Chrome — 2026-W32
Clone-free silent-fix hunt over Chrome (Gerrit-sourced), 2026-08-03 → 2026-08-09. Every candidate
below is cherry-picked from the week’s merged security-relevant commits, triaged on
the patch-now / watch / noise ladder, given a full root-cause writeup, and
put through independent adversarial verification — the same bar as the WebKit
weekly reports.
This week. 24 candidates — 2 patch-now (RCE-class, attacker-reachable in default config), 4 watch (security-relevant but gated / weaker primitive / unproven), 18 noise, 0 duplicate. 24 root-caused · 22 tier-2 verified.
Candidates
Verdict: 🔴 patch-now (RCE-class, attacker-reachable in default config) · 🟡 watch (security-relevant but not confirmed patch-now — gated, weaker primitive, or unproven) · ⚪ noise (structural false positive) · 🔁 dup (cherry-pick). ✔︎verified = passed independent adversarial tier-2 review; ~plausible = tier-2 could not fully confirm from the diff. Conf is confidence the commit is a genuine security fix.
| Verdict | Class | Conf | Sev | CVSS | Component | Commit | Primitive |
|---|---|---|---|---|---|---|---|
| 🔴 patch-now · ✔︎verified | UAF | 8.8 | third_party/blink/renderer/core/ |
b4daba3744 |
[M152] Add defensive copy in CollectFlattenedAssignedNodes | ||
| 🔴 patch-now · ✔︎verified | UAF | 8.1 | third_party/blink/renderer/core/ |
c319604d38 |
[M151] Sanitize presentation attribute cache hash using EnsureValidHash | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
0574afe5c9 |
[LNA] Add use counter for treat-as-public-address CSP header | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
0f2453fe77 |
Remove unused PageScheduler::IsMainFrameLocal() | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
1265f90ece |
[css-mixins] Fix @apply contents block brace serialization | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
12b7af59a2 |
[WebAudio]: Remove inner-loop check in ProcessInterpolatedPath | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
240ed2fa66 |
[CSS] Apply NUL replacement during identifier lookahead | ||
| 🟡 watch · ✔︎verified | IntegerOverflow | 4.8 | mojo/ |
53e38bbfa7 |
[M144-LTS] mojo: don’t overflow computation of channel read buffer size | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
5c460ad4be |
[M152] Fix android-binary-size test in merge CL: crrev.com/c/8179030 | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
6a2f2158da |
Remove zoom from SVGImage container scale | ||
| ⚪ noise | None | 0.0 | content/browser/ |
6aba37802c |
win: Fix crash in accessibility tests | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
79808f1b98 |
[M152] Make sure we don’t try lookup empty ids in SelectorQuery fast path | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
83eba3b4ca |
PA: Use MaxAllocationSize() |
||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
85b2d49195 |
Keep text-decoration fragment context cheap in the paint path | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
899fe20424 |
[CodeHealth] Resolve UNSAFE_TODO usages in XRSystem | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
962d8c917c |
Reset microtasks pauser when detaching the frame | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
a0db6501e8 |
[M151] Missing reset of pseudo_element for :nth-*(N of S) matching | ||
| 🟡 watch · ✔︎verified | UAF | 5.9 | services/ |
a10acf7b4d |
Fix race in HttpCacheDataRemover destruction | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
bc76d0648b |
Fix property tree update optimization links | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
c6f88ee2bd |
fix: ensure muted videos play back on desktop android | ||
| 🟡 watch · ✔︎verified | IntegerOverflow | 5.3 | third_party/blink/renderer/core/ |
c775e69845 |
Add overflow guard to FetchDataLoaderAsString | ||
| 🟡 watch · ~plausible | UAF | 7.5 | content/browser/ |
cc17d32870 |
Fix RenderWidgetHostViewAura UAF during shutdown | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
d848fe9ec9 |
Fix android-binary-size test in merge CL: https://crrev.com/c/8179030/5 | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
dcdb6fefe9 |
Fix some STL IWYU in //third_party/blink |