CVE-2026-7910

High watch CVSS 9.6 chrome UAF 📄 Reporter bug report 🔧 Commit mapped

Overview

High

Severity

9.6

CVSS

Exploited ITW

Fixed

Fix Status

ImpactUse after free in Views

DescriptionUse after free in Views

ComponentViews

Sub-componentViews

Bug ClassUAF

Action tierwatch — corruption primitive but gated (uncommon) — not default-reachable
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.

Tracker497543810

Fix commit3fc1ee6676b7 (chromium/src) +41/-0

CWECWE-416 (Use-after-free)

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CISA KEVNot listed

CreditedGoogle

Reported2026-03-29 (per vendor advisory)

Fix landed2026-04-09 (public git)

Disclosed2026-05-05

Patch gap26 days — fix public in source before the advisory

Background

`DesktopWindowTreeHostPlatform` (`DWTHP`): the Ozone/Aura desktop window host on Linux that bridges a platform window to the Views widget stack.
`OnActivationChanged`: a ui::PlatformWindowDelegate callback invoked when the platform window gains or loses activation; the enclosing function is named only in the commit subject, not in the @@ hunk context.
`HandleActivationChanged`: the DesktopNativeWidgetAura call reached from OnActivationChanged that notifies WidgetObservers, any of which can synchronously close (and thus destroy) the widget and its DWTHP.
`base::WeakPtr` guard: capturing a WeakPtr to this before a callback and testing it afterward so a method can detect its own synchronous destruction before continuing.

Root Cause Analysis

OnActivationChanged set is_active_, forwarded to aura::WindowTreeHostPlatform::OnActivationChanged, then called desktop_native_widget_aura_->HandleActivationChanged(active) and unconditionally called ScheduleRelayout() on this. On Linux/Ozone, HandleActivationChanged() can fire observer notifications that synchronously close the widget, destroying the DesktopWindowTreeHostPlatform instance; control then returned to OnActivationChanged, which called ScheduleRelayout() on the freed this, a use-after-free. The invariant violated is that this remains valid for the remainder of the method after dispatching a callback that can delete it.

The fix adds a base::WeakPtrFactory<DesktopWindowTreeHostPlatform> weak_factory_ member, captures auto weak_this = weak_factory_.GetWeakPtr(); before HandleActivationChanged(), and does if (!weak_this) return; before ScheduleRelayout(), so the method bails out safely when it was destroyed mid-call. The shipped regression test OnActivationChangedSurvivesSynchronousClose drives the exact trigger: a WidgetObserver that calls widget->CloseNow() from OnWidgetActivationChanged, after which the previously-crashing OnActivationChanged must not crash. The commit notes this mirrors an earlier analogous guard in the Windows hwnd_message_handler.cc.

Key insight

The method dereferenced this (ScheduleRelayout()) after a callback that can synchronously delete this; the fix detects that self-destruction with a WeakPtr guard and returns early instead of touching freed memory.

Attack Path

Hold an activation observer that closes A widget has a WidgetObserver (or equivalent) whose OnWidgetActivationChanged/close path synchronously tears down the widget, as the regression test’s CloseOnActivationWidgetObserver demonstrates.
Trigger activation change An activation event on the platform window invokes OnActivationChanged(active) on the DesktopWindowTreeHostPlatform.
Synchronous destruction HandleActivationChanged() dispatches the notification, the observer closes the widget via CloseNow(), and the DWTHP instance is freed before the call returns.
Use-after-free OnActivationChanged resumes and calls ScheduleRelayout() on the freed this, corrupting/reading freed browser-process memory.
Exploitation Grooming the freed allocation could escalate the UAF into a stronger primitive (inferred); the patch and test only show the crash.

Impact Assessment

An attacker able to influence window activation timing while an observer closes the widget synchronously can trigger a use-after-free of a DesktopWindowTreeHostPlatform in the browser process on Linux/Ozone, with the precondition of a synchronous close reachable from the activation-change notification. The advisory rates this high (“Use after free in Views”) and does not report in-the-wild exploitation. Memory corruption or code execution beyond the demonstrated dangling ScheduleRelayout() call is (inferred).

