Chrome · Skia
CVE-2026-17771
Uninitialized Memory in Skia
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
TEST_Fash/fullscreen_pixeltest.cc |
modified | |
LoginShelfWithPolicyWallpaperPixelTestWithRTLash/shelf/login_shelf_view_pixeltest.cc |
modified | |
TEST_Pash/shelf/scrollable_shelf_view_pixeltest.cc |
modified |
Files Changed
ash/app_list/views/app_list_view_pixeltest.ccash/fullscreen_pixeltest.ccash/shelf/login_shelf_view_pixeltest.ccash/shelf/scrollable_shelf_view_pixeltest.cc
Patch
From 51373fd7ec6b0e257019a51548266b35d8e12f30 Mon Sep 17 00:00:00 2001 From: Michael Ludwig <[email protected]> Date: Thu, 04 Jun 2026 14:03:21 -0700 Subject: [PATCH] [skia] Enable safe inset for linear sampled texture clamping NOTE TO SHERIFF's: Please do not revert if jobs not on the CQ are failing because of golden image or web test failures that just need to be updated. They should be fixed forward. This changes the shader clamp detection to use an inset that is just shy of a full half pixel to prevent ambiguity in bilinear sampling landing on an exact pixel center. This leads to very slight, imperceptible pixel diffs in layout tests, pixel tests, and ash tests that involve blurs. This CL rebases these golden images with a few things to call out: 1. Several ash pixel tests were not configured to generate a unique test name depending on the system blur property. This led to radically different golden images being assigned to the same "test" in Gold. These now generate an appropriate name. 2. The tolerances for bypass_texture_backdrop_extent renderer test was increased so that the shared golden image could be used for both ganesh and graphite-enabled tests instead of updating it to have two separate golden images. 3. For a reason I could not identify, the fuchsia+angle+swiftshader started to render incorrectly for Pixel_ReflectedDiv, drawing what you'd expect if it just weren't animating at all. Given the screenshot is captured by the OS, I suspect that switching to shader-based clamping is rendering quite slowly when run through swiftshader on the bot. I could not reproduce the rendering failure on real devices. As such, I triaged it as incorrect and updated the pixel expectations for it. Bug: 513160525 Change-Id: I050c03353b252b2a57b658bac8354c2d703fb94b Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7869108 Reviewed-by: Robert Phillips <[email protected]> Commit-Queue: Michael Ludwig <[email protected]> Reviewed-by: Vasiliy Telezhnikov <[email protected]> SLSA-Policy-Verified: SLSA Policy Verification Service <[email protected]> Cr-Commit-Position: refs/heads/main@{#1641927} --- diff --git a/ash/app_list/views/app_list_view_pixeltest.cc b/ash/app_list/views/app_list_view_pixeltest.cc index 255d5d6d..637c063 100644 --- a/ash/app_list/views/app_list_view_pixeltest.cc +++ b/ash/app_list/views/app_list_view_pixeltest.cc @@ -192,7 +192,7 @@ UseFixedPlaceholderTextAndHideCursor(test_helper->GetSearchBoxView()); EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen( GenerateScreenshotName("bubble_launcher_answer_card_search_results"), - /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 19 : 1, + /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 20 : 1, GetAppListTestHelper()->GetBubbleView(), GetPrimaryShelf()->navigation_widget())); } @@ -215,7 +215,7 @@ UseFixedPlaceholderTextAndHideCursor(test_helper->GetSearchBoxView()); EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen( GenerateScreenshotName("bubble_launcher_url_search_results"), - /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 18 : 1, + /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 19 : 1, GetAppListTestHelper()->GetBubbleView(), GetPrimaryShelf()->navigation_widget())); } @@ -252,7 +252,7 @@ GetAppListTestHelper()->GetSearchBoxView()); EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen( GenerateScreenshotName("bubble_launcher_basics"), - /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 21 : 1, + /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 22 : 1, GetAppListTestHelper()->GetBubbleView(), GetPrimaryShelf()->navigation_widget())); } @@ -275,7 +275,7 @@ EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen( GenerateScreenshotName("bubble_launcher_gradient_zone"), - /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 21 : 1, + /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 22 : 1, GetAppListTestHelper()->GetBubbleView(), GetPrimaryShelf()->navigation_widget())); } @@ -291,7 +291,7 @@ EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen( GenerateScreenshotName("bubble_launcher_gemini_button"), - /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 4 : 1, + /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 5 : 1, GetAppListTestHelper()->GetBubbleView(), GetPrimaryShelf()->navigation_widget())); } diff --git a/ash/fullscreen_pixeltest.cc b/ash/fullscreen_pixeltest.cc