# Async callback outlives native object

Raw this/pointers captured in async replies, observers, or threads that can fire after teardown

_Area: Memory corruption and native code. Seen in 5 disclosed reports; 3 confirmed bounties, median $8,000, range $2,000-$215,000; latest 2022-10-17. Updated 2026-11-02._

## How it works
A native object hands a raw pointer (often `this`) to something that runs later: a posted task with a reply, an observer registration, a timer or counter thread, a stack array of sub-message pointers. The object is then freed by navigation, dialog close, tab/window teardown, or an early error path. The deferred code still runs and dereferences the freed pointer. The broken assumption is "the object I captured will still be alive when this runs." Nothing enforces that unless the code holds a reference or cancels the callback on destruction.

## Where it shows up
- `PostTaskAndReply` / posted closures capturing `this` without a weak pointer or cancellation token.
- `AddObserver` without a matching `RemoveObserver` on the same lifecycle path.
- Iterators or frame vectors used after `end()` checks are skipped or invalidated mid-loop.
- Multi-message handlers with a stack array of raw sub-message pointers, some slots conditionally replaced by retained reply pointers.
- Separate timing/counter threads that outlive the media object or page.
- Parsers that free a stream/handle on an error path then keep using it.
- Fork-overridden methods that shadow an upstream fix.

## How to review
For every deferred callback, name the object it touches and the event that frees that object. The invariant: either the callback holds a strong reference for its whole run, or destruction cancels/weakens it, and every acquire has a matching release on every path. Check observer add/remove symmetry, that iterator loops re-validate after mutation, and that error paths do not free a handle still in use. In forks, diff overridden methods against upstream to see if a fix was bypassed.

## How finders spotted it
- Hunted fork-specific UI features and closed tabs/windows/dialogs mid-operation, moved dialogs between windows, deleted data while bubbles showed; re-tested upstream-fixed bugs against fork-overridden methods, and used AST queries for iterator dereferences [E1](https://bugbountylibrary.com/r/blog%3Amicrosoftedge-github-io-edgevr-posts-memory-corruption-vulnerabilities-in-edge.md).
- Found in-the-wild chains, then audited the XPC multi-message handler; noted the dual use of one stack buffer as a weird primitive a manual audit would catch [E2](https://bugbountylibrary.com/r/p0%3ACVE-2019-7286.md).
- Saw random crashes poking a new portal element, added its grammar to a fuzzer, got browser-process crashes within an hour [E3](https://bugbountylibrary.com/r/blog%3Ablog-redteam-pl-2019-12-chrome-portal-element-fuzzing-html.md).

## Variants seen
- Browser-process UAF/OOB from async dialogs and observers [E1](https://bugbountylibrary.com/r/blog%3Amicrosoftedge-github-io-edgevr-posts-memory-corruption-vulnerabilities-in-edge.md).
- XPC handler stack buffer mixing raw and retained pointers, with `xpc_release` on a reference never taken [E2](https://bugbountylibrary.com/r/p0%3ACVE-2019-7286.md).
- Portal navigation dereferencing a freed object after page reload [E3](https://bugbountylibrary.com/r/blog%3Ablog-redteam-pl-2019-12-chrome-portal-element-fuzzing-html.md).
- Media counter thread outliving a freed NetStream on malformed MP4 [E4](https://bugbountylibrary.com/r/h1%3A30567.md).
- EXIF parser using a stream after `_php_stream_free` [E5](https://bugbountylibrary.com/r/h1%3A371135.md).

## Impact and severity
Crashes to memory corruption and code execution; E2 chained a sandbox escape with a kernel UAF for renderer-to-kernel reach [E2](https://bugbountylibrary.com/r/p0%3ACVE-2019-7286.md). Browser-process bugs [E1](https://bugbountylibrary.com/r/blog%3Amicrosoftedge-github-io-edgevr-posts-memory-corruption-vulnerabilities-in-edge.md)[E3](https://bugbountylibrary.com/r/blog%3Ablog-redteam-pl-2019-12-chrome-portal-element-fuzzing-html.md) and parser UAFs [E4](https://bugbountylibrary.com/r/h1%3A30567.md)[E5](https://bugbountylibrary.com/r/h1%3A371135.md) raise severity when reachable from untrusted input.

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **Microsoft Edge** (web app install dialog) (version not stated): Guest Blog Post - Memory corruption vulnerabilities in Edge. Report: https://bugbountylibrary.com/r/blog%3Amicrosoftedge-github-io-edgevr-posts-memory-corruption-vulnerabilities-in-edge.md
- **Apple iOS** (cfprefsd multi-message handler) iOS 12-12.1, fixed in iOS 12.1.4: CVE-2019-7286: iOS use-after-free in cfprefsd (CVE-2019-7286). Report: https://bugbountylibrary.com/r/p0%3ACVE-2019-7286.md
- **PHP**: CVE-2018-12882: heap-use-after-free in PHP 7.2 through 7.2.6, possible 7.2.7 (CVE-2018-12882). Report: https://bugbountylibrary.com/r/h1%3A371135.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Amicrosoftedge-github-io-edgevr-posts-memory-corruption-vulnerabilities-in-edge.md
- E2: https://bugbountylibrary.com/r/p0%3ACVE-2019-7286.md
- E3: https://bugbountylibrary.com/r/blog%3Ablog-redteam-pl-2019-12-chrome-portal-element-fuzzing-html.md
- E4: https://bugbountylibrary.com/r/h1%3A30567.md
- E5: https://bugbountylibrary.com/r/h1%3A371135.md