CVE-2026-14049

Overview

Low

Severity

5.3

CVSS

No

Exploited ITW

Fixed

Fix Status

ImpactInappropriate implementation in GPU

DescriptionInappropriate implementation in GPU

ComponentGPU

Bug ClassLogic Error

Action tierwatch — information disclosure — security-relevant, below the RCE-class bar
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.

Tracker501659888

Fix commita4438e332666 (chromium/src) +1/-6

CWECWE-200 (Information exposure)

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

CISA KEVNot listed

CreditedGoogle

Reported2026-04-11 (per vendor advisory)

Fix landed2026-05-19 (public git)

Disclosed2026-06-30

Patch gap42 days — fix public in source before the advisory

Background

`gpu::gles2::Logger`: the GPU-process helper that formats and emits GL error/log messages for a command-buffer decoder context.
`this_in_hex_`: a std::string member that pre-formatted the logger object’s own this heap address as hex into a fallback log prefix.
`GetLogPrefix()`: the method that returns the string prepended to GL log messages, using the current debug marker or, if empty, the fallback prefix.
ASLR: Address Space Layout Randomization, the mitigation that makes heap/code addresses unpredictable to hinder exploitation.

Root Cause Analysis

The Logger constructor built this_in_hex_ by formatting reinterpret_cast<uintptr_t>(this) into a string, and GetLogPrefix() returned that string whenever the debug marker was empty. Because GL error logs are observable to web content (e.g., via console/error surfaces), this leaked the logger object’s live heap address to the renderer/attacker, providing a deterministic ASLR bypass for the GPU process. The prefix logic existed only to work around a since-closed bug (crbug.com/242999), so the fix removes the this_in_hex_ member and its constructor formatting, and rewrites GetLogPrefix() to simply return debug_marker_manager_->GetMarker(). With no pointer ever embedded in log output, the information-disclosure primitive is eliminated.

Key insight

The single mistake was embedding a raw this heap pointer into attacker-observable GL log output; the fix deletes this_in_hex_ and returns only the debug marker from GetLogPrefix(), removing the address leak.

Attack Path

Trigger an empty-marker GL error Web content drives WebGL/GPU operations that generate a synthesized GL error/log while no debug marker is set, so GetLogPrefix() falls back to this_in_hex_.
Leak the pointer The emitted log prefix contains the hex this address of the GPU-process Logger object, which the attacker reads from the observable error/log output.
Defeat ASLR The disclosed heap address lets the attacker compute GPU-process layout, providing a deterministic ASLR bypass.
Aid further exploitation The leaked address can be combined with a separate memory-corruption bug to build a reliable exploit (inferred); this patch addresses only the disclosure.

Impact Assessment

An attacker running web content gains a deterministic leak of a GPU-process heap address, defeating ASLR in that process and easing exploitation of a separate memory-corruption vulnerability. The precondition is the ability to trigger GL error logging that reaches observable output while no debug marker is present. The advisory classifies this as inappropriate implementation in GPU (an information disclosure / ASLR bypass); any chained code execution is (inferred) and no exploited-in-the-wild status is stated.

Changed Functions

Function	Change	Notes
`disable_gl_error_limit_` gpu/command_buffer/service/logger.cc	modified

Files Changed

gpu/command_buffer/service/logger.cc
gpu/command_buffer/service/logger.h

Audit Directions

Pointers in log/error strings
Grep for reinterpret_cast<uintptr_t>(this), %p, and pointer formatting that flows into any log, error, or exception message reachable by web content.
Attacker-observable diagnostic output
Audit GPU/renderer diagnostic and console-error paths for embedded addresses or other layout-revealing values.
Stale workaround code
Review prefix/fallback logic tied to closed bug references (like crbug.com/242999) that may still expose sensitive data after the original defect was fixed.

Patch

view commit

From a4438e3326664624b9190b95e6ddeeab2b3cccd8 Mon Sep 17 00:00:00 2001
From: Arthur Sonzogni <[email protected]>
Date: Tue, 19 May 2026 07:21:34 -0700
Subject: [PATCH] Remove this_in_hex_ from gpu::gles2::Logger

The gpu::gles2::Logger class was leaking its heap address in GL error
logs by including its 'this' pointer in the fallback prefix string. This
provided a deterministic heap ASLR bypass for the GPU process.

The underlying bug is closed (crbug.com/242999), so this prefix logic
is no longer required. This patch removes the 'this_in_hex_' member and
its associated formatting code.

Bug: 41013722
Fixed: 501659888
Change-Id: I32b49c87eeaaea9c4c8c45a8fe97784b20e75f82
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7852758
Reviewed-by: Corentin Wallez <[email protected]>
Auto-Submit: Arthur Sonzogni <[email protected]>
Commit-Queue: Corentin Wallez <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1632839}
---

diff --git a/gpu/command_buffer/service/logger.cc b/gpu/command_buffer/service/logger.cc
index 3e100cb4..6b8f706 100644
--- a/gpu/command_buffer/service/logger.cc
+++ b/gpu/command_buffer/service/logger.cc
@@ -23,9 +23,6 @@
       log_message_count_(0),
       log_synthesized_gl_errors_(true),
       disable_gl_error_limit_(disable_gl_error_limit) {
-  this_in_hex_ =
-      base::StringPrintf("GroupMarkerNotSet(crbug.com/242999)!:%" PRIXPTR,
-                         reinterpret_cast<uintptr_t>(this));
   suppress_performance_logs_ =
       base::CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kSuppressPerformanceLogs);
@@ -56,8 +53,7 @@
 }
 
 const std::string& Logger::GetLogPrefix() const {
-  const std::string& prefix(debug_marker_manager_->GetMarker());
-  return prefix.empty() ? this_in_hex_ : prefix;
+  return debug_marker_manager_->GetMarker();
 }
 
 bool Logger::SuppressPerformanceLogs() const {
diff --git a/gpu/command_buffer/service/logger.h b/gpu/command_buffer/service/logger.h
index 4830a453..6818a79 100644
--- a/gpu/command_buffer/service/logger.h
+++ b/gpu/command_buffer/service/logger.h
@@ -52,7 +52,6 @@
   // Uses the current marker to add information to logs.
   raw_ptr<const DebugMarkerManager> debug_marker_manager_;
   const LogMessageCallback log_message_callback_;
-  std::string this_in_hex_;
 
   int log_message_count_;
   bool log_synthesized_gl_errors_;

Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.

References

Vendor advisory Fix commit Bug tracker NVD