Changed Functions

Function	Change	Notes
`if` ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc	modified
`CloseOnActivationWidgetObserver` ui/views/widget/desktop_aura/desktop_window_tree_host_platform_unittest.cc	modified
`DesktopWindowTreeHostPlatformTest` ui/views/widget/desktop_aura/desktop_window_tree_host_platform_unittest.cc	modified
`VisibilityObserver` ui/views/widget/desktop_aura/desktop_window_tree_host_platform_unittest.cc	modified

Files Changed

ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc
ui/views/widget/desktop_aura/desktop_window_tree_host_platform.h
ui/views/widget/desktop_aura/desktop_window_tree_host_platform_unittest.cc

Audit Directions

Dereference after a self-deleting callback
Flag any method that calls this-> members after invoking observer/delegate notifications (activation, visibility, focus, bounds) that can synchronously close a widget; guard with a WeakPtr or restructure so no work follows the callback.
Platform parity gaps
When one platform (here Windows hwnd_message_handler.cc) already has a self-destruction guard, audit the Ozone/Linux, macOS, and other platform equivalents for the missing mirror.
Widget close/observer reentrancy
Review WidgetObserver and PlatformWindowDelegate dispatch sites where observers may call CloseNow()/Close(), since those are the synchronous-destruction sources for host and widget objects.

Patch

view commit

From 3fc1ee6676b729cd5b00c1a58bed103437c71aec Mon Sep 17 00:00:00 2001
From: Tom Anderson <thomasanderson@chromium.org>
Date: Thu, 09 Apr 2026 12:12:20 -0700
Subject: [PATCH] views: Guard against UAF in DWTHP::OnActivationChanged

HandleActivationChanged() notifications can cause the widget to be
synchronously closed. On Linux/Ozone, this can result in the destruction
of the DesktopWindowTreeHostPlatform instance.

This change adds a base::WeakPtr guard around HandleActivationChanged()
to ensure 'this' is still valid before calling ScheduleRelayout().
This mirrors an analogous fix previously applied to the Windows
implementation in hwnd_message_handler.cc.

Fixed: 497543810
Change-Id: I58fcddf8542bc1aa30d0ad5508d16849fd56e3ac
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7737952
Reviewed-by: Lei Zhang <thestig@chromium.org>
Auto-Submit: Thomas Anderson <thomasanderson@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1612417}
---

diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc b/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc
index 942e685..e005cce1 100644
--- a/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc
+++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc
@@ -1065,7 +1065,15 @@
   }
   is_active_ = active;
   aura::WindowTreeHostPlatform::OnActivationChanged(active);
+
+  // HandleActivationChanged() notifications can cause the widget to be
+  // synchronously closed.
+  auto weak_this = weak_factory_.GetWeakPtr();
   desktop_native_widget_aura_->HandleActivationChanged(active);
+  if (!weak_this) {
+    return;
+  }
+
   ScheduleRelayout();
 }
 
diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.h b/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.h
index 185da8cd..efca27cd 100644
--- a/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.h
+++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.h
@@ -273,6 +273,7 @@
 
   base::WeakPtrFactory<DesktopWindowTreeHostPlatform> close_widget_factory_{
       this};
+  base::WeakPtrFactory<DesktopWindowTreeHostPlatform> weak_factory_{this};
 };
 
 }  // namespace views
diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_platform_unittest.cc b/ui/views/widget/desktop_aura/desktop_window_tree_host_platform_unittest.cc
index 1236cb1..950938b 100644
--- a/ui/views/widget/desktop_aura/desktop_window_tree_host_platform_unittest.cc
+++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_platform_unittest.cc
@@ -137,6 +137,22 @@
   return CreateWidgetWithNativeWidgetWithParams(std::move(params));
 }
 
+class CloseOnActivationWidgetObserver : public WidgetObserver {
+ public:
+  explicit CloseOnActivationWidgetObserver(Widget* widget) {
+    observation_.Observe(widget);
+  }
+  ~CloseOnActivationWidgetObserver() override = default;
+
+  void OnWidgetActivationChanged(Widget* widget, bool active) override {
+    observation_.Reset();
+    widget->CloseNow();
+  }
+
+ private:
+  base::ScopedObservation<Widget, WidgetObserver> observation_{this};
+};
+
 }  // namespace
 
 class DesktopWindowTreeHostPlatformTest : public ViewsTestBase {
@@ -606,6 +622,22 @@
   EXPECT_TRUE(host_platform->IsActive());
 }
 
