party/blink/web_tests/fast/parser/adoption-agency-document-target-crash-expected.txt
  • third_party/blink/web_tests/fast/parser/adoption-agency-shadow-cycle-crash-expected.txt
  • third_party/blink/web_tests/fast/parser/adoption-agency-inner-loop-cycle-crash.html
  • third_party/blink/web_tests/fast/parser/adoption-agency-shadow-cycle-crash.html

Audit Directions

  • Parser fast paths that skip DOM pre-insertion validity checks
    review every Parser* insert/append routine and queued HTMLConstructionSite task for missing hierarchy checks (cycles, Document child constraints, template/shadow boundaries) when script can run between queuing and execution.
  • Tree-builder state vs. live DOM
    look for other algorithms that rely on the stack of open elements or the list of active formatting elements (AAA inner loop, foster parenting, </p>/</body> recovery, template handling) and may act on nodes that script has since moved.
  • Host-crossing containment
    when checking ancestry, make sure checks use host-aware helpers such as ContainsIncludingHostElements. Plain contains() misses cycles that pass through shadow roots or template.content.

Patch

view commit
From 5d50303b9695b52ec773f27a6ecb3c2ca464f532 Mon Sep 17 00:00:00 2001
From: Noam Rosenthal <nrosenthal@chromium.org>
Date: Mon, 20 Jul 2026 15:36:21 -0700
Subject: [PATCH] HTML parser: Drop a node the adoption agency cannot reinsert

Make a few check when moving around nodes with AAA.

The tests are internal temporarily until the upstream WPT and spec PR
land, but that process shouldn't delay fixing the crash.

See https://github.com/whatwg/html/pull/12709

Bug: 536662911
Change-Id: Ia357a2efea8029129b68b7fe647de4d7ba450b42
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8124514
Commit-Queue: Noam Rosenthal <nrosenthal@google.com>
Reviewed-by: David Baron <dbaron@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1664983}
---
diff --git a/third_party/blink/renderer/core/html/parser/html_construction_site.cc b/third_party/blink/renderer/core/html/parser/html_construction_site.cc
index 94ed802..8448e69 100644
--- a/third_party/blink/renderer/core/html/parser/html_construction_site.cc
+++ b/third_party/blink/renderer/core/html/parser/html_construction_site.cc
@@ -293,6 +293,21 @@
   DCHECK_EQ(task.operation,
             HTMLConstructionSiteTask::kInsertAlreadyParsedChild);
 
+  // See https://github.com/whatwg/html/pull/12709
+  if (Document* parentDoc = DynamicTo<Document>(task.parent.Get())) {
+    if (parentDoc->documentElement()) {
+      if (task.child->parentNode()) {
+        task.child->parentNode()->ParserRemoveChild(*task.child);
+      }
+      return;
+    }
+  } else if (task.child->ContainsIncludingHostElements(*task.parent)) {
+    if (task.child->parentNode()) {
+      task.child->parentNode()->ParserRemoveChild(*task.child);
+    }
+    return;
+  }
+
   Insert(task);
 }
 
@@ -1224,7 +1239,7 @@
 void HTMLConstructionSite::InsertAlreadyParsedChild(HTMLStackItem* new_parent,
                                                     HTMLStackItem* child) {
   if (new_parent->CausesFosterParenting()) {
-    FosterParent(child->GetNode());
+    FosterParentAlreadyParsedChild(child->GetNode());
     return;
   }
 
@@ -1613,6 +1628,15 @@
   QueueTask(task, true);
 }
 
+void HTMLConstructionSite::FosterParentAlreadyParsedChild(Node* child) {
+  HTMLConstructionSiteTask task(
+      HTMLConstructionSiteTask::kInsertAlreadyParsedChild);
+  FindFosterSite(task);
+  task.child = child;
+  DCHECK(task.parent);
+  QueueTask(task, true);
+}
+
 void HTMLConstructionSite::PendingText::Trace(Visitor* visitor) const {
   visitor->Trace(parent);
   visitor->Trace(next_child);
diff --git a/third_party/blink/renderer/core/html/parser/html_construction_site.h b/third_party/blink/renderer/core/html/parser/html_construction_site.h
index 987bb598..968906f 100644
--- a/third_party/blink/renderer/core/html/parser/html_construction_site.h
+++ b/third_party/blink/renderer/core/html/parser/html_construction_site.h
@@ -189,6 +189,7 @@
 
   bool ShouldFosterParent() const;
   void FosterParent(Node*);
+  void FosterParentAlreadyParsedChild(Node*);
 
