--- a/storage/browser/file_system/sandbox_file_system_backend_delegate.cc 2026-05-25 00:56:09.636682003 +0000 +++ b/storage/browser/file_system/sandbox_file_system_backend_delegate.cc 2026-06-06 00:26:01.813353579 +0000 @@ -441,8 +441,22 @@ #if DCHECK_IS_ON() DCHECK(!is_filesystem_opened_ || io_thread_checker_.CalledOnValidThread()); #endif - change_observers_[type] = + // --------------------------------------------------------------------------- + // Race-window amplification for the data race against GetChangeObservers(). + // The original code performs the unsynchronised read-modify-write below + // exactly once. Because the IO-thread reader hits this map for only a few + // hundred nanoseconds per OPFS operation, we repeat the same unsynchronised + // assignment in a tight loop so the IO thread has a realistic chance of + // copying the ChangeObserverList while it is being reassigned. The data + // race is unchanged; only its duration is extended. + // --------------------------------------------------------------------------- + ChangeObserverList added = change_observers_[type].AddObserver(std::move(observer), task_runner); + for (int i = 0; i < 5000000; ++i) { + change_observers_[type] = added; + change_observers_[type] = ChangeObserverList(); + } + change_observers_[type] = added; } void SandboxFileSystemBackendDelegate::AddFileAccessObserver(