PatchGap
Chrome · CrashReporting

CVE-2026-85052

OOB in CrashReporting
High chrome OOB 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactOut of bounds read in CrashReporting
DescriptionOut of bounds read in CrashReporting
ComponentCrashReporting
Bug ClassOOB
Tracker502304489
Fix commitda2e30bc2075 (chromium/src) +16/-2
CISA KEVNot listed
CreditedGoogle
Disclosed2026-09-03

Files Changed

  • third_party/crashpad/README.chromium
  • third_party/crashpad/crashpad/snapshot/fuchsia/process_snapshot_fuchsia_test.cc
  • third_party/crashpad/crashpad/snapshot/linux/exception_snapshot_linux_test.cc
  • third_party/crashpad/crashpad/snapshot/mac/cpu_context_mac_test.cc
  • third_party/crashpad/crashpad/snapshot/sanitized/process_snapshot_sanitized.cc
  • third_party/crashpad/crashpad/snapshot/win/exception_snapshot_win_test.cc
  • third_party/crashpad/crashpad/util/linux/pac_helper.cc
  • third_party/crashpad/crashpad/util/misc/capture_context_test_util_linux.cc
  • third_party/crashpad/crashpad/util/misc/capture_context_test_util_mac.cc
  • third_party/crashpad/crashpad/util/misc/capture_context_test_util_win.cc
  • third_party/crashpad/crashpad/util/misc/reinterpret_bytes.cc
  • third_party/crashpad/crashpad/util/numeric/int128_test.cc

Patch

view commit
From da2e30bc2075402c4bd68fe1af7674bfbe3f5a4a Mon Sep 17 00:00:00 2001
From: Joshua Peraza <jperaza@google.com>
Date: Wed, 26 Aug 2026 10:30:05 -0700
Subject: [PATCH] Update Crashpad to 60dd943f48d77dc8d05dabc04badbd8561d0b8c4

48b459d7aed3 Add missing build/build_config.h includes
60dd943f48d7 Round up OOB stack pointers in ScanStackForPointers

Bug: 502304489
Change-Id: I8d2c6a0e72a03ecb8b25d4cb5292ef743a3c0d23
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8279916
Commit-Queue: Mark Mentovai <mark@chromium.org>
Auto-Submit: Joshua Peraza <jperaza@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1686535}
---

diff --git a/third_party/crashpad/README.chromium b/third_party/crashpad/README.chromium
index 8d2e2fda..a20b700 100644
--- a/third_party/crashpad/README.chromium
+++ b/third_party/crashpad/README.chromium
@@ -2,7 +2,7 @@
 Short Name: crashpad
 URL: https://chromium.googlesource.com/crashpad/crashpad
 Version: N/A
-Revision: ad1827ddbc03f1c214030b31b380243ded660b95
+Revision: 60dd943f48d77dc8d05dabc04badbd8561d0b8c4
 Update Mechanism: Manual
 License: Apache-2.0
 License File: crashpad/LICENSE
diff --git a/third_party/crashpad/crashpad/snapshot/fuchsia/process_snapshot_fuchsia_test.cc b/third_party/crashpad/crashpad/snapshot/fuchsia/process_snapshot_fuchsia_test.cc
index af245d3..dbdcb8b 100644
--- a/third_party/crashpad/crashpad/snapshot/fuchsia/process_snapshot_fuchsia_test.cc
+++ b/third_party/crashpad/crashpad/snapshot/fuchsia/process_snapshot_fuchsia_test.cc
@@ -22,6 +22,7 @@
 #include "base/fuchsia/fuchsia_logging.h"
 #include "base/logging.h"
 #include "base/strings/stringprintf.h"
+#include "build/build_config.h"
 #include "gtest/gtest.h"
 #include "snapshot/fuchsia/memory_map_region_snapshot_fuchsia.h"
 #include "test/multiprocess_exec.h"
diff --git a/third_party/crashpad/crashpad/snapshot/linux/exception_snapshot_linux_test.cc b/third_party/crashpad/crashpad/snapshot/linux/exception_snapshot_linux_test.cc
index 1862488..a17b4c4 100644
--- a/third_party/crashpad/crashpad/snapshot/linux/exception_snapshot_linux_test.cc
+++ b/third_party/crashpad/crashpad/snapshot/linux/exception_snapshot_linux_test.cc
@@ -25,6 +25,7 @@
 
 #include "base/bit_cast.h"
 #include "base/strings/stringprintf.h"
+#include "build/build_config.h"
 #include "gtest/gtest.h"
 #include "snapshot/cpu_architecture.h"
 #include "snapshot/linux/process_reader_linux.h"
diff --git a/third_party/crashpad/crashpad/snapshot/mac/cpu_context_mac_test.cc b/third_party/crashpad/crashpad/snapshot/mac/cpu_context_mac_test.cc
index caacc19..06589d99 100644
--- a/third_party/crashpad/crashpad/snapshot/mac/cpu_context_mac_test.cc
+++ b/third_party/crashpad/crashpad/snapshot/mac/cpu_context_mac_test.cc
@@ -16,6 +16,7 @@
 