index 6871d105..3c2a3dc 100644 --- a/ash/fullscreen_pixeltest.cc +++ b/ash/fullscreen_pixeltest.cc @@ -23,7 +23,8 @@ // Verifies the primary fullscreen of an active user session. TEST_F(FullscreenPixelTest, VerifyDefaultPrimaryDisplay) { EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen( - "primary_display", /*revision_number=*/9, Shell::GetPrimaryRootWindow())); + "primary_display", /*revision_number=*/10, + Shell::GetPrimaryRootWindow())); } } // namespace ash diff --git a/ash/shelf/login_shelf_view_pixeltest.cc b/ash/shelf/login_shelf_view_pixeltest.cc index 4b0cba38..6ae7eab 100644 --- a/ash/shelf/login_shelf_view_pixeltest.cc +++ b/ash/shelf/login_shelf_view_pixeltest.cc @@ -68,29 +68,29 @@ aura::Window* primary_shelf_window = GetPrimaryShelf()->GetWindow(); PressAndReleaseKey(ui::VKEY_TAB); EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen( - "focus_on_login_user_expand_button", - /*revision_number=*/13, primary_big_user_view_.get(), + GenerateScreenshotName("focus_on_login_user_expand_button"), + /*revision_number=*/0, primary_big_user_view_.get(), primary_shelf_window)); // Trigger the tab key. Check that the login shelf shutdown button is focused. PressAndReleaseKey(ui::VKEY_TAB); EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen( - "focus_on_shutdown_button", - /*revision_number=*/13, primary_big_user_view_.get(), + GenerateScreenshotName("focus_on_shutdown_button"), + /*revision_number=*/0, primary_big_user_view_.get(), primary_shelf_window)); // Trigger the tab key. Check that the browser as guest button is focused. PressAndReleaseKey(ui::VKEY_TAB); EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen( - "focus_on_browser_as_guest_button", - /*revision_number=*/13, primary_big_user_view_.get(), + GenerateScreenshotName("focus_on_browser_as_guest_button"), + /*revision_number=*/0, primary_big_user_view_.get(), primary_shelf_window)); // Trigger the tab key. Check that the add person button is focused. PressAndReleaseKey(ui::VKEY_TAB); EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen( - "focus_on_add_person_button", - /*revision_number=*/13, primary_big_user_view_.get(), + GenerateScreenshotName("focus_on_add_person_button"), + /*revision_number=*/0, primary_big_user_view_.get(), primary_shelf_window)); } @@ -104,22 +104,22 @@ aura::Window* primary_shelf_window = GetPrimaryShelf()->GetWindow(); EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen( - "focus_on_calendar_view", - /*revision_number=*/10, primary_shelf_window)); + GenerateScreenshotName("focus_on_calendar_view"), + /*revision_number=*/0, primary_shelf_window)); // Focus on the time view. PressAndReleaseKey(ui::VKEY_TAB); EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen( - "focus_on_time_view.rev_0", - /*revision_number=*/10, primary_shelf_window)); + GenerateScreenshotName("focus_on_time_view.rev_0"), + /*revision_number=*/0, primary_shelf_window)); PressAndReleaseKey(ui::VKEY_TAB, ui::EF_SHIFT_DOWN); PressAndReleaseKey(ui::VKEY_TAB, ui::EF_SHIFT_DOWN); // Move the focus back to the add person button. EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen( - "refocus_on_login_shelf", - /*revision_number=*/10, primary_shelf_window)); + GenerateScreenshotName("refocus_on_login_shelf"), + /*revision_number=*/0, primary_shelf_window)); } class LoginShelfWithPolicyWallpaperPixelTestWithRTL diff --git a/ash/shelf/scrollable_shelf_view_pixeltest.cc b/ash/shelf/scrollable_shelf_view_pixeltest.cc index d3a6fe8..480ec659 100644 --- a/ash/shelf/scrollable_shelf_view_pixeltest.cc +++ b/ash/shelf/scrollable_shelf_view_pixeltest.cc @@ -52,7 +52,7 @@ TEST_P(ScrollableShelfViewPixelRTLTest, Basics) { EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen( GenerateScreenshotName("overflow"), - /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 11 : 0, + /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 12 : 0, GetPrimaryShelf()->GetWindow())); ASSERT_TRUE(scrollable_shelf_view_->right_arrow()); @@ -64,7 +64,7 @@ EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen( GenerateScreenshotName("overflow_end"), - /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 11 : 0, + /*revision_number=*/pixel_test_helper()->IsSystemBlurEnabled() ? 12 : 0, GetPrimaryShelf()->GetWindow()));
