Chrome · WebGL › GL
CVE-2026-103628
OOB in WebGL (GL)
Overview
Critical
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
src/libANGLE/renderer/gl/renderergl_utils.cppsrc/libANGLE/renderer/gl/TextureGL.cppinclude/platform/gl_features.json
Patch
From cdea97f48c9fcdad495c4c9a3fff95afbc3f29c9 Mon Sep 17 00:00:00 2001 From: Brandon Jones <[email protected]> Date: Tue, 15 Sep 2026 14:09:44 -0700 Subject: [PATCH] GL: Change mipmap workaround from flush to forcefullyFlush An existing workaround for IMG GPUs inserts a flush prior to any generateMipmaps calls, but a separate issue was discovered with the same GPUs that requires a forced flush or finish to resolve. Updates the flush to a forcefullyFlush to ensure that the issue is avoided. Bug: chromium:549995090 Change-Id: Ifd7d45b9fcf26f4755730c770e9dae5e84688f52 Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/8414369 Reviewed-by: Geoff Lang <[email protected]> Reviewed-by: Kenneth Russell <[email protected]> Auto-Submit: Brandon Jones <[email protected]> Commit-Queue: Shahbaz Youssefi <[email protected]> --- diff --git a/include/platform/gl_features.json b/include/platform/gl_features.json index 82506cf..2a90427 100644 --- a/include/platform/gl_features.json +++ b/include/platform/gl_features.json @@ -977,7 +977,7 @@ "description": [ "Force a flush before calling generateMipmap to work around driver bugs." ], - "issue": "http://crbug.com/549350408" + "issue": "http://crbug.com/549350408 https://crbug.com/549995090" }, { "name": "split_level_0_pbo_full_sub_image_2D", diff --git a/src/libANGLE/renderer/gl/TextureGL.cpp b/src/libANGLE/renderer/gl/TextureGL.cpp index 71fb6e7..0ae680b 100644 --- a/src/libANGLE/renderer/gl/TextureGL.cpp +++ b/src/libANGLE/renderer/gl/TextureGL.cpp @@ -1844,9 +1844,8 @@ if (features.flushBeforeGenerateMipmap.enabled) { - // Force a flush before generating the mipmap, which avoids a bad state in the IMG driver if - // the texture's base level is still bound to an active FBO. - ANGLE_GL_TRY(context, functions->flush()); + // Force a flush before generating the mipmap, which avoids bad states in the IMG driver. + ANGLE_GL_TRY(context, stateManager->forcefullyFlush()); } stateManager->bindTexture(getType(), mTextureID); diff --git a/src/libANGLE/renderer/gl/renderergl_utils.cpp b/src/libANGLE/renderer/gl/renderergl_utils.cpp index 558a872..060321a 100644 --- a/src/libANGLE/renderer/gl/renderergl_utils.cpp +++ b/src/libANGLE/renderer/gl/renderergl_utils.cpp @@ -2758,8 +2758,7 @@ // Disable EXT_clear_texture entirely on IMG as a speculative fix for driver crashes. ANGLE_FEATURE_CONDITION(features, disableClearTexture, IsPowerVR(vendor)); - // Forces a flush before generating a mipmap, which avoids a bad state in the IMG driver if - // the texture's base level is still bound to an active FBO. + // Forces a flush before generating a mipmap, which avoids bad states in the IMG driver. ANGLE_FEATURE_CONDITION(features, flushBeforeGenerateMipmap, IsPowerVR(vendor)); // IMG GL drivers crash while compiling shaders with more than the limit of uniform blocks.
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page