Chrome — 2026-W04
Clone-free silent-fix hunt over Chrome (Gerrit-sourced), 2026-01-19 → 2026-01-25. Every candidate
below is cherry-picked from the week’s merged security-relevant commits, triaged on
the patch-now / watch / noise ladder, given a full root-cause writeup, and
put through independent adversarial verification — the same bar as the WebKit
weekly reports.
This week. 15 candidates — 0 patch-now (RCE-class, attacker-reachable in default config), 12 watch (security-relevant but gated / weaker primitive / unproven), 1 noise, 2 duplicate. 15 root-caused · 15 tier-2 verified.
Candidates
Verdict: 🔴 patch-now (RCE-class, attacker-reachable in default config) · 🟡 watch (security-relevant but not confirmed patch-now — gated, weaker primitive, or unproven) · ⚪ noise (structural false positive) · 🔁 dup (cherry-pick). ✔︎verified = passed independent adversarial tier-2 review; ~plausible = tier-2 could not fully confirm from the diff. Conf is confidence the commit is a genuine security fix.
| Verdict | Class | Conf | Sev | CVSS | Component | Commit | Primitive |
|---|---|---|---|---|---|---|---|
| 🟡 watch · ✔︎verified | IntegerOverflow | 0.8 | low | 3.3 | content/browser/code_cache |
0a75e6a832 |
max_bytes*kMaxWebUIPercent/100 overflows int when –disk-cache-size exceeds INT_MAX/2; fixed with int64 saturated_cast. |
🔁 dup of e9f65dc37d |
LogicError | 0.7 | low | 4.0 | third_party/blink/renderer |
b92b3b5af5 |
Guards rule->cssRules() against null for kNestedDeclarationsRule before iterating, preventing a null-deref during CSS resource serialization. |
| 🟡 watch · ✔︎verified | LogicError | 0.7 | low | 4.0 | third_party/blink/renderer |
e9f65dc37d |
kNestedDeclarationsRule is not a CSSGroupingRule and returns null from cssRules(); the unchecked loop dereferenced it, crashing during CSS serialization. |
| 🟡 watch · ✔︎verified | UAF | 0.65 | low | 4.3 | third_party/blink/renderer |
0cc1de910c |
Lambda callbacks kept a raw WeakPersistent(this); after GPUDevice deletion the weak ptr is null and the unchecked callback dereferences it, crashing the renderer. |
🔁 dup of 0cc1de910c |
UAF | 0.65 | low | 4.3 | third_party/blink/renderer |
3a7666894a |
Identical to origin CL: member-function binding replaces raw-lambda weak-ptr callbacks that could deref null after GPUDevice teardown. |
| 🟡 watch · ✔︎verified | LogicError | 0.6 | low | 3.5 | third_party/blink/renderer |
f4b178b0d0 |
waitUntil resolution reaching zero called document_->View()->ScheduleAnimation() without checking that document/View still exist during promise-driven teardown. |
| 🟡 watch · ✔︎verified | InputValidation | 0.5 | low | 3.1 | media/filters/ffmpeg_demuxer.cc |
57be4fe333 |
Removes a DCHECK_GE on buffer timestamp that fuzzer-crafted media could violate when codec_delay and negative start_time combine. |
| 🟡 watch · ✔︎verified | UAF | 0.5 | low | 2.0 | content/browser/webauth |
6d6235f4ec |
Drops a cached FlakyDanglingUntriaged raw_ptr to the test discovery factory and queries AuthenticatorEnvironment on demand instead. |
| 🟡 watch · ✔︎verified | PolicyBypass | 0.5 | low | 3.7 | content/child/runtime_features.cc |
b5ec42654d |
Adds a content-layer FeatureList check and origin-trial validation so the UserMediaElement permission element isn’t enabled via OT on disabled platforms. |
| 🟡 watch · ~plausible | OOB-read | 0.5 | medium | 5.0 | third_party/blink/renderer |
cef5dec891 |
Old memcpy copied bytes_to_read from a source buffer whose size is only CHECK_LE bytes_to_read, potentially over-reading; fix copies only bytes_read via span copy_prefix_from. |
| 🟡 watch · ✔︎verified | UAF | 0.4 | low | 0.0 | services/device/geolocation |
0bb64e19da |
Removes a dangling-pointer annotation on a raw_ptr after a lifetime audit; keeps it for ChromeOS where a real teardown-order dangle may exist. |
| 🟡 watch · ✔︎verified | LogicError | 0.4 | low | 0.0 | third_party/blink/renderer |
4e81b0721c |
Rewrites an erase-while-iterating loop over the observers vector to build a remaining-observers vector, removing UNSAFE_TODO pointer arithmetic. |
| ⚪ noise | UAF | 0.4 | low | 0.0 | services/device/geolocation |
56703ec4ec |
Removes dangling annotation on notifier_ raw_ptr after auditing declaration/destruction order in the owning provider; reorders a test member to match. |
| 🟡 watch · ✔︎verified | UAF | 0.35 | low | 2.5 | third_party/blink/renderer |
7db3f95b0a |
Short-circuits reset processing when shutting down and replaces pending-request release with a DCHECK, tightening callback/decoder lifetime on the close path. |
| 🟡 watch · ✔︎verified | LogicError | 0.3 | low | 0.0 | third_party/blink/renderer |
9012331469 |
Replaces raw memcpy of source bytes into a shared ArrayBuffer with span copy_from over an explicit-length span. |