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/components/test/data/viz/bypass_texture_backdrop_extent.png b/components/test/data/viz/bypass_texture_backdrop_extent.png index 07ac826..f2140f4 100644 --- a/components/test/data/viz/bypass_texture_backdrop_extent.png +++ b/components/test/data/viz/bypass_texture_backdrop_extent.png Binary files differ diff --git a/content/test/content_test_bundle_data.filelist b/content/test/content_test_bundle_data.filelist index 24ec47a7..9e3cc9c 100644 --- a/content/test/content_test_bundle_data.filelist +++ b/content/test/content_test_bundle_data.filelist @@ -7801,7 +7801,6 @@ data/gpu/meet_effects/meet-gpu-tests/release/assets/rainbow_wig_and_eyelashes_4320e727bc3e93838b16ee409b041d35.wasm.data data/gpu/meet_effects/meet-gpu-tests/release/assets/rainbow_wig_and_eyelashes_5c8a35f8e9aeb15a737d16307ab8a3aa.zip data/gpu/meet_effects/meet-gpu-tests/release/assets/rainbow_wig_and_eyelashes_d427110d3ae5eca7f33221205b23575c.metadata.jspb -data/gpu/meet_effects/meet-gpu-tests/release/assets/rio_selfiesegmentation_darwinn_exec_d46eb6ae52e7b125129300761d693b5e.metadata.jspb data/gpu/meet_effects/meet-gpu-tests/release/assets/segm_full_sparse_v1008_0bda82336d236e21e52f2b74129b9883.dat data/gpu/meet_effects/meet-gpu-tests/release/assets/segm_gpu_hd_v1093_bd6bd17c2cf0b7f4f6753685523caa08.dat data/gpu/meet_effects/meet-gpu-tests/release/assets/segm_quantized_v3346_c5b35537731c3939ac5514f4edbea539.dat @@ -7831,7 +7830,6 @@ data/gpu/meet_effects/meet-gpu-tests/release/assets/selfiesegmentation_tpu_512_3138_4ad1bc3b5d81b441d9ad4dff7ffb0e40.f16.abrolhos.metadata.jspb data/gpu/meet_effects/meet-gpu-tests/release/assets/selfiesegmentation_tpu_512_3138_56a05a46169c1922089a8eb47b21e218.f16.wasm.data data/gpu/meet_effects/meet-gpu-tests/release/assets/selfiesegmentation_tpu_512_3138_7a160e14443e5f65ef532adc94c1bbdc.f16.janeiro.metadata.jspb -data/gpu/meet_effects/meet-gpu-tests/release/assets/selfiesegmentation_tpu_512_3138_7fb384efb53da537e32f6b4a7f807dd6.stablehlo.husky.metadata.jspb data/gpu/meet_effects/meet-gpu-tests/release/assets/triggers_xref_35037371ae2008ccd89389d157d7798c.xnxr.wasm.data data/gpu/meet_effects/meet-gpu-tests/release/assets/triggers_xref_d5c1210c15445cc5aed66de2c15261bd.xnxr.zip data/gpu/meet_effects/meet-gpu-tests/release/assets/triggers_xref_f55a5953c7cabbbc5bfcfbfe3035c5a1.xnxr.metadata.jspb diff --git a/content/test/gpu/gpu_tests/test_expectations/pixel_expectations.txt b/content/test/gpu/gpu_tests/test_expectations/pixel_expectations.txt index d3c3993cd..586df21 100644 --- a/content/test/gpu/gpu_tests/test_expectations/pixel_expectations.txt +++ b/content/test/gpu/gpu_tests/test_expectations/pixel_expectations.txt @@ -469,6 +469,7 @@ crbug.com/40935289 [ angle-vulkan arm fuchsia web-engine-shell ] Pixel_Video_MP4_FourColors_Rot_90 [ Failure ] crbug.com/40935289 [ angle-vulkan arm fuchsia web-engine-shell ] Pixel_Video_MP4_Rounded_Corner [ Failure ] crbug.com/40935289 [ angle-vulkan arm fuchsia no-clang-coverage web-engine-shell ] Pixel_Video_VP9 [ Failure ] +crbug.com/519220175 [ angle-swiftshader fuchsia web-engine-shell ] Pixel_ReflectedDiv [ Failure ] # Flaky on Mac ASAN crbug.com/372055518 [ angle-metal asan mac ] Pixel_WebGLReadPixelsTabSwitch_SoftwareCompositing [ Failure ] diff --git a/third_party/blink/web_tests/compositing/culling/filter-occlusion-blur-large-expected.png b/third_party/blink/web_tests/compositing/culling/filter-occlusion-blur-large-expected.png index f4d0c666..ba0b9bdc 100644 --- a/third_party/blink/web_tests/compositing/culling/filter-occlusion-blur-large-expected.png +++ b/third_party/blink/web_tests/compositing/culling/filter-occlusion-blur-large-expected.png Binary files differ diff --git a/third_party/blink/web_tests/compositing/overflow/mask-with-filter-expected.png b/third_party/blink/web_tests/compositing/overflow/mask-with-filter-expected.png index 6167415..41adb49 100644 --- a/third_party/blink/web_tests/compositing/overflow/mask-with-filter-expected.png +++ b/third_party/blink/web_tests/compositing/overflow/mask-with-filter-expected.png Binary files differ diff --git a/third_party/blink/web_tests/css3/filters/effect-all-on-background-hw-expected.png b/third_party/blink/web_tests/css3/filters/effect-all-on-background-hw-expected.png index 89eaec29..1784bcb 100644 --- a/third_party/blink/web_tests/css3/filters/effect-all-on-background-hw-expected.png +++ b/third_party/blink/web_tests/css3/filters/effect-all-on-background-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/css3/filters/effect-blur-hw-expected.png b/third_party/blink/web_tests/css3/filters/effect-blur-hw-expected.png index ea141ef3..128b984 100644 --- a/third_party/blink/web_tests/css3/filters/effect-blur-hw-expected.png +++ b/third_party/blink/web_tests/css3/filters/effect-blur-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/css3/filters/effect-reference-hidpi-hw-expected.png b/third_party/blink/web_tests/css3/filters/effect-reference-hidpi-hw-expected.png index 700ffc1..0e20ebd7 100644 --- a/third_party/blink/web_tests/css3/filters/effect-reference-hidpi-hw-expected.png +++ b/third_party/blink/web_tests/css3/filters/effect-reference-hidpi-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/css3/filters/effect-reference-ordering-hw-expected.png b/third_party/blink/web_tests/css3/filters/effect-reference-ordering-hw-expected.png index e543bfd..45143ce0 100644 --- a/third_party/blink/web_tests/css3/filters/effect-reference-ordering-hw-expected.png +++ b/third_party/blink/web_tests/css3/filters/effect-reference-ordering-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/css3/filters/effect-reference-zoom-hw-expected.png b/third_party/blink/web_tests/css3/filters/effect-reference-zoom-hw-expected.png index 673efbc..1a17562 100644 --- a/third_party/blink/web_tests/css3/filters/effect-reference-zoom-hw-expected.png +++ b/third_party/blink/web_tests/css3/filters/effect-reference-zoom-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/css3/filters/filter-change-repaint-composited-expected.png b/third_party/blink/web_tests/css3/filters/filter-change-repaint-composited-expected.png index 4336d14b..b68a2b4 100644 --- a/third_party/blink/web_tests/css3/filters/filter-change-repaint-composited-expected.png +++ b/third_party/blink/web_tests/css3/filters/filter-change-repaint-composited-expected.png Binary files differ diff --git a/third_party/blink/web_tests/css3/filters/filter-change-repaint-expected.png b/third_party/blink/web_tests/css3/filters/filter-change-repaint-expected.png index bc91ff5c..b77e93a 100644 --- a/third_party/blink/web_tests/css3/filters/filter-change-repaint-expected.png +++ b/third_party/blink/web_tests/css3/filters/filter-change-repaint-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/highdpi/compositing/backface-visibility/backface-visibility-image-expected.png b/third_party/blink/web_tests/flag-specific/highdpi/compositing/backface-visibility/backface-visibility-image-expected.png index ca014f1..0f6376e9 100644 --- a/third_party/blink/web_tests/flag-specific/highdpi/compositing/backface-visibility/backface-visibility-image-expected.png +++ b/third_party/blink/web_tests/flag-specific/highdpi/compositing/backface-visibility/backface-visibility-image-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/highdpi/compositing/culling/filter-occlusion-blur-large-expected.png b/third_party/blink/web_tests/flag-specific/highdpi/compositing/culling/filter-occlusion-blur-large-expected.png index ebfebac..7e15f654 100644 --- a/third_party/blink/web_tests/flag-specific/highdpi/compositing/culling/filter-occlusion-blur-large-expected.png +++ b/third_party/blink/web_tests/flag-specific/highdpi/compositing/culling/filter-occlusion-blur-large-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/culling/filter-occlusion-blur-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/culling/filter-occlusion-blur-expected.png index 8981ae8a..7ac1fb5c 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/culling/filter-occlusion-blur-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/culling/filter-occlusion-blur-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/culling/filter-occlusion-blur-large-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/culling/filter-occlusion-blur-large-expected.png index 3b8c2799..0e051c73 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/culling/filter-occlusion-blur-large-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/culling/filter-occlusion-blur-large-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/masks/mask-with-removed-filters-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/masks/mask-with-removed-filters-expected.png index dedd406..fdcf3b1 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/masks/mask-with-removed-filters-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/masks/mask-with-removed-filters-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/overflow/mask-with-filter-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/overflow/mask-with-filter-expected.png index 9acefcdd..01baa72 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/overflow/mask-with-filter-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/compositing/overflow/mask-with-filter-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/crash-filter-change-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/crash-filter-change-expected.png index d663899..b03a77e2 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/crash-filter-change-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/crash-filter-change-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-blur-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-blur-expected.png index 4159aa0..e8748269 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-blur-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-blur-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-blur-hw-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-blur-hw-expected.png index 41430bd..ae70efc 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-blur-hw-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-blur-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-drop-shadow-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-drop-shadow-expected.png index 308cd3f..4ba1c6e 