Low chrome Uninitialized Memory 🔧 Commit mapped

Overview

Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactUninitialized resource in GPU
DescriptionUninitialized resource in GPU
ComponentGPU
Bug ClassUninitialized Memory
Tracker514460295
Fix commit2e9bb0c975af (chromium/src) +6/-0
CISA KEVNot listed
CreditedGoogle
Disclosed2026-10-06

Files Changed

  • gpu/command_buffer/service/gles2_cmd_clear_framebuffer.cc
From 2e9bb0c975af539af5efea89311c1582d79bd8e1 Mon Sep 17 00:00:00 2001
From: Brandon Jones <[email protected]>
Date: Thu, 03 Sep 2026 16:45:43 -0700
Subject: [PATCH] Disable additional state before framebuffer clear.

Disabled some additional GL state that has the potential to
interfere with the draw call performed in
ClearFramebufferResourceManager::ClearFramebuffer. This state is
already reverted in the existing decoder->RestoreGlobalState();
call.

Fixed: 514460295
Change-Id: Ib9111c1bf77e6b87f1543b65a61a4808d941e4bd
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8350479
Reviewed-by: Kai Ninomiya <[email protected]>
Auto-Submit: Brandon Jones <[email protected]>
Commit-Queue: Brandon Jones <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1692040}
---
diff --git a/gpu/command_buffer/service/gles2_cmd_clear_framebuffer.cc b/gpu/command_buffer/service/gles2_cmd_clear_framebuffer.cc
index b043781..ca87112 100644
--- a/gpu/command_buffer/service/gles2_cmd_clear_framebuffer.cc
+++ b/gpu/command_buffer/service/gles2_cmd_clear_framebuffer.cc
@@ -4,6 +4,7 @@
 
 #include "gpu/command_buffer/service/gles2_cmd_clear_framebuffer.h"
 
+#include "gpu/command_buffer/service/feature_info.h"
 #include "gpu/command_buffer/service/gl_utils.h"
 #include "gpu/command_buffer/service/gles2_cmd_decoder.h"
 #include "gpu/command_buffer/service/shader_manager.h"
@@ -166,6 +167,11 @@
   glDisable(GL_CULL_FACE);
   glDisable(GL_BLEND);
   glDisable(GL_POLYGON_OFFSET_FILL);
+  glDisable(GL_SAMPLE_ALPHA_TO_COVERAGE);
+  glDisable(GL_SAMPLE_COVERAGE);
+  if (decoder->GetFeatureInfo()->IsES3Capable()) {
+    glDisable(GL_RASTERIZER_DISCARD);
+  }
 
   glViewport(0, 0, max_viewport_size.width(), max_viewport_size.height());
   glDrawArrays(GL_TRIANGLE_FAN, 0, 4);
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.