`libaom`

the AOMedia reference AV1 codec library, vendored into Chromium at third_party/libaom/source/libaom and pinned to an exact upstream commit.

`DEPS` roll

a Chromium change that only moves a third-party dependency’s pinned revision; the actual code fix lives in the upstream repository and is not part of the Chromium diff.

`src_sad_blk_64x64`

per the subject of the associated Chromium merge commit (“Restrict src_sad_blk_64x64 to single spatial layer”), a libaom encoder buffer of per-64x64-block source SAD (sum of absolute differences) values; its sizing and indexing are not visible in this diff.

Spatial layers (SVC)

scalable encoding in which one stream carries several resolutions, so per-frame buffers sized for one layer’s dimensions may not fit another layer’s (inferred relevance).

1. Reach the AV1 encoder Content drives libaom encoding inside Chrome, for example through WebRTC or WebCodecs AV1 encoding (inferred; the diff does not show which Chromium entry points use libaom).
2. Request spatial scalability The attacker configures an encode with more than one spatial layer, which the merge subject names as the condition the fix removes (inferred).
3. Trigger the source-SAD path Encoding frames under that configuration makes the encoder compute or read src_sad_blk_64x64 entries outside the bounds of the buffer, producing the heap overflow named by the advisory (inferred; the exact sink is not in the diff).
4. Memory corruption The out-of-bounds access corrupts heap memory in the process hosting the encoder. Any further exploitation is not shown (inferred).

• DEPS
• third_party/libaom/README.chromium
• third_party/libaom/source/libaom

• Per-layer buffer sizing in SVC encoders
  In libaom (and libvpx’s equivalent real-time paths), check every per-block side buffer (SAD maps, content/scene-detection arrays, cyclic-refresh maps) for whether it is allocated at one resolution but indexed using the current spatial layer’s mi_rows/mi_cols or 64x64 block counts.
• Feature gating as a bounds fix
  When a fix disables a feature for some configurations instead of correcting the index math, look for other configurations (resolution changes mid-stream, dynamic layer changes, scalabilityMode reconfiguration) that reach the same buffer with mismatched dimensions.
• Rolls that hide the fix
  For third_party CVEs fixed through DEPS, map the rolled range to upstream commits and diff them directly; also check every Chromium branch’s pin (the bug was merged to several branch heads) for the same exposure.

Crash with three-way self Jitsi Meet call