Chrome · Skia › Ganesh
CVE-2026-119271
UAF in Skia (Ganesh)
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
src/gpu/ganesh/gl/GrGLCaps.cpp
Patch
From ab9b798555a6cc38e7adeacb86ca6a99c5be5819 Mon Sep 17 00:00:00 2001 From: Michael Ludwig <[email protected]> Date: Mon, 26 Oct 2026 11:07:50 -0400 Subject: [PATCH] [ganesh] Don't set texImageFormat for BGRA as RGBx GrGLCaps already set fExternalTexImageFormat = 0 (disabling writes) when using BGRA8 texture with the RGBA8 color type. However, BGRA8 as RGBx8 was configured to allow writes with RGBA8 data. This is allowed for GL but not GLES. For consistency with BGRA-as-RGBA, this treats BGRA-as-RGBx the same (instead of branching on the GL standard). Bug: b/577403270 Change-Id: I70d01796f508139b5c62b735b1e2e18e32c6d612 Reviewed-on: https://skia-review.googlesource.com/c/skia/+/1405636 Commit-Queue: Greg Daniel <[email protected]> Auto-Submit: Michael Ludwig <[email protected]> Reviewed-by: Greg Daniel <[email protected]> --- diff --git a/src/gpu/ganesh/gl/GrGLCaps.cpp b/src/gpu/ganesh/gl/GrGLCaps.cpp index 7232d90..0a185ea 100644 --- a/src/gpu/ganesh/gl/GrGLCaps.cpp +++ b/src/gpu/ganesh/gl/GrGLCaps.cpp @@ -2196,7 +2196,7 @@ auto& ioFormat = ctInfo.fExternalIOFormats[ioIdx++]; ioFormat.fColorType = GrColorType::kRGB_888x; ioFormat.fExternalType = GR_GL_UNSIGNED_BYTE; - ioFormat.fExternalTexImageFormat = GR_GL_RGBA; + ioFormat.fExternalTexImageFormat = 0; ioFormat.fExternalReadFormat = GR_GL_RGBA; } }
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page