Chrome — 2026-W39
Clone-free silent-fix hunt over Chrome (Gerrit-sourced), 2026-09-21 → 2026-09-27. Every candidate
below is cherry-picked from the week’s merged security-relevant commits, triaged on
the patch-now / watch / noise ladder, given a full root-cause writeup, and
put through independent adversarial verification — the same bar as the WebKit
weekly reports.
This week. 22 candidates — 1 patch-now (RCE-class, attacker-reachable in default config), 7 watch (security-relevant but gated / weaker primitive / unproven), 14 noise, 0 duplicate. 22 root-caused · 22 tier-2 verified.
Candidates
Verdict: 🔴 patch-now (RCE-class, attacker-reachable in default config) · 🟡 watch (security-relevant but not confirmed patch-now — gated, weaker primitive, or unproven) · ⚪ noise (structural false positive) · 🔁 dup (cherry-pick). ✔︎verified = passed independent adversarial tier-2 review; ~plausible = tier-2 could not fully confirm from the diff. Conf is confidence the commit is a genuine security fix.
| Verdict | Class | Conf | Sev | CVSS | Component | Commit | Primitive |
|---|---|---|---|---|---|---|---|
| 🔴 patch-now · ✔︎verified | UAF | 8.8 | third_party/blink/renderer/core/ |
f9cea35d3e |
Ensure sufficient lifetime of WebViewImpl::page_popup_. | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
02a4e3a417 |
[FragmentedOofInCb] Break appeal inside OOFs should not propagate. | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
07c1f47353 |
WebGPU: Return transparent black in TransferToImageBitmap when unconfigured | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
08842a9896 |
[Blink] Replace CreateRecorder() with ConfigureRecorder() in BaseRC2D | ||
| 🟡 watch · ✔︎verified | UninitializedMemory | 6.5 | gpu/command_buffer/ |
0bdffe8ac0 |
Clamp pixel readback bounds on the renderer side | ||
| 🟡 watch · ✔︎verified | UAF | 6.3 | third_party/blink/renderer/core/ |
1d82312be9 |
[actor] Prevent UAF in ScriptTool and ModelContext | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
4185b1a580 |
[gap-decorations] Remove stale TODOs from GapDecorations code | ||
| ⚪ noise | None | 0.0 | gpu/command_buffer/ |
459760a9ba |
graphite: Guard bottom-left read pixels workaround with legacy flag | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
507619c53f |
[Blink] Reset recorder when resource provider init/recreation fails | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
78a6187cca |
Ensure MediaQueryExpValue::id_ is always initialized | ||
| ⚪ noise | DoS | 3.1 | third_party/blink/renderer/modules/ |
8789d86933 |
Fix NPE in non-coonfigured video encoder | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
a0982cf761 |
OfflineAudioDestinationHandler can render multiple times | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
a14f531e73 |
[blink] Use base::EnumSet for animated source properties | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
c49b809b82 |
[blink] Remove SyncToken check for automatic SyncToken mode | ||
| 🟡 watch · ✔︎verified | InfoDisclosure | 4.3 | third_party/blink/renderer/core/ |
c53fe9e04b |
[Autofill] Prevent textarea preview from leaking overflow geometry | ||
| 🟡 watch · ✔︎verified | UAF | 7.0 | content/browser/ |
c5c4b77965 |
Fix missing WebContentsImpl DetachDelegate | ||
| 🟡 watch · ✔︎verified | DoS | 3.1 | content/browser/ |
c9a9289d7a |
[Connection-Allowlist] Fix crash on navigation-triggered downloads. | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/modules/ |
d03168d311 |
[APC] Omit FormControlData::field_value for checkbox and radio inputs | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
d19ad54f43 |
[M155] Always allow attributionsrc in window.open() by default | ||
| 🟡 watch · ✔︎verified | UAF | 8.3 | content/browser/ |
e75c6ae03b |
[M152] bluetooth: Fix reentrancy UAF during ShowPermissionPrompt | ||
| ⚪ noise | None | 0.0 | third_party/blink/renderer/core/ |
eabf5dcf02 |
[Blink] Sort IDs prior to std::unique in timing collision tests | ||
| 🟡 watch · ~plausible | DoS | 3.1 | third_party/blink/renderer/core/ |
ede5159e83 |
Avoid crash in BoxPainterBase |