CVE-2026-17726

High watch ✔︎ verified CVSS 9.6 chrome Integer Overflow 🔧 Commit mapped 🧬 Trusting GPU driver quirks, clear state, or layout math

Overview

High

Severity

9.6

CVSS

Exploited ITW

Fixed

Fix Status

ImpactInteger overflow in WebGL

DescriptionInteger overflow in WebGL

ComponentWebGL

Sub-componentGL

Bug ClassInteger Overflow

Action tierwatch — corruption primitive but gated (uncommon) — not default-reachable — upheld by independent review by AI
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.

Independent review by AIConfirmed
Reviewer notes: Claims Mali-only/no other GL backends, but diff also enables the workaround for PowerVR (crashes on test). Diff cites only an OOB write; the 'and read' claim is unsupported. Requires a PBO sized for >=256MiB row pitch.
A second, independent AI reviewer (not a human) re-derived this analysis from the fixing commit and the vendor advisory, looking for errors.

Tracker529867799

Fix commit1ca561b41b1c (angle/angle) +86/-7

CWECWE-190 (Integer overflow)

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CISA KEVNot listed

CreditedGoogle

Reported2026-06-30 (per vendor advisory)

Fix landed2026-07-14 (public git)

Disclosed2026-07-29

Patch gap15 days — fix public in source before the advisory

Background

Pixel pack buffer: a GL buffer object bound to GL_PIXEL_PACK_BUFFER that receives pixel data written by glReadPixels; readback DMAs framebuffer contents into it.
Row pitch / `rowBytes`: the byte stride between consecutive pixel rows in the pack destination, computed by glFormat.computeRowPitch(...) in FramebufferGL::readPixels.
Stride in bits: Mali’s GLES driver derives the packing stride as row_length * bytes_per_pixel * 8, computed in a signed 32-bit int; 0x10000000 (256 MiB) is the pitch at which this multiply overflows.
`readPixelsRowByRow`: the fallback path that issues one packed read per row, avoiding a single call with a huge stride.

Root Cause Analysis

In FramebufferGL::readPixels, ANGLE forwards the caller-controlled row pitch to the Mali driver, which computes the internal pack stride as row_length * bytes_per_pixel * 8 using a 32-bit signed int. Once rowBytes reaches 0x10000000 (256 MiB), the multiply by 8 (to convert bytes to bits) overflows the 32-bit range and wraps to a small or negative value. The driver then uses this wrong, too-small stride to advance between rows while writing into the pixel pack buffer, so row offsets no longer correspond to the buffer the application sized for the true pitch. Because ANGLE validated the destination buffer against the correct large stride but the driver writes using the wrapped small stride, the resulting write/read lands out of bounds of the pack buffer.

The fix routes readback through readPixelsRowByRow whenever packBuffer && rowBytes >= 0x10000000u under the new packLargeRowLengthSeparatelyPackBuffer feature, so no single call ever passes the overflow-triggering stride to the driver.

Key insight

The vulnerability lives in the Mali driver’s 32-bit bits-per-stride arithmetic, not in ANGLE itself; ANGLE trusts the driver to honor a large pitch, but the driver silently wraps it, so the workaround must keep any single readback’s stride below the 256 MiB threshold.

Attack Path

Allocate oversized pack buffer On a Mali device, script WebGL to create a pixel pack buffer whose true row pitch is at least 256 MiB (large width and/or wide format).
Trigger readback Issue a glReadPixels that reaches FramebufferGL::readPixels with packBuffer bound and rowBytes >= 0x10000000u.
Driver stride wrap Mali computes row_length * bytes_per_pixel * 8 in int32, overflowing to a small stride that mismatches the buffer ANGLE sized for the real pitch.
Out-of-bounds access The driver writes packed rows using the wrapped stride, reading/writing past the pack buffer’s bounds, corrupting adjacent heap memory.

Impact Assessment

An integer overflow in Mali’s stride computation produces an out-of-bounds write (and read) into memory around the pixel pack buffer, reachable from WebGL content. On affected Mali GPUs this yields heap corruption that a remote page could leverage toward memory disclosure or code execution; the issue is Mali-only and does not affect other GL backends.

