PatchGap · Weakness Pattern
DevTools raw context pointer freed by re-entrant JS
WP-REENTRANT-INSPECTOR-UAF
UAF
9 CVEs
9 mapped
CWE-416 use-after-free
2026-04 → 2026-09
A DevTools/Inspector agent borrows a raw pointer to an InspectedContext, InjectedScript, V8DebuggerScript, session, or message storage and holds it across a call that synchronously re-enters attacker-controlled JavaScript. That re-entrant execution destroys the very object still referenced, leaving the agent to dereference freed memory. The lifetime bug is specific to the inspector’s synchronous callouts, not to ordinary async scheduling.
Invariant
An inspector agent must co-own (via a stack-pinned shared_ptr or re-validated id) every context/script/session object it touches across any call that can synchronously re-enter user JavaScript; borrowing a raw pointer over such a callout is forbidden.
Mechanism
The inspector caches a raw InspectedContext*/InjectedScript*/V8DebuggerScript* or a live container iterator, then makes a call (addBinding, addBindings, setBreakpoint, forEachSession dispatch, serialization, or a nested message loop) that runs untrusted JS. The script tears down its own context, session, or console message storage synchronously during that callout. On return the stale raw pointer is dereferenced, or an existence check (hasConsoleMessageStorage) mistakes a destroy-and-recreate for continuity. Fixes promote the borrow to an owning shared_ptr pinned on the stack or re-fetch/re-validate the object by id under DisallowGarbageCollection.
Fix shape
Hold the object by owning shared_ptr for the duration of the re-entrant call (or re-resolve it by id and bail if gone) instead of caching a raw pointer.
CVEs in this pattern
2 components · V8, DevTools| CVE | What | Component | Vendor | Severity | Month | |
|---|---|---|---|---|---|---|
| CVE-2026-87617 | UAF in DevTools | DevTools | chrome | Low | 2026-09 | 🔧 |
| CVE-2026-17807 | UAF in V8 | V8 | chrome | Medium | 2026-07 | 🔧 |
| CVE-2026-17836 | UAF in V8 | V8 | chrome | Medium | 2026-07 | 🔧 |
| CVE-2026-10991 | UAF in V8 | V8 | chrome | Medium | 2026-06 | 🔧 |
| CVE-2026-11185 | UAF in V8 | V8 | chrome | Medium | 2026-06 | 🔧 |
| CVE-2026-14393 | UAF in V8 | V8 | chrome | Medium | 2026-06 | 🔧 |
| CVE-2026-14426 | UAF in V8 | V8 | chrome | High | 2026-06 | 🔧 |
| CVE-2026-7940 | UAF in V8 | V8 | chrome | Medium | 2026-05 | 🔧 |
| CVE-2026-5861 | UAF in V8 | V8 | chrome | High | 2026-04 | 🔧 |
Hunt for siblings
Auditor/scanner signal: a raw InspectedContext*/InjectedScript*/V8DebuggerScript* or session pointer that outlives a call known to run user JS (addBinding(s), setBreakpoint, forEachSession, serialize, nested message loop) with no stack shared_ptr guarding it.
Mitigations that would catch this class
- Return owning shared_ptr from context/script accessors and pin on the stack across callouts
- Re-validate objects by stable id after each re-entrant step and bail if destroyed
- Snapshot ids and re-fetch under DisallowGarbageCollection instead of holding live iterators