The vulnerability is in ANGLE’s Metal backend CPU mipmap generation, TextureMtl::generateMipmapCPU in TextureMtl.mm. When a texture format is non-renderable (so mip levels cannot be generated on the GPU), ANGLE falls back to a CPU path that, for each destination mip level, calls the format’s mipGenerationFunction to downsample the previous level.

The bug is that the depth argument passed to mipGenerationFunction was hard-coded to the constant 1 rather than the previous level’s actual depth (prevLevelDepth). For a 3D texture, mip levels are reduced in width, height, AND depth, but depth reduces on its own schedule; when the depth dimension has more mip levels than width/height (e.g. a 1x1x2 texture, where width and height are already 1 at level 0 but depth still halves to 1 at level 1), the previous level’s depth can be greater than 1. By telling the downsampling function that the source depth is 1 when it is actually 2 (or more), the generation function reads/writes the wrong number of depth slices relative to the real source and destination buffers described by prevLevelDepthPitch/dstDepthPitch, producing an out-of-bounds access (the previous level’s data buffer has more than one slice worth of data, but only one slice’s worth is accounted for, or the reduction across depth slices is skipped). The invariant violated is that the width/height/depth passed to the mip-generation kernel must describe the actual dimensions of the source level’s data buffer.

The fix replaces the literal 1 with prevLevelDepth so the depth passed matches the previous level’s real depth, restoring correct bounds and correct depth reduction.

The added regression test MipmapsForTexture3DNonRenderableMoreMipLevelsInDepthNoCrash creates exactly this shape: a 1x1x2 GL_ALPHA (non-renderable) 3D texture and calls glGenerateMipmap, asserting it does not crash and that level 1 contains the depth-averaged value (102 ~ average of 5 and 200), confirming the previous code both mis-bounded and failed to average across depth.

The patch shows an out-of-bounds access in CPU mipmap generation for 3D textures with non-renderable formats, reachable from WebGL2 content and running in the sandboxed GPU process. Because the incorrect depth (1 vs actual prevLevelDepth) drives buffer indexing in the downsampling kernel, the primitive is a heap out-of-bounds read and/or write over texture level buffers whose sizes and contents are partly attacker-controlled; the demonstrated and advertised outcome is a crash (denial of service in the GPU process). Escalation of an OOB heap access toward memory corruption or information disclosure is conceivable in principle but is not established by the diff, which only asserts non-crashing and correct depth averaging. The fault is confined to the GPU process sandbox, not the WebContent process.