Changed Functions

Function	Change	Notes
`ReadPixelsPBODrawTest` src/tests/gl_tests/ReadPixelsTest.cpp	modified

Files Changed

include/platform/autogen/FeaturesGL_autogen.h
include/platform/gl_features.json
src/libANGLE/renderer/gl/FramebufferGL.cpp
src/libANGLE/renderer/gl/renderergl_utils.cpp
src/tests/angle_end2end_tests_expectations.txt
src/tests/gl_tests/ReadPixelsTest.cpp
util/autogen/angle_features_autogen.cpp

Audit Directions

Stride/pitch conversions to bits
Audit any driver or backend path that multiplies a byte pitch by 8 (or by bpp) in a fixed 32-bit int; large-but-legal dimensions can overflow before the destination is written.
Trusted-large-value handoffs
Where ANGLE validates a buffer against a correct large value but passes it to a driver that recomputes with narrower arithmetic, look for threshold-based workarounds that must cap or split the operation.
Other pack/unpack transfers
Check glReadPixels, texture uploads, and other DMA paths for the same 256 MiB / 0x10000000 boundary under Mali and similar drivers.

Patch

view commit

From 1ca561b41b1c5172b081937d95add84155073bcd Mon Sep 17 00:00:00 2001
From: Ken Russell <[email protected]>
Date: Wed, 08 Jul 2026 16:58:51 -0700
Subject: [PATCH] GL: workaround: pack large row lengths separately.

Apply this workaround to Mali GPUs. Add a stress test verifying the
workaround, which is skipped on Metal, Vulkan, and Intel OpenGL for
the time being.

Co-authored with Gemini.

Fixed: chromium:529867799
Change-Id: I32e0fce82e44335598a4fc5016c9311fa45f4c76
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/8067312
Reviewed-by: Shahbaz Youssefi <[email protected]>
Reviewed-by: Amirali Abdolrashidi <[email protected]>
Commit-Queue: Kenneth Russell <[email protected]>
---

diff --git a/include/platform/autogen/FeaturesGL_autogen.h b/include/platform/autogen/FeaturesGL_autogen.h
index a0f1e29..6b43b42 100644
--- a/include/platform/autogen/FeaturesGL_autogen.h
+++ b/include/platform/autogen/FeaturesGL_autogen.h
@@ -86,6 +86,12 @@
         &members,
     };
 
+    FeatureInfo packLargeRowLengthSeparatelyPackBuffer = {
+        "packLargeRowLengthSeparatelyPackBuffer",
+        FeatureCategory::OpenGLWorkarounds,
+        &members,
+    };
+
     FeatureInfo initializeCurrentVertexAttributes = {
         "initializeCurrentVertexAttributes",
         FeatureCategory::OpenGLWorkarounds,
diff --git a/include/platform/gl_features.json b/include/platform/gl_features.json
index 73fdf1d..79e0837 100644
--- a/include/platform/gl_features.json
+++ b/include/platform/gl_features.json
@@ -86,6 +86,15 @@
             ]
         },
         {
+            "name": "pack_large_row_length_separately_pack_buffer",
+            "category": "Workarounds",
+            "description": [
+                "When packing to a pixel pack buffer with a row pitch >= 256MiB, pack row by row.",
+                "Mali GLES computes stride in bits as int32; row_length*bpp*8 wraps at 0x10000000."
+            ],
+            "issue": "http://crbug.com/529867799"
+        },
+        {
             "name": "initialize_current_vertex_attributes",
             "category": "Workarounds",
             "description": [
diff --git a/src/libANGLE/renderer/gl/FramebufferGL.cpp b/src/libANGLE/renderer/gl/FramebufferGL.cpp
index 609e86b..abbf39c 100644
--- a/src/libANGLE/renderer/gl/FramebufferGL.cpp
+++ b/src/libANGLE/renderer/gl/FramebufferGL.cpp
@@ -792,22 +792,26 @@
         stateManager->getHasSeparateFramebufferBindings() ? GL_READ_FRAMEBUFFER : GL_FRAMEBUFFER;
     stateManager->bindFramebuffer(framebufferTarget, mFramebufferID);
 
