CVE-2026-5281

2026/06/27：この脆弱性は公開されています。パッチの箇所は異なりますが、全体的な手法とトリガーパスは私のPoCと完全に同一です。

Chromium コミット```

commit e00a64ead1abef9447943efede7bc26362ac3797 (HEAD -> 146.0.7680.71, tag: 146.0.7680.71) Author: Roger McFarlane [email protected] Date: Mon Mar 9 12:52:01 2026 -0700

[M146-desktop-respin] Make LimitedLayerEntropyCostTracker time-aware.

This change modifies the LimitedLayerEntropyCostTracker to account for
the entropy cost of studies that are active at a specific evaluation
time. The evaluation time is passed to the tracker's constructor and is
used to check against the study's filter dates and Google web visibility
dates.

The current time for entropy evaluation is sourced from
VariationsIdsProvider.

(cherry picked from commit 2ec2c50b47686def251947a2675a207863803cac)

Bug: 490248046, 490432663
Change-Id: I3174730f35b037d533bf10b2b1d0531e3781acfe
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7639358
Reviewed-by: Alexei Svitkine <[email protected]>
Commit-Queue: Alexei Svitkine <[email protected]>
Cr-Original-Commit-Position: refs/heads/main@{#1595543}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7637760
Bot-Commit: Rubber Stamper <[email protected]>
Cr-Commit-Position: refs/branch-heads/7680_65@{#23}
Cr-Branched-From: efe36a9d42443b4091a5be1be21e93ceff9b7a5e-refs/branch-heads/7680@{#1898}
Cr-Branched-From: 76b7d80e5cda23fe6537eed26d68c92e995c7f39-refs/heads/main@{#1582197}

## ビルド引数```
# Set build arguments here. See `gn help buildargs`.
is_official_build = false
is_debug = false
is_asan = true
symbol_level = 0
v8_symbol_level = 0
blink_symbol_level = 0
is_component_build = false
proprietary_codecs = true
ffmpeg_branding = "Chrome"
v8_enable_sandbox = true
dcheck_always_on = false
optimize_webui = true
target_os = "linux"
target_cpu = "x64"

