PatchGap · Weakness Pattern
Download hash inconsistent with bytes actually on disk
WP-DL-INTEGRITY
LogicError
2 CVEs
2 mapped
CWE-354CWE-459
2026-09 → 2026-09
A download or cache integrity check reports a hash that does not correspond to the bytes actually persisted, because the hashed range and the on-disk range diverge. A resumed or sparse download accumulates a hash over a different byte span than the file that ends up on disk, so the reported digest no longer certifies the stored content.
Invariant
The reported content hash must be computed over exactly the contiguous byte range that is persisted on disk, with no trailing, missing, or non-contiguous bytes.
Mechanism
Both members show a mismatch between the hashed span and the physical file: BaseFile::Finish() hashed the logical prefix of a sparse file but never truncated the physical file to that length, leaving trailing bytes that made the on-disk file inconsistent with its reported SHA-256 (CVE-2026-87549); and a hash accumulated over GetReceivedBytes() total bytes was treated as the hash of the contiguous prefix ending at the smaller resume offset, so the digest covered a different range than the persisted content (CVE-2026-95330).
Fix shape
Truncate the physical file to the exact hashed length before finishing, and drop or reset the hash state whenever the accumulated byte count disagrees with the persisted contiguous offset.
CVEs in this pattern
1 component · Downloads| CVE | What | Component | Vendor | Severity | Month | |
|---|---|---|---|---|---|---|
| CVE-2026-87549 | LogicError in Downloads | Downloads | chrome | Medium | 2026-09 | 🔧 |
| CVE-2026-95330 | InputValidation in Downloads | Downloads | chrome | Medium | 2026-09 | 🔧 |
Hunt for siblings
Auditors should check that every download-finish and resume path truncates to and hashes exactly the persisted contiguous range; fuzzing interrupted and resumed downloads with sparse writes surfaces hash/length divergence.
Mitigations that would catch this class
- Truncate the on-disk file to the hashed logical length so no trailing bytes escape the digest.
- Reset hash state whenever the received-byte total and the persisted contiguous offset diverge, forcing a clean re-hash.
- Compute the integrity digest only over the contiguous persisted prefix, never over a superset of received bytes.