Chrome · GPU
CVE-2026-106275
Uninitialized Memory in GPU
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
gpu/command_buffer/service/gles2_cmd_clear_framebuffer.cc
Patch
From 2e9bb0c975af539af5efea89311c1582d79bd8e1 Mon Sep 17 00:00:00 2001 From: Brandon Jones <[email protected]> Date: Thu, 03 Sep 2026 16:45:43 -0700 Subject: [PATCH] Disable additional state before framebuffer clear. Disabled some additional GL state that has the potential to interfere with the draw call performed in ClearFramebufferResourceManager::ClearFramebuffer. This state is already reverted in the existing decoder->RestoreGlobalState(); call. Fixed: 514460295 Change-Id: Ib9111c1bf77e6b87f1543b65a61a4808d941e4bd Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8350479 Reviewed-by: Kai Ninomiya <[email protected]> Auto-Submit: Brandon Jones <[email protected]> Commit-Queue: Brandon Jones <[email protected]> Cr-Commit-Position: refs/heads/main@{#1692040} --- diff --git a/gpu/command_buffer/service/gles2_cmd_clear_framebuffer.cc b/gpu/command_buffer/service/gles2_cmd_clear_framebuffer.cc index b043781..ca87112 100644 --- a/gpu/command_buffer/service/gles2_cmd_clear_framebuffer.cc +++ b/gpu/command_buffer/service/gles2_cmd_clear_framebuffer.cc @@ -4,6 +4,7 @@ #include "gpu/command_buffer/service/gles2_cmd_clear_framebuffer.h" +#include "gpu/command_buffer/service/feature_info.h" #include "gpu/command_buffer/service/gl_utils.h" #include "gpu/command_buffer/service/gles2_cmd_decoder.h" #include "gpu/command_buffer/service/shader_manager.h" @@ -166,6 +167,11 @@ glDisable(GL_CULL_FACE); glDisable(GL_BLEND); glDisable(GL_POLYGON_OFFSET_FILL); + glDisable(GL_SAMPLE_ALPHA_TO_COVERAGE); + glDisable(GL_SAMPLE_COVERAGE); + if (decoder->GetFeatureInfo()->IsES3Capable()) { + glDisable(GL_RASTERIZER_DISCARD); + } glViewport(0, 0, max_viewport_size.width(), max_viewport_size.height()); glDrawArrays(GL_TRIANGLE_FAN, 0, 4);
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page