   bool IndexOfFirstUnopenFormattingElement(
       unsigned& first_unopen_element_index) const;
diff --git a/third_party/blink/web_tests/fast/parser/adoption-agency-cycle-crash-expected.txt b/third_party/blink/web_tests/fast/parser/adoption-agency-cycle-crash-expected.txt
new file mode 100644
index 0000000..c2541f4
--- /dev/null
+++ b/third_party/blink/web_tests/fast/parser/adoption-agency-cycle-crash-expected.txt
@@ -0,0 +1 @@
+PASS if no crash.
diff --git a/third_party/blink/web_tests/fast/parser/adoption-agency-cycle-crash.html b/third_party/blink/web_tests/fast/parser/adoption-agency-cycle-crash.html
new file mode 100644
index 0000000..edf7f06
--- /dev/null
+++ b/third_party/blink/web_tests/fast/parser/adoption-agency-cycle-crash.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<script>
+if (window.testRunner) {
+  testRunner.dumpAsText();
+  testRunner.waitUntilDone();
+}
+</script>
+<div id=ca><b><p id=fb><script>
+window.fb = document.getElementById('fb');
+window.ca = document.getElementById('ca');
+document.body.appendChild(window.fb);
+window.fb.appendChild(window.ca);
+</script></b></div>
+<script>
+if (window.testRunner) {
+  testRunner.notifyDone();
+}
+</script>
+PASS if no crash.
diff --git a/third_party/blink/web_tests/fast/parser/adoption-agency-document-target-crash-expected.txt b/third_party/blink/web_tests/fast/parser/adoption-agency-document-target-crash-expected.txt
new file mode 100644
index 0000000..c2541f4
--- /dev/null
+++ b/third_party/blink/web_tests/fast/parser/adoption-agency-document-target-crash-expected.txt
@@ -0,0 +1 @@
+PASS if no crash.
diff --git a/third_party/blink/web_tests/fast/parser/adoption-agency-document-target-crash.html b/third_party/blink/web_tests/fast/parser/adoption-agency-document-target-crash.html
new file mode 100644
index 0000000..a2d7238
--- /dev/null
+++ b/third_party/blink/web_tests/fast/parser/adoption-agency-document-target-crash.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<script>
+if (window.testRunner) {
+  testRunner.dumpAsText();
+  testRunner.waitUntilDone();
+}
+</script>
+<table><tbody><tr><b><div id=fb><script>
+window.fb = document.getElementById('fb');
+window.other = document.implementation.createHTMLDocument('');
+window.other.documentElement.remove();
+window.other.appendChild(document.querySelector('table'));
+</script></b></table>
+<script>
+if (window.testRunner) {
+  testRunner.notifyDone();
+}
+</script>
+PASS if no crash.
diff --git a/third_party/blink/web_tests/fast/parser/adoption-agency-inner-loop-cycle-crash-expected.txt b/third_party/blink/web_tests/fast/parser/adoption-agency-inner-loop-cycle-crash-expected.txt
new file mode 100644
index 0000000..c2541f4
--- /dev/null
+++ b/third_party/blink/web_tests/fast/parser/adoption-agency-inner-loop-cycle-crash-expected.txt
@@ -0,0 +1 @@
+PASS if no crash.
diff --git a/third_party/blink/web_tests/fast/parser/adoption-agency-inner-loop-cycle-crash.html b/third_party/blink/web_tests/fast/parser/adoption-agency-inner-loop-cycle-crash.html
new file mode 100644
index 0000000..f45e242
--- /dev/null
+++ b/third_party/blink/web_tests/fast/parser/adoption-agency-inner-loop-cycle-crash.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<script>
+if (window.testRunner) {
+  testRunner.dumpAsText();
+  testRunner.waitUntilDone();
+}
+</script>
+<div id=ca><b><i><p id=fb><script>
+window.fb = document.getElementById('fb');
+window.ca = document.getElementById('ca');
+document.body.appendChild(window.fb);
+window.fb.appendChild(window.ca);
+</script></i></b></div>
+<script>
+if (window.testRunner) {
+  testRunner.notifyDone();
+}
+</script>
+PASS if no crash.
diff --git a/third_party/blink/web_tests/fast/parser/adoption-agency-shadow-cycle-crash-expected.txt b/third_party/blink/web_tests/fast/parser/adoption-agency-shadow-cycle-crash-expected.txt
new file mode 100644
index 0000000..c2541f4
--- /dev/null
+++ b/third_party/blink/web_tests/fast/parser/adoption-agency-shadow-cycle-crash-expected.txt
@@ -0,0 +1 @@
+PASS if no crash.
diff --git a/third_party/blink/web_tests/fast/parser/adoption-agency-shadow-cycle-crash.html b/third_party/blink/web_tests/fast/parser/adoption-agency-shadow-cycle-crash.html
