Chrome — 2026-W05
Clone-free silent-fix hunt over Chrome (Gerrit-sourced), 2026-01-26 → 2026-02-01. Every candidate
below is cherry-picked from the week’s merged security-relevant commits, triaged on
the patch-now / watch / noise ladder, given a full root-cause writeup, and
put through independent adversarial verification — the same bar as the WebKit
weekly reports.
This week. 16 candidates — 0 patch-now (RCE-class, attacker-reachable in default config), 12 watch (security-relevant but gated / weaker primitive / unproven), 4 noise, 0 duplicate. 16 root-caused · 16 tier-2 verified.
Candidates
Verdict: 🔴 patch-now (RCE-class, attacker-reachable in default config) · 🟡 watch (security-relevant but not confirmed patch-now — gated, weaker primitive, or unproven) · ⚪ noise (structural false positive) · 🔁 dup (cherry-pick). ✔︎verified = passed independent adversarial tier-2 review; ~plausible = tier-2 could not fully confirm from the diff. Conf is confidence the commit is a genuine security fix.
| Verdict | Class | Conf | Sev | CVSS | Component | Commit | Primitive |
|---|---|---|---|---|---|---|---|
| 🟡 watch · ✔︎verified | UAF | 0.65 | medium | 6.5 | third_party/blink/renderer |
c782b7694c |
PaintTimingVisualizer (a TraceSessionObserver) lived inside a GCed object; Oilpan poisons such memory before destruction, so the non-GC observer list held a poisoned pointer used after poisoning. |
| 🟡 watch · ✔︎verified | UAF | 0.6 | medium | 6.5 | third_party/blink/renderer |
290dca899b |
Creating a permission/geolocation element via a saved reference to a detached document leaves GetExecutionContext() null, which was dereferenced during cache registration and task-runner lookup, crashing the renderer. |
| 🟡 watch · ✔︎verified | LogicError | 0.55 | medium | 6.5 | third_party/blink/renderer |
3ef3a44d6a |
A child inside ruby was inlinified, violating the block-level invariant of the canvas layout subtree and crashing during layout. |
| ⚪ noise | LogicError | 0.5 | low | 3.1 | third_party/blink/renderer |
02831a8662 |
A detached element could still invoke navigation activation behavior, contrary to spec’s cannot-navigate rule. No memory safety impact. |
| 🟡 watch · ~plausible | InfoDisclosure | 0.5 | low | 3.5 | third_party/blink/renderer |
11a2ce184d |
The deprecated webrtc::Buffer(size,capacity) constructor can produce uninitialized backing memory; replaced with CreateWithCapacity for the digest buffer. |
| 🟡 watch · ✔︎verified | InputValidation | 0.5 | medium | 5.0 | third_party/blink/public |
558f682dc5 |
The is_cross_origin_isolated bool in WebEmbeddedWorkerStartData was uninitialized (found by MSAN); a stale/garbage value could influence whether a worker gets cross-origin-isolated API access. |
| 🟡 watch · ✔︎verified | LogicError | 0.5 | medium | 5.9 | third_party/blink/renderer |
df9d578b62 |
Relaying out without fragmentation for clipped overflow during named-page pagination lost the page name, leading to a fragmentation-state inconsistency that crashed (test previously marked Crash). |
| 🟡 watch · ✔︎verified | LogicError | 0.45 | medium | 5.9 | third_party/blink/renderer |
f31e214aac |
A CHECK asserting the containing block equals the transition scope (or is the view-transition root) could fail for view-transition pseudo-elements, crashing the renderer during paint property tree building. |
| 🟡 watch · ✔︎verified | TypeConfusion | 0.4 | low | 3.7 | third_party/blink/renderer |
0ca06b10ef |
Cloning an element without children failed to assign the document’s default scoped custom element registry, so the clone could resolve against an unexpected registry/definition set. |
| 🟡 watch · ✔︎verified | UAF | 0.4 | low | 4.3 | third_party/blink/renderer |
87194599a4 |
Painting a dirty LayoutBlock whose descendants may already be destroyed is guarded by an early return; the release-build NOTREACHED dump was replaced with a DCHECK to avoid crashing while still returning. |
| 🟡 watch · ✔︎verified | InputValidation | 0.4 | low | 3.1 | third_party/blink/renderer |
9e619333d2 |
Range operators (>, <, =) were incorrectly accepted for non-range media/container features (e.g. overflow-inline > scroll), being matched as if ‘:’. |
| 🟡 watch · ✔︎verified | LogicError | 0.4 | low | 4.3 | third_party/blink/renderer |
b2f80b3e2b |
Adds CHECKs around BodyStreamBuffer close/LockAndDisturb to catch re-entering V8 while an exception is pending, a state that can lead to inconsistent/unsafe script execution. |
| 🟡 watch · ✔︎verified | LogicError | 0.3 | low | 3.1 | third_party/blink/renderer/core/ |
6914696683 |
Shadow root with a deliberately-null custom element registry could wrongly acquire the global registry on document adoption. |
| ⚪ noise | NotSecurity | 0.05 | dev | — | third_party/blink/renderer/modules/ |
3e2a2160a2 |
Threads a real media::MediaLog through the WebCodecs DecoderSelector (replacing NullMediaLog); diagnostics plumbing. |
| ⚪ noise | NotSecurity | 0.05 | dev | 0.0 | third_party/blink/renderer/core/ |
c604849492 |
Migrate IsAtomicInlineLevel() to IsAtomicInline()/IsInline() across core/editing and inline_cursor. |
| ⚪ noise | NotSecurity | 0.05 | dev | 0.0 | third_party/blink/renderer/core/ |
e9a953f63e |
Switch core/layout/layout_* uses of IsAtomicInlineLevel() to IsInline(). |