ASAN ログ```

================================================================= ==1780424==ERROR: AddressSanitizer: heap-use-after-free on address 0x76ca5a1351d0 at pc 0x5c3a49a29eea bp 0x7ffc5ece7110 sp 0x7ffc5ece7108 READ of size 8 at 0x76ca5a1351d0 thread T0 (chrome) #0 0x5c3a49a29ee9 in dawn::wire::server::Server::DoAdapterRequestDevice(dawn::wire::server::Known<WGPUAdapterImpl*>, dawn::wire::ObjectHandle, WGPUFuture, dawn::wire::ObjectHandle, WGPUFuture, WGPUDeviceDescriptor const*)::$_0::__invoke(WGPUDeviceImpl* const*, WGPUErrorType, WGPUStringView, void*, void*) ServerAdapter.cpp #1 0x5c3a2b68ef0b in dawn::native::DeviceBase::HandleError(std::__Cr::unique_ptr<dawn::native::ErrorData, std::__Cr::default_deletedawn::native::ErrorData>, dawn::native::InternalErrorType, wgpu::DeviceLostReason, dawn::native::DeviceBase::ForwardToErrorScope) Device.cpp #2 0x5c3a2b79f46d in dawn::native::QueueBase::APIWriteBuffer(dawn::native::BufferBase*, unsigned long, void const*, unsigned long) Queue.cpp #3 0x5c3a2b52b9be in dawn::native::NativeQueueWriteBuffer(WGPUQueueImpl*, WGPUBufferImpl*, unsigned long, void const*, unsigned long) ProcTable.cpp #4 0x5c3a49a3c449 in dawn::wire::server::Server::DoQueueWriteBuffer(dawn::wire::server::Known<WGPUQueueImpl*>, dawn::wire::server::Known<WGPUBufferImpl*>, unsigned long, unsigned char const*, unsigned long) ServerQueue.cpp #5 0x5c3a49a1c14a in dawn::wire::server::Server::HandleQueueWriteBuffer(dawn::wire::DeserializeBuffer*) ServerHandlers_autogen.cpp #6 0x5c3a49a201f9 in dawn::wire::server::Server::HandleCommands(char const volatile*, unsigned long) ServerHandlers_autogen.cpp #7 0x5c3a499db517 in gpu::webgpu::(anonymous namespace)::DawnWireServer::HandleCommands(char const volatile*, unsigned long) webgpu_decoder_impl.cc #8 0x5c3a499db98d in gpu::webgpu::(anonymous namespace)::WebGPUDecoderImpl::HandleDawnCommands(unsigned int, void const volatile*) webgpu_decoder_impl.cc #9 0x5c3a499cf882 in gpu::webgpu::(anonymous namespace)::WebGPUDecoderImpl::DoCommands(unsigned int, void const volatile*, int, int*) webgpu_decoder_impl.cc #10 0x5c3a32edce84 in gpu::CommandBufferService::Flush(int, gpu::AsyncAPIInterface*) command_buffer_service.cc #11 0x5c3a491024ab in gpu::CommandBufferStub::OnAsyncFlush(int, unsigned int, std::__Cr::vector<gpu::SyncToken, std::__Cr::allocatorgpu::SyncToken> const&) command_buffer_stub.cc #12 0x5c3a49101711 in gpu::CommandBufferStub::ExecuteDeferredRequest(gpu::mojom::DeferredCommandBufferRequestParams&, gpu::FenceSyncReleaseDelegate*) command_buffer_stub.cc #13 0x5c3a4912483c in gpu::GpuChannel::ExecuteDeferredRequest(mojo::StructPtrgpu::mojom::DeferredRequestParams, gpu::FenceSyncReleaseDelegate*) gpu_channel.cc #14 0x5c3a49132b97 in void base::internal::DecayedFunctorTraits<void (gpu::GpuChannel::)(mojo::StructPtrgpu::mojom::DeferredRequestParams, gpu::FenceSyncReleaseDelegate), base::WeakPtrgpu::GpuChannel&&, mojo::StructPtrgpu::mojom::DeferredRequestParams&&>::Invoke<void (gpu::GpuChannel::)(mojo::StructPtrgpu::mojom::DeferredRequestParams, gpu::FenceSyncReleaseDelegate), base::WeakPtrgpu::GpuChannel const&, mojo::StructPtrgpu::mojom::DeferredRequestParams, gpu::FenceSyncReleaseDelegate*>(void (gpu::GpuChannel::)(mojo::StructPtrgpu::mojom::DeferredRequestParams, gpu::FenceSyncReleaseDelegate), base::WeakPtrgpu::GpuChannel const&, mojo::StructPtrgpu::mojom::DeferredRequestParams&&, gpu::FenceSyncReleaseDelegate*&&) gpu_channel.cc #15 0x5c3a49132979 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::GpuChannel::&&)(mojo::StructPtrgpu::mojom::DeferredRequestParams, gpu::FenceSyncReleaseDelegate), base::WeakPtrgpu::GpuChannel&&, mojo::StructPtrgpu::mojom::DeferredRequestParams&&>, base::internal::BindState<true, true, false, void (gpu::GpuChannel::)(mojo::StructPtrgpu::mojom::DeferredRequestParams, gpu::FenceSyncReleaseDelegate), base::WeakPtrgpu::GpuChannel, mojo::StructPtrgpu::mojom::DeferredRequestParams>, void (gpu::FenceSyncReleaseDelegate*)>::RunOnce(base::internal::BindStateBase*, gpu::FenceSyncReleaseDelegate*) gpu_channel.cc #16 0x5c3a32f1f831 in void base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>&&, gpu::FenceSyncReleaseDelegate*>, base::internal::BindState<false, true, true, base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>, base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunImpl<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>, std::__Cr::tuple<base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, 0ul>(base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>&&, std::__Cr::tuple<base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, std::__Cr::integer_sequence<unsigned long, 0ul>) task_graph.cc #17 0x5c3a32ef3f77 in gpu::Scheduler::ExecuteSequence(base::IdType<gpu::SyncPointOrderData, unsigned int, 0u, 1u>) scheduler.cc #18 0x5c3a32ef1fa8 in gpu::Scheduler::RunNextTask() scheduler.cc #19 0x5c3a32ef5b91 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::Scheduler::&&)(), gpu::Scheduler>, base::internal::BindState<true, true, false, void (gpu::Scheduler::)(), base::internal::UnretainedWrapper<gpu::Scheduler, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase) scheduler.cc #20 0x5c3a3f89be16 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) task_annotator.cc #21 0x5c3a3f913257 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) thread_controller_with_message_pump_impl.cc