PatchGap · Weakness Pattern
Browser process trusts renderer-supplied value without revalidation
WP-TRUST-RENDERER
LogicError
9 CVEs
9 mapped
CWE-807CWE-1287
2026-06 → 2026-09
The privileged browser process accepts a value, flag, length, scheme, or activation state supplied by the untrusted renderer and acts on it without recomputing or bounding it against browser-authoritative state. Because a compromised or malicious renderer controls that input, the browser inherits the renderer’s lie. The defect is one of trust placement, not of a check applied unevenly.
Invariant
The browser process must derive every security-relevant property from its own authoritative state, never adopting a renderer-supplied value, flag, or length as ground truth.
Mechanism
Members share the shape of the browser taking renderer input at face value: trusting a renderer-supplied is_xr_overlay flag and forwarding it to ancestor frames (CVE-2026-87502); trusting a renderer boolean for whether an opaque origin is a secure context instead of computing it from the precursor tuple (CVE-2026-87553); trusting a renderer scroll rect without intersecting it with the child frame’s known bounds (CVE-2026-87495); trusting a renderer-supplied file:// scheme into ClipboardMac::WriteURL (CVE-2026-87582); enforcing a fenced-frame restriction only in the renderer while the browser binder trusts it unconditionally (CVE-2026-87543); and dropping an input-size limit so an untrusted page pushes unbounded text into the privileged layer (CVE-2026-13777). GPU-service-supplied lengths bounding a fixed buffer (CVE-2026-84351) and out-of-range untrusted enums (CVE-2026-12009) follow the same pattern.
Fix shape
Delete or ignore the renderer-supplied field and have the browser compute the property authoritatively from its own state, or bound/validate the incoming value against browser-known extents before use.
CVEs in this pattern
8 components · Chromium, GPU, Scroll, Fullscreen, Core, SiteIsolation, DataTransfer, ServiceWorker| CVE | What | Component | Vendor | Severity | Month | |
|---|---|---|---|---|---|---|
| CVE-2026-84351 | OOB in GPU | GPU | chrome | High | 2026-09 | 🔧 |
| CVE-2026-87495 | InfoDisclosure in Scroll | Scroll | chrome | Medium | 2026-09 | 🔧 |
| CVE-2026-87502 | AuthorizationError in Fullscree | Fullscreen | chrome | Low | 2026-09 | 🔧 |
| CVE-2026-87543 | AuthorizationError in Core | Core | chrome | Low | 2026-09 | 🔧 |
| CVE-2026-87553 | InputValidation in SiteIsolatio | SiteIsolation | chrome | Medium | 2026-09 | 🔧 |
| CVE-2026-87582 | AuthorizationError in DataTransfer | DataTransfer | chrome | Medium | 2026-09 | 🔧 |
| CVE-2026-87614 | AuthorizationError in ServiceWorker | ServiceWorker | chrome | Low | 2026-09 | 🔧 |
| CVE-2026-12009 | InputValidation in Chromium | Chromium | chrome | Critical | 2026-06 | 🔧 |
| CVE-2026-13777 | InputValidation in Chromium | Chromium | chrome | Critical | 2026-06 | 🔧 |
Hunt for siblings
Auditors and fuzzers should trace renderer-originated IPC fields into browser-process sinks and flag any security-relevant value used without a browser-side recomputation or bound; mutating IPC flags, lengths, and enums to out-of-spec values is a direct fuzzer signal.
Mitigations that would catch this class
- Recompute security-relevant properties (secure-context, scheme, origin, activation) in the browser from authoritative state rather than trusting IPC fields.
- Bound every renderer-supplied length, rect, or count against browser-known limits before use, and reject out-of-range enums.
- Enforce restrictions in the browser-process binder, never relying on renderer-side enforcement of the same rule.