High chrome Integer Overflow 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInteger overflow in WebGL
DescriptionInteger overflow in WebGL
ComponentWebGL
Sub-componentGPU
Bug ClassInteger Overflow
Tracker546630009
Fix commitffa67bc6b5b0 (chromium/src) +12/-0
CISA KEVNot listed
CreditedGoogle
Disclosed2026-10-06

Files Changed

  • gpu/config/gpu_driver_bug_list.json
From ffa67bc6b5b0d34e75eec39e6e961b29b08bdf4e Mon Sep 17 00:00:00 2001
From: Ken Russell <[email protected]>
Date: Fri, 11 Sep 2026 07:52:02 -0700
Subject: [PATCH] GPU: enable adjust_src_dst_region_for_blitframebuffer on Mali.

The adjust_src_dst_region_for_blitframebuffer workaround added some
time ago is needed on Mali GPUs as well.

Bug: 546630009
Change-Id: I73f55414ab5d43fbb48a724685d17d56b95d7eca
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8395847
Commit-Queue: Geoff Lang <[email protected]>
Reviewed-by: Geoff Lang <[email protected]>
Auto-Submit: Kenneth Russell <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1696236}
---
diff --git a/gpu/config/gpu_driver_bug_list.json b/gpu/config/gpu_driver_bug_list.json
index 0804efc..5a120c8 100644
--- a/gpu/config/gpu_driver_bug_list.json
+++ b/gpu/config/gpu_driver_bug_list.json
@@ -3956,6 +3956,18 @@
       "features": [
         "recreate_mipmap_levels_before_generate"
       ]
+    },
+    {
+      "id": 499,
+      "description": "adjust src/dst region if blitting pixels outside framebuffer on Android Mali",
+      "cr_bugs": [546630009],
+      "os": {
+        "type": "android"
+      },
+      "gl_vendor": "ARM.*",
+      "features": [
+        "adjust_src_dst_region_for_blitframebuffer"
+      ]
     }
   ]
 }
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.