 #include <mach/mach.h>
 
+#include "build/build_config.h"
 #include "gtest/gtest.h"
 
 namespace crashpad {
diff --git a/third_party/crashpad/crashpad/snapshot/sanitized/process_snapshot_sanitized.cc b/third_party/crashpad/crashpad/snapshot/sanitized/process_snapshot_sanitized.cc
index afa1c9f..5d44229 100644
--- a/third_party/crashpad/crashpad/snapshot/sanitized/process_snapshot_sanitized.cc
+++ b/third_party/crashpad/crashpad/snapshot/sanitized/process_snapshot_sanitized.cc
@@ -52,7 +52,11 @@
   template <typename Pointer>
   bool ScanStackForPointers(void* data, size_t size) {
     size_t sp_offset;
-    if (!AssignIfInRange(&sp_offset, stack_pointer_ - stack_->Address())) {
+    // stack_pointer_ might point below the stack region if ProcessReaderLinux
+    // interpreted it as pointing to a guard page.
+    if (stack_pointer_ < stack_->Address()) {
+      sp_offset = 0;
+    } else if (!AssignIfInRange(&sp_offset, stack_pointer_ - stack_->Address())) {
       return false;
     }
     const size_t aligned_sp_offset =
diff --git a/third_party/crashpad/crashpad/snapshot/win/exception_snapshot_win_test.cc b/third_party/crashpad/crashpad/snapshot/win/exception_snapshot_win_test.cc
index aa78e55..efb3bf8 100644
--- a/third_party/crashpad/crashpad/snapshot/win/exception_snapshot_win_test.cc
+++ b/third_party/crashpad/crashpad/snapshot/win/exception_snapshot_win_test.cc
@@ -20,6 +20,7 @@
 
 #include "base/files/file_path.h"
 #include "base/strings/utf_string_conversions.h"
+#include "build/build_config.h"
 #include "gtest/gtest.h"
 #include "snapshot/win/exception_snapshot_win.h"
 #include "snapshot/win/process_snapshot_win.h"
diff --git a/third_party/crashpad/crashpad/util/linux/pac_helper.cc b/third_party/crashpad/crashpad/util/linux/pac_helper.cc
index a9d5f04..49eccce2 100644
--- a/third_party/crashpad/crashpad/util/linux/pac_helper.cc
+++ b/third_party/crashpad/crashpad/util/linux/pac_helper.cc
@@ -24,6 +24,7 @@
   #include <ptrauth.h>
 #endif
 
+#include "build/build_config.h"
 #include "util/misc/address_types.h"
 
 namespace crashpad {
diff --git a/third_party/crashpad/crashpad/util/misc/capture_context_test_util_linux.cc b/third_party/crashpad/crashpad/util/misc/capture_context_test_util_linux.cc
index 55820b9..9b357ada 100644
--- a/third_party/crashpad/crashpad/util/misc/capture_context_test_util_linux.cc
+++ b/third_party/crashpad/crashpad/util/misc/capture_context_test_util_linux.cc
@@ -14,6 +14,7 @@
 
 #include "util/misc/capture_context_test_util.h"
 
+#include "build/build_config.h"
 #include "gtest/gtest.h"
 #include "util/misc/from_pointer_cast.h"
 
diff --git a/third_party/crashpad/crashpad/util/misc/capture_context_test_util_mac.cc b/third_party/crashpad/crashpad/util/misc/capture_context_test_util_mac.cc
index 8a75b03..841aec4 100644
--- a/third_party/crashpad/crashpad/util/misc/capture_context_test_util_mac.cc
+++ b/third_party/crashpad/crashpad/util/misc/capture_context_test_util_mac.cc
@@ -14,6 +14,7 @@
 
 #include "util/misc/capture_context_test_util.h"
 
+#include "build/build_config.h"
 #include "gtest/gtest.h"
 #include "util/misc/implicit_cast.h"
 
diff --git a/third_party/crashpad/crashpad/util/misc/capture_context_test_util_win.cc b/third_party/crashpad/crashpad/util/misc/capture_context_test_util_win.cc
index e21d865..70a6a7d 100644
--- a/third_party/crashpad/crashpad/util/misc/capture_context_test_util_win.cc
+++ b/third_party/crashpad/crashpad/util/misc/capture_context_test_util_win.cc
@@ -16,6 +16,7 @@
 