+TEST_F(DesktopWindowTreeHostPlatformTest,
+       OnActivationChangedSurvivesSynchronousClose) {
+  std::unique_ptr<Widget> widget = CreateWidgetWithNativeWidget();
+  widget->Show();
+
+  auto* host_platform = DesktopWindowTreeHostPlatform::GetHostForWidget(
+      widget->GetNativeWindow()->GetHost()->GetAcceleratedWidget());
+  ASSERT_TRUE(host_platform);
+
+  CloseOnActivationWidgetObserver observer(widget.get());
+
+  // This should not crash.
+  static_cast<ui::PlatformWindowDelegate*>(host_platform)
+      ->OnActivationChanged(false);
+}
+
 #endif  // !BUILDFLAG(IS_FUCHSIA)
 
 class VisibilityObserver : public aura::WindowObserver {

Loading diff…

Regression Test / PoC

shipped with the fix

diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_platform_unittest.cc b/ui/views/widget/desktop_aura/desktop_window_tree_host_platform_unittest.cc
index 1236cb1..950938b 100644
--- a/ui/views/widget/desktop_aura/desktop_window_tree_host_platform_unittest.cc
+++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_platform_unittest.cc
@@ -137,6 +137,22 @@
   return CreateWidgetWithNativeWidgetWithParams(std::move(params));
 }
 
+class CloseOnActivationWidgetObserver : public WidgetObserver {
+ public:
+  explicit CloseOnActivationWidgetObserver(Widget* widget) {
+    observation_.Observe(widget);
+  }
+  ~CloseOnActivationWidgetObserver() override = default;
+
+  void OnWidgetActivationChanged(Widget* widget, bool active) override {
+    observation_.Reset();
+    widget->CloseNow();
+  }
+
+ private:
+  base::ScopedObservation<Widget, WidgetObserver> observation_{this};
+};
+
 }  // namespace
 
 class DesktopWindowTreeHostPlatformTest : public ViewsTestBase {
@@ -606,6 +622,22 @@
   EXPECT_TRUE(host_platform->IsActive());
 }
 
+TEST_F(DesktopWindowTreeHostPlatformTest,
+       OnActivationChangedSurvivesSynchronousClose) {
+  std::unique_ptr<Widget> widget = CreateWidgetWithNativeWidget();
+  widget->Show();
+
+  auto* host_platform = DesktopWindowTreeHostPlatform::GetHostForWidget(
+      widget->GetNativeWindow()->GetHost()->GetAcceleratedWidget());
+  ASSERT_TRUE(host_platform);
+
+  CloseOnActivationWidgetObserver observer(widget.get());
+
+  // This should not crash.
+  static_cast<ui::PlatformWindowDelegate*>(host_platform)
+      ->OnActivationChanged(false);
+}
+
 #endif  // !BUILDFLAG(IS_FUCHSIA)
 
 class VisibilityObserver : public aura::WindowObserver {

Loading diff…

Original Bug Report

reported by vm...@google.com

Potential Use-After-Free in DesktopWindowTreeHostPlatform::OnActivationChanged

Project Fortify, an experimental security project, has identified the following potential security issue.

Overview: A potential Use-After-Free (UAF) vulnerability exists in DesktopWindowTreeHostPlatform::OnActivationChanged on Linux/Ozone. Synchronous widget destruction during activation handling can free the this pointer, which is subsequently accessed when calling ScheduleRelayout(). This could potentially allow a compromised renderer to achieve Remote Code Execution (RCE) in the browser process.

Affected files:

ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc
ui/views/widget/desktop_aura/desktop_window_tree_host_platform.h

Estimated timestamp from git blame: 2024-05-31

Summary

A potential Use-After-Free (UAF) vulnerability has been identified in the browser process on Linux (Ozone platform) within DesktopWindowTreeHostPlatform::OnActivationChanged. The issue occurs because a synchronous call to desktop_native_widget_aura_->HandleActivationChanged(active) can trigger a cascade of events that results in the destruction of the DesktopWindowTreeHostPlatform instance. Upon returning from this call, the method unconditionally invokes ScheduleRelayout() on the now-freed this pointer.

Technical Details

In ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc, OnActivationChanged is implemented as follows:

void DesktopWindowTreeHostPlatform::OnActivationChanged(bool active) {
  // ...
  is_active_ = active;
  aura::WindowTreeHostPlatform::OnActivationChanged(active);
  desktop_native_widget_aura_->HandleActivationChanged(active);
  ScheduleRelayout();
}

The call to HandleActivationChanged(active) notifies WidgetObservers and focus listeners of the activation change. A specifically crafted UI interaction (or observer behavior) could respond to this notification by synchronously calling Widget::CloseNow().

