Chrome — 2026-W40
Clone-free silent-fix hunt over Chrome (Gerrit-sourced), 2026-09-28 → 2026-10-04. Every candidate
below is cherry-picked from the week’s merged security-relevant commits, triaged on
the patch-now / watch / noise ladder, given a full root-cause writeup, and
put through independent adversarial verification — the same bar as the WebKit
weekly reports.
This week. 24 candidates — 10 patch-now (RCE-class, attacker-reachable in default config), 4 watch (security-relevant but gated / weaker primitive / unproven), 10 noise, 0 duplicate. 11 root-caused · 11 tier-2 verified.
Candidates
Verdict: 🔴 patch-now (RCE-class, attacker-reachable in default config) · 🟡 watch (security-relevant but not confirmed patch-now — gated, weaker primitive, or unproven) · ⚪ noise (structural false positive) · 🔁 dup (cherry-pick). ✔︎verified = passed independent adversarial tier-2 review; ~plausible = tier-2 could not fully confirm from the diff. Conf is confidence the commit is a genuine security fix.
| Verdict | Class | Conf | Sev | CVSS | Component | Commit | Primitive |
|---|---|---|---|---|---|---|---|
| 🔴 patch-now · ✔︎verified | UAF | 0.97 | high | — | net/ |
5343c336cd |
use-after-free of goaway_fields_/this after visitor_->OnGoAway destructs the framer |
| 🔴 patch-now · ✔︎verified | UAF | 0.96 | high | — | net/ |
457776ec7c |
re-entrant QueryComplete frees the request object while outer frames execute (UAF) |
| 🔴 patch-now · ✔︎verified | UAF | 0.93 | high | — | content/browser/ |
f97c3791aa |
synchronous ResumeProcessing re-enters ProcessConditions and frees a condition/NavigationRequest still referenced by an outer frame (UAF) |
| 🔴 patch-now · ✔︎verified | UAF | 0.9 | high | — | third_party/blink/renderer/core/ |
280ca3161b |
dangling AtomicString& into attribute storage reallocated by Trusted Types default policy |
| 🔴 patch-now · ~plausible | UAF | 0.9 | high | — | third_party/blink/renderer/core/ |
57e51ecf9c |
WebViewImpl::page_popup_ freed by a callback during Cancel/Close/Update, leaving dangling this |
| 🔴 patch-now · ✔︎verified | UAF | 0.9 | high | — | third_party/blink/renderer/core/ |
67f6fef1e4 |
dangling unique_ptr& slot in pattern_map_ cleared during BuildPatternData |
| 🔴 patch-now · ✔︎verified | UAF | 0.9 | high | — | third_party/blink/renderer/core/ |
fa43f62504 |
dangling unique_ptr& slot in pattern_map_ cleared during BuildPatternData |
| 🔴 patch-now · ✔︎verified | OOB-read | 0.85 | medium | — | media/ |
c96fd4426c |
attacker-controlled CameraMetadataEntry.count/type reinterpreted over a smaller byte buffer -> OOB heap read |
| 🔴 patch-now · ✔︎verified | UAF | 0.85 | medium | — | third_party/blink/renderer/core/ |
e886fddb58 |
dangling ClientEntry& into clients_ hash map rehashed by FindCycle() |
| 🔴 patch-now · ✔︎verified | UAF | 0.75 | medium | — | third_party/blink/renderer/modules/ |
3635198d8f |
raw_ptr to non-GCed base of GCed RTCIceTransport invisible to Oilpan |
| 🟡 watch | UAF | 0.65 | medium | — | third_party/blink/renderer/core/ |
e3754d9289 |
raw_ptr to non-GCed base of GCed RemoteFrame invisible to Oilpan |
| 🟡 watch · ~plausible | LogicError | 0.6 | medium | — | third_party/blink/renderer/core/ |
0f12a22f12 |
use-after-close of AnimationFrameTimingMonitor via stale CoreProbeSink registration |
| 🟡 watch | InputValidation | 0.55 | medium | — | gpu/command_buffer/ |
65c300b6ec |
invalid/null GpuFence handle: null-GLFence deref, bad FD to eglCreateSyncKHR, FD leak on failure |
| 🟡 watch | LogicError | 0.45 | low | — | third_party/blink/renderer/core/ |
b6610de43b |
null-pointer dereference of CanvasNon2DResourceProvider::Create() result |
| ⚪ noise | NotSecurity | 0.13 | low | — | services/ |
cb795fd9ae |
latent dangling ptr in USB transfer/device sets |
| ⚪ noise | NotSecurity | 0.12 | dev | — | — |
076207ce1b |
latent dangling raw ptr in test-shell window list |
| ⚪ noise | NotSecurity | 0.12 | low | — | services/ |
38aa622625 |
none attacker-reachable — crash-on-bus-loss made graceful + test-harness lifetime rework |
| ⚪ noise | NotSecurity | 0.1 | dev | — | third_party/blink/renderer/core/ |
76b175b583 |
none (no-op raw_ptr trait in release) |
| ⚪ noise | NotSecurity | 0.1 | dev | — | third_party/blink/renderer/core/ |
79367b82f7 |
none (no-op raw_ptr trait in release) |
| ⚪ noise | NotSecurity | 0.07 | dev | — | media/ |
b71bb73b3d |
none (latency optimization) |
| ⚪ noise | NotSecurity | 0.06 | dev | — | third_party/blink/renderer/modules/ |
d85a6668d8 |
none |
| ⚪ noise | NotSecurity | 0.05 | dev | — | third_party/blink/renderer/modules/ |
102c6a1ee4 |
none — semantics-preserving refactor |
| ⚪ noise | NotSecurity | 0.05 | dev | — | third_party/blink/renderer/core/ |
2c21589df5 |
none (defers a non-fatal CHECK) |
| ⚪ noise | NotSecurity | 0.04 | dev | — | third_party/blink/renderer/core/ |
053f234ce5 |
none |