new file mode 100644
index 0000000..1bb1fec
--- /dev/null
+++ b/third_party/blink/web_tests/fast/parser/adoption-agency-shadow-cycle-crash.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<script>
+if (window.testRunner) {
+  testRunner.dumpAsText();
+  testRunner.waitUntilDone();
+}
+</script>
+<div id=ca><b><p id=fb><script>
+window.fb = document.getElementById('fb');
+window.ca = document.getElementById('ca');
+var host = document.createElement('span');
+var root = host.attachShadow({mode:'open'});
+document.body.appendChild(window.fb);
+window.fb.appendChild(host);
+root.appendChild(window.ca);
+</script></b></div>
+<script>
+if (window.testRunner) {
+  testRunner.notifyDone();
+}
+</script>
+PASS if no crash.
diff --git a/third_party/blink/web_tests/fast/parser/adoption-agency-template-cycle-crash-expected.txt b/third_party/blink/web_tests/fast/parser/adoption-agency-template-cycle-crash-expected.txt
new file mode 100644
index 0000000..c2541f4
--- /dev/null
+++ b/third_party/blink/web_tests/fast/parser/adoption-agency-template-cycle-crash-expected.txt
@@ -0,0 +1 @@
+PASS if no crash.
diff --git a/third_party/blink/web_tests/fast/parser/adoption-agency-template-cycle-crash.html b/third_party/blink/web_tests/fast/parser/adoption-agency-template-cycle-crash.html
new file mode 100644
index 0000000..ebd0cc5
--- /dev/null
+++ b/third_party/blink/web_tests/fast/parser/adoption-agency-template-cycle-crash.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<script>
+if (window.testRunner) {
+  testRunner.dumpAsText();
+  testRunner.waitUntilDone();
+}
+</script>
+<div id=ca><b><p id=fb><script>
+window.fb = document.getElementById('fb');
+window.ca = document.getElementById('ca');
+var tmpl = document.createElement('template');
+document.body.appendChild(window.fb);
+window.fb.appendChild(tmpl);
+tmpl.content.appendChild(window.ca);
+</script></b></div>
+<script>
+if (window.testRunner) {
+  testRunner.notifyDone();
+}
+</script>
+PASS if no crash.
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/third_party/blink/web_tests/fast/parser/adoption-agency-cycle-crash-expected.txt b/third_party/blink/web_tests/fast/parser/adoption-agency-cycle-crash-expected.txt
new file mode 100644
index 0000000..c2541f4
--- /dev/null
+++ b/third_party/blink/web_tests/fast/parser/adoption-agency-cycle-crash-expected.txt
@@ -0,0 +1 @@
+PASS if no crash.
diff --git a/third_party/blink/web_tests/fast/parser/adoption-agency-cycle-crash.html b/third_party/blink/web_tests/fast/parser/adoption-agency-cycle-crash.html
new file mode 100644
index 0000000..edf7f06
--- /dev/null
+++ b/third_party/blink/web_tests/fast/parser/adoption-agency-cycle-crash.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<script>
+if (window.testRunner) {
+  testRunner.dumpAsText();
+  testRunner.waitUntilDone();
+}
+</script>
+<div id=ca><b><p id=fb><script>
+window.fb = document.getElementById('fb');
+window.ca = document.getElementById('ca');
+document.body.appendChild(window.fb);
+window.fb.appendChild(window.ca);
+</script></b></div>
+<script>
+if (window.testRunner) {
+  testRunner.notifyDone();
+}
+</script>
+PASS if no crash.
diff --git a/third_party/blink/web_tests/fast/parser/adoption-agency-document-target-crash-expected.txt b/third_party/blink/web_tests/fast/parser/adoption-agency-document-target-crash-expected.txt
new file mode 100644
index 0000000..c2541f4
--- /dev/null
+++ b/third_party/blink/web_tests/fast/parser/adoption-agency-document-target-crash-expected.txt
@@ -0,0 +1 @@
+PASS if no crash.
diff --git a/third_party/blink/web_tests/fast/parser/adoption-agency-document-target-crash.html b/third_party/blink/web_tests/fast/parser/adoption-agency-document-target-crash.html
new file mode 100644
index 0000000..a2d7238
--- /dev/null
+++ b/third_party/blink/web_tests/fast/parser/adoption-agency-document-target-crash.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<script>
+if (window.testRunner) {
+  testRunner.dumpAsText();
+  testRunner.waitUntilDone();
+}
+</script>
+<table><tbody><tr><b><div id=fb><script>