 #include <iterator>
 
+#include "build/build_config.h"
 #include "gtest/gtest.h"
 #include "util/win/context_wrappers.h"
 
diff --git a/third_party/crashpad/crashpad/util/misc/reinterpret_bytes.cc b/third_party/crashpad/crashpad/util/misc/reinterpret_bytes.cc
index 5909b728..e7e5809b 100644
--- a/third_party/crashpad/crashpad/util/misc/reinterpret_bytes.cc
+++ b/third_party/crashpad/crashpad/util/misc/reinterpret_bytes.cc
@@ -19,6 +19,7 @@
 #include <algorithm>
 
 #include "base/logging.h"
+#include "build/build_config.h"
 
 namespace crashpad {
 namespace internal {
diff --git a/third_party/crashpad/crashpad/util/numeric/int128_test.cc b/third_party/crashpad/crashpad/util/numeric/int128_test.cc
index 5bc9e41..43eaf08 100644
--- a/third_party/crashpad/crashpad/util/numeric/int128_test.cc
+++ b/third_party/crashpad/crashpad/util/numeric/int128_test.cc
@@ -15,6 +15,7 @@
 #include "util/numeric/int128.h"
 
 #include "base/bit_cast.h"
+#include "build/build_config.h"
 #include "gtest/gtest.h"
 
 namespace crashpad {
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/third_party/crashpad/crashpad/snapshot/fuchsia/process_snapshot_fuchsia_test.cc b/third_party/crashpad/crashpad/snapshot/fuchsia/process_snapshot_fuchsia_test.cc
index af245d3..dbdcb8b 100644
--- a/third_party/crashpad/crashpad/snapshot/fuchsia/process_snapshot_fuchsia_test.cc
+++ b/third_party/crashpad/crashpad/snapshot/fuchsia/process_snapshot_fuchsia_test.cc
@@ -22,6 +22,7 @@
 #include "base/fuchsia/fuchsia_logging.h"
 #include "base/logging.h"
 #include "base/strings/stringprintf.h"
+#include "build/build_config.h"
 #include "gtest/gtest.h"
 #include "snapshot/fuchsia/memory_map_region_snapshot_fuchsia.h"
 #include "test/multiprocess_exec.h"
diff --git a/third_party/crashpad/crashpad/snapshot/linux/exception_snapshot_linux_test.cc b/third_party/crashpad/crashpad/snapshot/linux/exception_snapshot_linux_test.cc
index 1862488..a17b4c4 100644
--- a/third_party/crashpad/crashpad/snapshot/linux/exception_snapshot_linux_test.cc
+++ b/third_party/crashpad/crashpad/snapshot/linux/exception_snapshot_linux_test.cc
@@ -25,6 +25,7 @@
 
 #include "base/bit_cast.h"
 #include "base/strings/stringprintf.h"
+#include "build/build_config.h"
 #include "gtest/gtest.h"
 #include "snapshot/cpu_architecture.h"
 #include "snapshot/linux/process_reader_linux.h"
diff --git a/third_party/crashpad/crashpad/snapshot/mac/cpu_context_mac_test.cc b/third_party/crashpad/crashpad/snapshot/mac/cpu_context_mac_test.cc
index caacc19..06589d99 100644
--- a/third_party/crashpad/crashpad/snapshot/mac/cpu_context_mac_test.cc
+++ b/third_party/crashpad/crashpad/snapshot/mac/cpu_context_mac_test.cc
@@ -16,6 +16,7 @@
 
 #include <mach/mach.h>
 
+#include "build/build_config.h"
 #include "gtest/gtest.h"
 
 namespace crashpad {
diff --git a/third_party/crashpad/crashpad/snapshot/win/exception_snapshot_win_test.cc b/third_party/crashpad/crashpad/snapshot/win/exception_snapshot_win_test.cc
index aa78e55..efb3bf8 100644
--- a/third_party/crashpad/crashpad/snapshot/win/exception_snapshot_win_test.cc
+++ b/third_party/crashpad/crashpad/snapshot/win/exception_snapshot_win_test.cc
@@ -20,6 +20,7 @@
 
 #include "base/files/file_path.h"
 #include "base/strings/utf_string_conversions.h"
+#include "build/build_config.h"
 #include "gtest/gtest.h"
 #include "snapshot/win/exception_snapshot_win.h"
 #include "snapshot/win/process_snapshot_win.h"
diff --git a/third_party/crashpad/crashpad/util/numeric/int128_test.cc b/third_party/crashpad/crashpad/util/numeric/int128_test.cc
index 5bc9e41..43eaf08 100644
--- a/third_party/crashpad/crashpad/util/numeric/int128_test.cc
+++ b/third_party/crashpad/crashpad/util/numeric/int128_test.cc
@@ -15,6 +15,7 @@
 #include "util/numeric/int128.h"
 
 #include "base/bit_cast.h"
+#include "build/build_config.h"
 #include "gtest/gtest.h"
 
 namespace crashpad {
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
On This Page