Skip to content

Chrome advisory parsing failed if no bounty amount listed #35

Description

@ahanwate

$ psirt-advisory https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html

Could not find impact; skipping: Security Fixes and RewardsNote: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projectssimilarly depend on, but haven’t yet fixed.This update includes 1 security fix. Below, we highlight fixes that were contributed by external researchers. Please see the Chrome Security Page for more information.[NA][427663123] High CVE-2025-6554: Type Confusion in V8. Reported by Clément Lecigne of Google's Threat Analysis Group on 2025-06-25.This issue was mitigated on 2025-06-26 by a configuration changepushed out to Stable channel across all platforms.Google is aware that an exploit for CVE-2025-6554 exists in the wild.Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.Krishna GovindGoogle Chrome

The root cause is advisory_text = re.sub(r"(.)\[\$", r"\1\n[$", advisory_text)

To resolve this we need to simply remove the $ from both the pattern and the replacement string in the re.sub call.

advisory_text = re.sub(r"(.)\[", r"\1\n[", advisory_text)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions