Chrome — 2026-W02
Clone-free silent-fix hunt over Chrome (Gerrit-sourced), 2026-01-05 → 2026-01-11. Every candidate
below is cherry-picked from the week’s merged security-relevant commits, triaged on
the patch-now / watch / noise ladder, given a full root-cause writeup, and
put through independent adversarial verification — the same bar as the WebKit
weekly reports.
This week. 19 candidates — 0 patch-now (RCE-class, attacker-reachable in default config), 15 watch (security-relevant but gated / weaker primitive / unproven), 4 noise, 0 duplicate. 19 root-caused · 19 tier-2 verified.
Candidates
Verdict: 🔴 patch-now (RCE-class, attacker-reachable in default config) · 🟡 watch (security-relevant but not confirmed patch-now — gated, weaker primitive, or unproven) · ⚪ noise (structural false positive) · 🔁 dup (cherry-pick). ✔︎verified = passed independent adversarial tier-2 review; ~plausible = tier-2 could not fully confirm from the diff. Conf is confidence the commit is a genuine security fix.
| Verdict | Class | Conf | Sev | CVSS | Component | Commit | Primitive |
|---|---|---|---|---|---|---|---|
| 🟡 watch · ✔︎verified | LogicError | 0.8 | low | 3.1 | third_party/blink/renderer |
1530d75211 |
ContentLayoutBoxFromNode() unconditionally cast the layout object to LayoutBlock and dereferenced it, crashing when the node has no layout object or is not a LayoutBlock. |
| 🟡 watch · ✔︎verified | IntegerOverflow | 0.8 | low | 3.7 | third_party/blink/renderer |
2522215e62 |
rootMargin percentage strings (e.g. ‘3e9%’) were passed through Length::IntValue(), triggering an undefined float-to-int cast overflow. |
| 🟡 watch · ✔︎verified | UAF | 0.75 | medium | 4.3 | third_party/blink/renderer |
53226c0f8d |
ImageRecord’s MediaTiming could be garbage-collected between the null test and the trace-event access (raw stack ptr optimized away), dereferencing a now-null field. |
| 🟡 watch · ✔︎verified | LogicError | 0.75 | low | 3.7 | third_party/blink/renderer |
f4a3c606be |
ApplyIterationAccumulation dereferenced cached_value_ without a null check, crashing for unsupported properties under iterationComposite:accumulate. |
| 🟡 watch · ✔︎verified | InfoDisclosure | 0.7 | medium | 5.3 | services/webnn/dml |
6b088b99da |
Context-lost handling was scheduled after tensor reads (race allowing reads of invalid results) and broadcast the lost reason to all contexts, including those from other origins, leaking cross-origin info. |
| 🟡 watch · ✔︎verified | LogicError | 0.6 | low | 3.1 | third_party/blink/renderer |
28bb9dc0c3 |
A CHECK(grid_layout_data) added earlier was crashing renderers on real pages; null grid_layout_data is already handled by the following nullptr path. |
| 🟡 watch · ✔︎verified | UAF | 0.6 | medium | 4.3 | third_party/blink/renderer |
79ebcbb929 |
When SuppressScrollAnchorScope is constructed with a null ScrollableArea, anchor_ was left uninitialized and later dereferenced in the destructor. |
| 🟡 watch · ✔︎verified | OOB-read | 0.6 | medium | 6.5 | third_party/blink/renderer |
b56c9d4512 |
Without disabling client-side array handling, vertex attribute offsets could be interpreted with client-side pointer semantics, enabling out-of-bounds/arbitrary memory reads from attribute offsets. |
| 🟡 watch · ~plausible | UAF | 0.55 | medium | 5.0 | third_party/blink/renderer |
8b599dffcd |
SVG resource invalidation triggered during interleaved-recalc/detach could be wrongly deferred (rather than performed) because the guarding flag was still set, leaving stale resource state. |
| 🟡 watch · ~plausible | UAF | 0.5 | low | 4.0 | AUTHORS |
35740ce260 |
If a worklet module load is in flight during navigation, pending tasks were not aborted, tripping a ~Worklet DCHECK and leaving WorkletPendingTasks referencing a torn-down context. |
| 🟡 watch · ✔︎verified | UAF | 0.5 | low | 3.7 | third_party/blink/renderer |
570bf70b7d |
Reused a CanvasSnapshotProvider without checking IsValid(), so a provider with a lost GPU context could be reused. |
| 🟡 watch · ~plausible | IntegerOverflow | 0.5 | low | 3.1 | gpu/command_buffer/client |
70973a7a60 |
GPUCanvasContext/OffscreenCanvas reported external buffer bytes before allocation, producing an inaccurate/overflowing memory-usage figure. |
| 🟡 watch · ✔︎verified | UAF | 0.5 | low | 3.7 | third_party/blink/renderer |
76749c84fc |
Context-loss was only checked in the accelerated case; a non-accelerated provider with an invalid/lost context could be reused. |
| ⚪ noise | InputValidation | 0.5 | low | 2.6 | AUTHORS |
abcf3e7bbd |
ConvertNFCDefRawMessage() assigned record payload and type spans into mojo identifier, so NDEF records were mis-parsed/confused when bridged to mojo. |
| 🟡 watch · ✔︎verified | LogicError | 0.5 | low | 3.1 | third_party/blink/renderer |
abde48c0d2 |
clearDepth() called glClearDepthFn, which is null in ANGLE’s entry points, causing a null function-pointer call. |
| 🟡 watch · ✔︎verified | UAF | 0.5 | low | 3.7 | third_party/blink/renderer |
b0caaa118e |
ImageCaptureFrameGrabber reused a snapshot provider without validating it, so a provider with a lost/invalid GPU context could be reused. |
| ⚪ noise | NotSecurity | 0.1 | dev | 0.0 | third_party/blink/renderer/core/ |
122c8eb2af |
Replace an InitialStyle() null-fallback with DCHECK(style) in GetOrCreateColumnPseudoElementIfNeeded(). |
| ⚪ noise | NotSecurity | 0.02 | dev | 0.0 | third_party/blink/renderer/core/ |
508a510508 |
Migrate base::Contains() calls to member .Contains() across blink. |
| ⚪ noise | NotSecurity | 0.02 | dev | 0.0 | third_party/blink/renderer/modules/ |
d696b12cec |
Migrate base::Contains() to member contains() across blink (files that keep the include). |