This triggers the following synchronous destruction path:

Widget::CloseNow() calls native_widget_->CloseNow(), which routes to DesktopWindowTreeHostPlatform::CloseNow().
DesktopWindowTreeHostPlatform::CloseNow() calls platform_window()->Close().
On Ozone/X11 or Wayland, the platform window synchronously notifies its delegate via OnClosed().
DesktopWindowTreeHostPlatform::OnClosed() calls DesktopNativeWidgetAura::OnHostClosed().

Inside DesktopNativeWidgetAura::OnHostClosed() (desktop_native_widget_aura.cc:378):

  // WindowEventDispatcher owns |desktop_window_tree_host_|.
  desktop_window_tree_host_ = nullptr;
  // Delete host after resetting `desktop_window_tree_host_` and
  // `content_window_` to avoid accessing the stale instance during deletion.
  host_.reset();

First, the raw_ptr tracking the host object (desktop_window_tree_host_) is set to nullptr. This explicitly drops the reference count before destruction, meaning MiraclePtr (BackupRefPtr) will not quarantine the memory for this specific pointer.

Second, host_.reset() destroys the DesktopWindowTreeHostPlatform object (this). The memory is returned to PartitionAlloc.

When the stack unwinds back to OnActivationChanged, the code unconditionally calls ScheduleRelayout() on the freed this pointer.

Inside ScheduleRelayout():

void DesktopWindowTreeHostPlatform::ScheduleRelayout() {
  if (!native_widget_delegate_) {
    return;
  }
  Widget* widget = native_widget_delegate_->AsWidget();
  // ...

The code reads native_widget_delegate_ (a base::WeakPtr) from the freed memory and subsequently calls AsWidget(), a pure virtual function. If the memory has been reallocated and controlled by an attacker, this virtual function call can be hijacked.

Potential Exploitation Steps

Note: These are potential steps, as our tooling agent doesn’t yet have the ability to run code to confirm a working PoC.

An attacker compromises a renderer process (e.g., via a v8 bug).
The attacker uses the compromised renderer to open two popup windows (Popup A and Popup B).
The attacker programmatically closes Popup A, causing the OS window manager (Wayland/X11) to deliver an activation change notification to Popup B’s platform window.
DesktopWindowTreeHostPlatform::OnActivationChanged(true) is invoked for Popup B.
During HandleActivationChanged(true), a synchronous UI event or observer cascade triggers Widget::CloseNow().
The DesktopWindowTreeHostPlatform instance is destroyed via host_.reset(), and its memory is freed.
Concurrently, the attacker sprays the browser process heap via IPC messages to reallocate the freed memory chunk with attacker-controlled data.
The attacker forges the base::WeakPtr (native_widget_delegate_) within the sprayed memory to appear valid and points it to a fake object.
Control returns to OnActivationChanged, and ScheduleRelayout() is executed.
The forged WeakPtr check passes, and the virtual method AsWidget() is called on the attacker-controlled pointer, granting Remote Code Execution (RCE) in the browser process.

Suggested Fix

The call to ScheduleRelayout() in DesktopWindowTreeHostPlatform::OnActivationChanged must be guarded to ensure the this pointer has not been destroyed during the synchronous call to HandleActivationChanged(). A base::WeakPtr check should be used.

void DesktopWindowTreeHostPlatform::OnActivationChanged(bool active) {
  // ...
  is_active_ = active;
  aura::WindowTreeHostPlatform::OnActivationChanged(active);

  auto weak_this = close_widget_factory_.GetWeakPtr();
  desktop_native_widget_aura_->HandleActivationChanged(active);
  if (!weak_this) {
    return;
  }

  ScheduleRelayout();
}

A similar fix was previously applied to the Windows equivalent (ui/views/win/hwnd_message_handler.cc) but is missing in the Linux/Ozone implementation.

Evaluated with Chrome root at commit: a9cbf6e8b275fe4147435aa905f3b7f5a656f5f0

Results from so far have been promising, but there can be wrong deductions. If this proves to be a false positive, please close as WAI; data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.

View on issue tracker

References

Vendor advisory Fix commit Bug tracker NVD

On This Page