Chrome — 2026-W31
Clone-free silent-fix hunt over Chrome (Gerrit-sourced), 2026-07-27 → 2026-08-02. Every candidate
below is cherry-picked from the week’s merged security-relevant commits, triaged on
the patch-now / watch / noise ladder, given a full root-cause writeup, and
put through independent adversarial verification — the same bar as the WebKit
weekly reports.
This week. 23 candidates — 2 patch-now (RCE-class, attacker-reachable in default config), 10 watch (security-relevant but gated / weaker primitive / unproven), 11 noise, 0 duplicate. 23 root-caused · 22 tier-2 verified.
Candidates
Verdict: 🔴 patch-now (RCE-class, attacker-reachable in default config) · 🟡 watch (security-relevant but not confirmed patch-now — gated, weaker primitive, or unproven) · ⚪ noise (structural false positive) · 🔁 dup (cherry-pick). ✔︎verified = passed independent adversarial tier-2 review; ~plausible = tier-2 could not fully confirm from the diff. Conf is confidence the commit is a genuine security fix.
| Verdict | Class | Conf | Sev | CVSS | Component | Commit | Primitive |
|---|---|---|---|---|---|---|---|
| 🔴 patch-now · ✔︎verified | UAF | 7.3 | media/ |
69bf1c67cb |
[M150] [media] Keep ref on MemoryTypeTracker in SharedImageReadLock | ||
| 🔴 patch-now · ✔︎verified | UAF | 8.1 | third_party/blink/renderer/core/ |
85c3f8f61a |
[M152] Sanitize presentation attribute cache hash using EnsureValidHash | ||
| 🟡 watch · ~plausible | UAF | 8.1 | — |
00b6352a29 |
[M150] Prevent use-after-free in WidgetBase by adding weak pointer checks. | ||
| 🟡 watch · ✔︎verified | UAF | 5.4 | third_party/blink/renderer/modules/ |
021769f100 |
[M144-LTS] InspectorIndexedDBAgent must not use v8_session_ after disposal | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
195beab04b |
[tracing] Avoid perfetto track aliasing in third_party/blink/renderer/core/workers | ||
| 🟡 watch · ✔︎verified | OOB | 6.5 | third_party/blink/renderer/core/ |
1d5f4f482b |
[M150] Fix crash in CSSNumericValue.parse() with unsupported functions | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
2a0129fa00 |
Fix WebPagePopupImpl::OwnerWindowRectInScreen() when the popup is in a subframe | ||
| 🟡 watch · ~plausible | UAF | 8.1 | — |
38c49d2a96 |
[M144] Prevent use-after-free in WidgetBase::UpdateSurfaceAndScreen. | ||
| 🟡 watch · ~plausible | UAF | 7.0 | content/browser/ |
3a2d2b9451 |
[M144-LTS][DC] Add weak_this guard in Abort() | ||
| ⚪ noise | None | 0.0 | net/ |
3b34a565bf |
[gardener] Disable CertVerifyProcBuiltinTest Mtc tests on Linux MSan | ||
| ⚪ noise | None | 0.0 | media/ |
4084e55ddd |
cast: Fix audio sender samples count underflow crash | ||
| ⚪ noise | None | 0.0 | net/ |
550ff921eb |
[gardener] Disable DedicatedWebTransportHttp3HeadersTest on Linux MSan | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
65aae08b16 |
IcuBridge migration 11/n: multiple files | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
67ffa39a6b |
Replace String::Format() with StrCat() in FontMetadata | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
772428a9d1 |
[WebMIDI] Mark things const when possible | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
7f29670d11 |
Invalidate if(navigation(phase:)) changes | ||
| 🟡 watch · ~plausible | UAF | 8.1 | content/browser/ |
820623987e |
[M144-LTS] prevent CommitDeferringConditionRunner from potential UAF | ||
| 🟡 watch · ~plausible | UAF | 7.3 | — |
8676797b54 |
[M150] Fix potential use-after-free in WidgetBase. | ||
| 🟡 watch · ✔︎verified | IntegerOverflow | 6.5 | media/ |
a1a8e5fbb4 |
h264_decoder: Prevent signed integer overflow in frame_num_offset | ||
| 🟡 watch · ~plausible | UAF | 3.1 | content/browser/ |
a7c62a7cb9 |
Enforce EyeDropperChooserImpl liveness after eye_dropper_.reset() | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
c17eb4ef8c |
[M152] [webcodecs] Disable kUseSharedImageFormatForWebcodecsVideoFrame | ||
| 🟡 watch · ✔︎verified | InputValidation | 6.5 | services/ |
e16e582198 |
[viz] Add checks to reject invalid VTResourceId in SharedElementQuad | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
fcfe54d6d5 |
Built-in AI: Gate model session creation on adequate cache disk space |