Chrome · Mojo
CVE-2026-8580
UAF in Mojo
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
WatcherImplmojo/public/java/system/watcher_impl.cc |
modified |
Files Changed
mojo/public/java/system/watcher_impl.cc
Patch
From 57fbced46b4bb4ffb3c938e335e027427e0c1203 Mon Sep 17 00:00:00 2001
From: mikt <mikt@google.com>
Date: Tue, 31 Mar 2026 00:16:30 -0700
Subject: [PATCH] Add AMSC macro to mojo::android::WatcherImpl
Bug: 496639647
Change-Id: Ifdd8dea7702b6639a8d4f9701e9e8f155a52c492
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7707718
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Commit-Queue: Mikihito Matsuura <mikt@google.com>
Cr-Commit-Position: refs/heads/main@{#1607682}
---
diff --git a/mojo/public/java/system/watcher_impl.cc b/mojo/public/java/system/watcher_impl.cc
index caed52da..fde62e8 100644
--- a/mojo/public/java/system/watcher_impl.cc
+++ b/mojo/public/java/system/watcher_impl.cc
@@ -8,6 +8,7 @@
#include "base/android/jni_android.h"
#include "base/android/scoped_java_ref.h"
#include "base/functional/bind.h"
+#include "base/memory/advanced_memory_safety_checks.h"
#include "base/task/sequenced_task_runner.h"
#include "mojo/public/cpp/system/handle.h"
#include "mojo/public/cpp/system/simple_watcher.h"
@@ -23,6 +24,9 @@
namespace {
class WatcherImpl {
+ // TODO(https://crbug.com/496639647): Remove this macro.
+ ADVANCED_MEMORY_SAFETY_CHECKS();
+
public:
WatcherImpl()
: watcher_(FROM_HERE,
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page