+    const gl::InternalFormat &glFormat = gl::GetInternalFormatInfo(readFormat, readType);
+    GLuint rowBytes                    = 0;
+    ANGLE_CHECK_GL_MATH(contextGL,
+                        glFormat.computeRowPitch(readType, area.width, packState.alignment,
+                                                 packState.rowLength, &rowBytes));
+
     bool useOverlappingRowsWorkaround = features.packOverlappingRowsSeparatelyPackBuffer.enabled &&
                                         packBuffer && packState.rowLength != 0 &&
                                         packState.rowLength < clippedArea.width;
 
+    bool useLargeRowLengthWorkaround =
+        features.packLargeRowLengthSeparatelyPackBuffer.enabled && packBuffer &&
+        rowBytes >= 0x10000000u;  // Mali int32 stride-in-bits wrap threshold
+
     GLubyte *outPtr = static_cast<GLubyte *>(pixels);
     int leftClip    = clippedArea.x - area.x;
     int topClip     = clippedArea.y - area.y;
     if (leftClip || topClip)
     {
         // Adjust destination to match portion clipped off left and/or top.
-        const gl::InternalFormat &glFormat = gl::GetInternalFormatInfo(readFormat, readType);
-
-        GLuint rowBytes = 0;
-        ANGLE_CHECK_GL_MATH(contextGL,
-                            glFormat.computeRowPitch(readType, area.width, packState.alignment,
-                                                     packState.rowLength, &rowBytes));
         ANGLE_UNSAFE_TODO(outPtr += leftClip * glFormat.pixelBytes + topClip * rowBytes);
     }
 
@@ -825,7 +829,8 @@
     bool usePackSkipWorkaround = features.emulatePackSkipRowsAndPackSkipPixels.enabled &&
                                  (packState.skipRows != 0 || packState.skipPixels != 0);
 
-    if (cannotSetDesiredRowLength || useOverlappingRowsWorkaround || usePackSkipWorkaround)
+    if (cannotSetDesiredRowLength || useOverlappingRowsWorkaround || useLargeRowLengthWorkaround ||
+        usePackSkipWorkaround)
     {
         return readPixelsRowByRow(context, clippedArea, format, readFormat, readType, packState,
                                   outPtr);
diff --git a/src/libANGLE/renderer/gl/renderergl_utils.cpp b/src/libANGLE/renderer/gl/renderergl_utils.cpp
index 9d84d2e..92597d3 100644
--- a/src/libANGLE/renderer/gl/renderergl_utils.cpp
+++ b/src/libANGLE/renderer/gl/renderergl_utils.cpp
@@ -2403,6 +2403,13 @@
 
     ANGLE_FEATURE_CONDITION(features, unpackOverlappingRowsSeparatelyUnpackBuffer, isNvidia);
     ANGLE_FEATURE_CONDITION(features, packOverlappingRowsSeparatelyPackBuffer, isNvidia);
+    // Mali GLES computes readPixels row_stride as (int32_t)(row_length*bpp)*8;
+    // wraps negative when the byte pitch >= 0x10000000 -> OOB write into the
+    // PBO's cmem mapping. Route through readPixelsRowByRow so Mali only ever
+    // sees PACK_ROW_LENGTH=0. Also apply to Imagination GPUs which crash on
+    // the new test. crbug.com/529867799
+    ANGLE_FEATURE_CONDITION(features, packLargeRowLengthSeparatelyPackBuffer,
+                            isMali || IsPowerVR(vendor));
 
     std::array<int, 2> powerVRVersion = {0, 0};
     bool isPowerVRDriver =
diff --git a/src/tests/angle_end2end_tests_expectations.txt b/src/tests/angle_end2end_tests_expectations.txt
index 41fc454..9b93783 100644
--- a/src/tests/angle_end2end_tests_expectations.txt
+++ b/src/tests/angle_end2end_tests_expectations.txt
@@ -2783,6 +2783,10 @@
 // Unimplemented parts.
 515493666 D3D11 : Restart/DrawElementsVariantsTest.Draw/* = SKIP
 