+window.fb = document.getElementById('fb');
+window.other = document.implementation.createHTMLDocument('');
+window.other.documentElement.remove();
+window.other.appendChild(document.querySelector('table'));
+</script></b></table>
+<script>
+if (window.testRunner) {
+  testRunner.notifyDone();
+}
+</script>
+PASS if no crash.
diff --git a/third_party/blink/web_tests/fast/parser/adoption-agency-inner-loop-cycle-crash-expected.txt b/third_party/blink/web_tests/fast/parser/adoption-agency-inner-loop-cycle-crash-expected.txt
new file mode 100644
index 0000000..c2541f4
--- /dev/null
+++ b/third_party/blink/web_tests/fast/parser/adoption-agency-inner-loop-cycle-crash-expected.txt
@@ -0,0 +1 @@
+PASS if no crash.
diff --git a/third_party/blink/web_tests/fast/parser/adoption-agency-inner-loop-cycle-crash.html b/third_party/blink/web_tests/fast/parser/adoption-agency-inner-loop-cycle-crash.html
new file mode 100644
index 0000000..f45e242
--- /dev/null
+++ b/third_party/blink/web_tests/fast/parser/adoption-agency-inner-loop-cycle-crash.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<script>
+if (window.testRunner) {
+  testRunner.dumpAsText();
+  testRunner.waitUntilDone();
+}
+</script>
+<div id=ca><b><i><p id=fb><script>
+window.fb = document.getElementById('fb');
+window.ca = document.getElementById('ca');
+document.body.appendChild(window.fb);
+window.fb.appendChild(window.ca);
+</script></i></b></div>
+<script>
+if (window.testRunner) {
+  testRunner.notifyDone();
+}
+</script>
+PASS if no crash.
diff --git a/third_party/blink/web_tests/fast/parser/adoption-agency-shadow-cycle-crash-expected.txt b/third_party/blink/web_tests/fast/parser/adoption-agency-shadow-cycle-crash-expected.txt
new file mode 100644
index 0000000..c2541f4
--- /dev/null
+++ b/third_party/blink/web_tests/fast/parser/adoption-agency-shadow-cycle-crash-expected.txt
@@ -0,0 +1 @@
+PASS if no crash.
diff --git a/third_party/blink/web_tests/fast/parser/adoption-agency-shadow-cycle-crash.html b/third_party/blink/web_tests/fast/parser/adoption-agency-shadow-cycle-crash.html
new file mode 100644
index 0000000..1bb1fec
--- /dev/null
+++ b/third_party/blink/web_tests/fast/parser/adoption-agency-shadow-cycle-crash.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<script>
+if (window.testRunner) {
+  testRunner.dumpAsText();
+  testRunner.waitUntilDone();
+}
+</script>
+<div id=ca><b><p id=fb><script>
+window.fb = document.getElementById('fb');
+window.ca = document.getElementById('ca');
+var host = document.createElement('span');
+var root = host.attachShadow({mode:'open'});
+document.body.appendChild(window.fb);
+window.fb.appendChild(host);
+root.appendChild(window.ca);
+</script></b></div>
+<script>
+if (window.testRunner) {
+  testRunner.notifyDone();
+}
+</script>
+PASS if no crash.
diff --git a/third_party/blink/web_tests/fast/parser/adoption-agency-template-cycle-crash-expected.txt b/third_party/blink/web_tests/fast/parser/adoption-agency-template-cycle-crash-expected.txt
new file mode 100644
index 0000000..c2541f4
--- /dev/null
+++ b/third_party/blink/web_tests/fast/parser/adoption-agency-template-cycle-crash-expected.txt
@@ -0,0 +1 @@
+PASS if no crash.
diff --git a/third_party/blink/web_tests/fast/parser/adoption-agency-template-cycle-crash.html b/third_party/blink/web_tests/fast/parser/adoption-agency-template-cycle-crash.html
new file mode 100644
index 0000000..ebd0cc5
--- /dev/null
+++ b/third_party/blink/web_tests/fast/parser/adoption-agency-template-cycle-crash.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<script>
+if (window.testRunner) {
+  testRunner.dumpAsText();
+  testRunner.waitUntilDone();
+}
+</script>
+<div id=ca><b><p id=fb><script>
+window.fb = document.getElementById('fb');
+window.ca = document.getElementById('ca');
+var tmpl = document.createElement('template');
+document.body.appendChild(window.fb);
+window.fb.appendChild(tmpl);
+tmpl.content.appendChild(window.ca);
+</script></b></div>
+<script>
+if (window.testRunner) {
+  testRunner.notifyDone();
+}
+</script>
+PASS if no crash.
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
On This Page