From fa9a5d289de0e7d21dee9225249bc04c017e0b1f Mon Sep 17 00:00:00 2001
From: David Bokan <bokan@chromium.org>
Date: Fri, 15 May 2026 13:49:32 -0700
Subject: [PATCH] [Actor] Fix UAF in ClickDispatcher::DoMouseUp

Hold a weak_this WeakPtr in DoMouseUp and check it after DoMouseUpImpl
returns to prevent use-after-free if the instance is destroyed during
event dispatch.

Fixed: 511741396
Change-Id: I72f3d48817e9d36a979032317fd7f29982f463c7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7850495
Reviewed-by: Kevin McNee <mcnee@chromium.org>
Commit-Queue: Kevin McNee <mcnee@chromium.org>
Commit-Queue: David Bokan <bokan@chromium.org>
Auto-Submit: David Bokan <bokan@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1631538}
---

diff --git a/chrome/renderer/actor/click_dispatcher.cc b/chrome/renderer/actor/click_dispatcher.cc
index 461b026..462c090 100644
--- a/chrome/renderer/actor/click_dispatcher.cc
+++ b/chrome/renderer/actor/click_dispatcher.cc
@@ -135,7 +135,11 @@
 }
 
 void ClickDispatcher::DoMouseUp() {
+  base::WeakPtr<ClickDispatcher> weak_this = weak_ptr_factory_.GetWeakPtr();
   DoMouseUpImpl();
+  if (!weak_this) {
+    return;
+  }
   Finish(MakeOkResult());
 }