+529867799 METAL : ReadPixelsPBOTest.PackLargeRowLength/* = SKIP
+529867799 VULKAN : ReadPixelsPBOTest.PackLargeRowLength/* = SKIP
+529867799 INTEL OPENGL : ReadPixelsPBOTest.PackLargeRowLength/* = SKIP
+
 // !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
 // Slow tests, should appear last in this file
 // !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
diff --git a/src/tests/gl_tests/ReadPixelsTest.cpp b/src/tests/gl_tests/ReadPixelsTest.cpp
index 217abca..16be449 100644
--- a/src/tests/gl_tests/ReadPixelsTest.cpp
+++ b/src/tests/gl_tests/ReadPixelsTest.cpp
@@ -775,6 +775,52 @@
     ASSERT_GL_NO_ERROR();
 }
 
+// Test that readPixels with a large PACK_ROW_LENGTH into a PBO does not overflow int32 stride
+// calculation. Ported from crbug.com/528175330 / crbug.com/529867799.
+TEST_P(ReadPixelsPBOTest, PackLargeRowLength)
+{
+    reset(16, 8, 8);
+
+    const GLColor kExpectedColor(65, 128, 192, 255);
+    constexpr GLint kLargeRowLength          = 0x7fffffc;
+    constexpr GLsizeiptr kByteOffsetToVerify = 0x1ffffff0;
+    constexpr GLsizeiptr kBufferSize         = kByteOffsetToVerify + 256;
+
+    glBindBuffer(GL_PIXEL_PACK_BUFFER, mPBO);
+    glBufferData(GL_PIXEL_PACK_BUFFER, kBufferSize, nullptr, GL_STREAM_READ);
+    ANGLE_SKIP_TEST_IF(glGetError() == GL_OUT_OF_MEMORY);
+    ASSERT_GL_NO_ERROR();
+
+    glClearColor(kExpectedColor.R / 255.0f, kExpectedColor.G / 255.0f, kExpectedColor.B / 255.0f,
+                 kExpectedColor.A / 255.0f);
+    glClear(GL_COLOR_BUFFER_BIT);
+
+    glPixelStorei(GL_PACK_ROW_LENGTH, kLargeRowLength);
+    glPixelStorei(GL_PACK_ALIGNMENT, 4);
+    glReadPixels(0, 0, 1, 2, GL_RGBA, GL_UNSIGNED_BYTE, nullptr);
+    EXPECT_GL_NO_ERROR();
+
+    void *mappedPtr = glMapBufferRange(GL_PIXEL_PACK_BUFFER, 0, kBufferSize, GL_MAP_READ_BIT);
+    ASSERT_NE(nullptr, mappedPtr);
+
+    const GLColor *colorPtr = static_cast<const GLColor *>(mappedPtr);
+    GLColor actualColorRow0;
+    GLColor actualColorRow1;
+
+    // Check row 0 pixel (at byte offset 0)
+    actualColorRow0 = colorPtr[0];
+
+    // Check row 1 pixel (at byte offset kByteOffsetToVerify)
+    constexpr size_t kRow1OffsetInPixels = kByteOffsetToVerify / sizeof(GLColor);
+    // SAFETY: test-only code.
+    ANGLE_UNSAFE_BUFFERS(actualColorRow1 = colorPtr[kRow1OffsetInPixels]);
+
+    glUnmapBuffer(GL_PIXEL_PACK_BUFFER);
+
+    EXPECT_EQ(kExpectedColor, actualColorRow0);
+    EXPECT_EQ(kExpectedColor, actualColorRow1);
+}
+
 class ReadPixelsPBODrawTest : public ReadPixelsPBOTest
 {
   protected:
diff --git a/util/autogen/angle_features_autogen.cpp b/util/autogen/angle_features_autogen.cpp
index cfcf801..0869671 100644
--- a/util/autogen/angle_features_autogen.cpp
+++ b/util/autogen/angle_features_autogen.cpp
@@ -261,6 +261,7 @@
     {Feature::MutableMipmapTextureUpload, "mutableMipmapTextureUpload"},
     {Feature::NoperspectiveInterpolationBrokenWithPassthroughShaders, "noperspectiveInterpolationBrokenWithPassthroughShaders"},

Loading diff…

Regression Test / PoC

shipped with the fix

diff --git a/src/tests/angle_end2end_tests_expectations.txt b/src/tests/angle_end2end_tests_expectations.txt
index 41fc454..9b93783 100644
--- a/src/tests/angle_end2end_tests_expectations.txt
+++ b/src/tests/angle_end2end_tests_expectations.txt
@@ -2783,6 +2783,10 @@
 // Unimplemented parts.
 515493666 D3D11 : Restart/DrawElementsVariantsTest.Draw/* = SKIP
 
+529867799 METAL : ReadPixelsPBOTest.PackLargeRowLength/* = SKIP
+529867799 VULKAN : ReadPixelsPBOTest.PackLargeRowLength/* = SKIP
+529867799 INTEL OPENGL : ReadPixelsPBOTest.PackLargeRowLength/* = SKIP
+
 // !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
 // Slow tests, should appear last in this file
 // !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
diff --git a/src/tests/gl_tests/ReadPixelsTest.cpp b/src/tests/gl_tests/ReadPixelsTest.cpp
index 217abca..16be449 100644
--- a/src/tests/gl_tests/ReadPixelsTest.cpp
+++ b/src/tests/gl_tests/ReadPixelsTest.cpp
@@ -775,6 +775,52 @@
     ASSERT_GL_NO_ERROR();
 }
 
+// Test that readPixels with a large PACK_ROW_LENGTH into a PBO does not overflow int32 stride
+// calculation. Ported from crbug.com/528175330 / crbug.com/529867799.
+TEST_P(ReadPixelsPBOTest, PackLargeRowLength)
+{
+    reset(16, 8, 8);
+
+    const GLColor kExpectedColor(65, 128, 192, 255);
+    constexpr GLint kLargeRowLength          = 0x7fffffc;
+    constexpr GLsizeiptr kByteOffsetToVerify = 0x1ffffff0;
+    constexpr GLsizeiptr kBufferSize         = kByteOffsetToVerify + 256;
+
+    glBindBuffer(GL_PIXEL_PACK_BUFFER, mPBO);
+    glBufferData(GL_PIXEL_PACK_BUFFER, kBufferSize, nullptr, GL_STREAM_READ);
+    ANGLE_SKIP_TEST_IF(glGetError() == GL_OUT_OF_MEMORY);
+    ASSERT_GL_NO_ERROR();
+
+    glClearColor(kExpectedColor.R / 255.0f, kExpectedColor.G / 255.0f, kExpectedColor.B / 255.0f,
+                 kExpectedColor.A / 255.0f);
+    glClear(GL_COLOR_BUFFER_BIT);
+
+    glPixelStorei(GL_PACK_ROW_LENGTH, kLargeRowLength);
+    glPixelStorei(GL_PACK_ALIGNMENT, 4);
+    glReadPixels(0, 0, 1, 2, GL_RGBA, GL_UNSIGNED_BYTE, nullptr);
+    EXPECT_GL_NO_ERROR();
+
+    void *mappedPtr = glMapBufferRange(GL_PIXEL_PACK_BUFFER, 0, kBufferSize, GL_MAP_READ_BIT);
+    ASSERT_NE(nullptr, mappedPtr);
+
+    const GLColor *colorPtr = static_cast<const GLColor *>(mappedPtr);
+    GLColor actualColorRow0;
+    GLColor actualColorRow1;
+
+    // Check row 0 pixel (at byte offset 0)
+    actualColorRow0 = colorPtr[0];
+
+    // Check row 1 pixel (at byte offset kByteOffsetToVerify)
+    constexpr size_t kRow1OffsetInPixels = kByteOffsetToVerify / sizeof(GLColor);
+    // SAFETY: test-only code.
+    ANGLE_UNSAFE_BUFFERS(actualColorRow1 = colorPtr[kRow1OffsetInPixels]);
+
+    glUnmapBuffer(GL_PIXEL_PACK_BUFFER);
+
+    EXPECT_EQ(kExpectedColor, actualColorRow0);
+    EXPECT_EQ(kExpectedColor, actualColorRow1);
+}
+
 class ReadPixelsPBODrawTest : public ReadPixelsPBOTest
 {
   protected:

Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.

References

Vendor advisory Fix commit Bug tracker NVD

On This Page