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-drop-shadow-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-drop-shadow-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-drop-shadow-hw-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-drop-shadow-hw-expected.png index a9f91360..d598999 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-drop-shadow-hw-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/effect-drop-shadow-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-change-repaint-composited-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-change-repaint-composited-expected.png index 2c4e002..3b32863 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-change-repaint-composited-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-change-repaint-composited-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-change-repaint-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-change-repaint-expected.png index 5e98f14a..3004ffab 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-change-repaint-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-change-repaint-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-blur-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-blur-expected.png index c0e12c0..64859a8 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-blur-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-blur-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-expected.png index 0910c1a6..2537df5 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-shadow-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-shadow-expected.png index 47e48dd..7bf2752f 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-shadow-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/css3/filters/filter-repaint-shadow-expected.png Binary files differ diff --git a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/images/color-profile-reflection-expected.png b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/images/color-profile-reflection-expected.png index 61e6976..568a74f 100644 --- a/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/images/color-profile-reflection-expected.png +++ b/third_party/blink/web_tests/flag-specific/skia-vulkan-swiftshader/images/color-profile-reflection-expected.png Binary files differ diff --git a/third_party/blink/web_tests/images/yuv-decode-eligible/color-profile-layer-filter-expected.png b/third_party/blink/web_tests/images/yuv-decode-eligible/color-profile-layer-filter-expected.png index 6cdf197..442da01 100644 --- a/third_party/blink/web_tests/images/yuv-decode-eligible/color-profile-layer-filter-expected.png +++ b/third_party/blink/web_tests/images/yuv-decode-eligible/color-profile-layer-filter-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/compositing/culling/filter-occlusion-blur-expected.png b/third_party/blink/web_tests/platform/linux/compositing/culling/filter-occlusion-blur-expected.png index 742df59..9269847 100644 --- a/third_party/blink/web_tests/platform/linux/compositing/culling/filter-occlusion-blur-expected.png +++ b/third_party/blink/web_tests/platform/linux/compositing/culling/filter-occlusion-blur-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/compositing/masks/mask-with-added-filters-expected.png b/third_party/blink/web_tests/platform/linux/compositing/masks/mask-with-added-filters-expected.png index 09ec1d52..43724e4f 100644 --- a/third_party/blink/web_tests/platform/linux/compositing/masks/mask-with-added-filters-expected.png +++ b/third_party/blink/web_tests/platform/linux/compositing/masks/mask-with-added-filters-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/compositing/masks/mask-with-removed-filters-expected.png b/third_party/blink/web_tests/platform/linux/compositing/masks/mask-with-removed-filters-expected.png index 0e36384..fd9f106 100644 --- a/third_party/blink/web_tests/platform/linux/compositing/masks/mask-with-removed-filters-expected.png +++ b/third_party/blink/web_tests/platform/linux/compositing/masks/mask-with-removed-filters-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/compositing/transform-3d-scales-different-x-y-expected.png b/third_party/blink/web_tests/platform/linux/compositing/transform-3d-scales-different-x-y-expected.png index 519406b..6822f6c 100644 --- a/third_party/blink/web_tests/platform/linux/compositing/transform-3d-scales-different-x-y-expected.png +++ b/third_party/blink/web_tests/platform/linux/compositing/transform-3d-scales-different-x-y-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/transforms/3d/point-mapping/3d-point-mapping-preserve-3d-expected.png b/third_party/blink/web_tests/platform/linux/transforms/3d/point-mapping/3d-point-mapping-preserve-3d-expected.png index 4c4f0708..4b049550d 100644 --- a/third_party/blink/web_tests/platform/linux/transforms/3d/point-mapping/3d-point-mapping-preserve-3d-expected.png +++ b/third_party/blink/web_tests/platform/linux/transforms/3d/point-mapping/3d-point-mapping-preserve-3d-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/transforms/transformed-caret-expected.png b/third_party/blink/web_tests/platform/linux/transforms/transformed-caret-expected.png index 60ab00e..7a425c9d 100644 --- a/third_party/blink/web_tests/platform/linux/transforms/transformed-caret-expected.png +++ b/third_party/blink/web_tests/platform/linux/transforms/transformed-caret-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/virtual/exotic-color-space/images/optimize-contrast-canvas-expected.png b/third_party/blink/web_tests/platform/linux/virtual/exotic-color-space/images/optimize-contrast-canvas-expected.png deleted file mode 100644 index 7d4e96d..0000000 --- a/third_party/blink/web_tests/platform/linux/virtual/exotic-color-space/images/optimize-contrast-canvas-expected.png +++ /dev/null Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/virtual/exotic-color-space/images/optimize-contrast-image-expected.png b/third_party/blink/web_tests/platform/linux/virtual/exotic-color-space/images/optimize-contrast-image-expected.png deleted file mode 100644 index 7d4e96d..0000000 --- a/third_party/blink/web_tests/platform/linux/virtual/exotic-color-space/images/optimize-contrast-image-expected.png +++ /dev/null Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/virtual/gpu-rasterization/images/color-profile-reflection-expected.png b/third_party/blink/web_tests/platform/linux/virtual/gpu-rasterization/images/color-profile-reflection-expected.png new file mode 100644 index 0000000..33bd491 --- /dev/null +++ b/third_party/blink/web_tests/platform/linux/virtual/gpu-rasterization/images/color-profile-reflection-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/virtual/gpu/fast/canvas/canvas-incremental-repaint-expected.png b/third_party/blink/web_tests/platform/linux/virtual/gpu/fast/canvas/canvas-incremental-repaint-expected.png index e640752..1d6e5ddf 100644 --- a/third_party/blink/web_tests/platform/linux/virtual/gpu/fast/canvas/canvas-incremental-repaint-expected.png +++ b/third_party/blink/web_tests/platform/linux/virtual/gpu/fast/canvas/canvas-incremental-repaint-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-brightness-clamping-hw-expected.png b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-brightness-clamping-hw-expected.png index 758f8f7..c83bad09 100644 --- a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-brightness-clamping-hw-expected.png +++ b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-brightness-clamping-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-combined-hw-expected.png b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-combined-hw-expected.png index 2ae064d6..3cd3b08 100644 --- a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-combined-hw-expected.png +++ b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-combined-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-drop-shadow-hw-expected.png b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-drop-shadow-hw-expected.png index 6b57fb40..2b4da4c 100644 --- a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-drop-shadow-hw-expected.png +++ b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-drop-shadow-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-colorspace-hw-expected.png b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-colorspace-hw-expected.png index 0af6b89..8173aa7 100644 --- a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-colorspace-hw-expected.png +++ b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-colorspace-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-hw-expected.png b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-hw-expected.png index a0c0a3c..72b21670 100644 --- a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-hw-expected.png +++ b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-subregion-hw-expected.png b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-subregion-hw-expected.png index 34e65603e..bcb9464f 100644 --- a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-subregion-hw-expected.png +++ b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-subregion-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-zoom-hw-expected.png b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-zoom-hw-expected.png index 14a55e6..c238c7fc 100644 --- a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-zoom-hw-expected.png +++ b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200/css3/filters/effect-reference-zoom-hw-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/mac-mac15-arm64/compositing/masks/mask-with-removed-filters-expected.png b/third_party/blink/web_tests/platform/mac-mac15-arm64/compositing/masks/mask-with-removed-filters-expected.png new file mode 100644 index 0000000..2df70a3 --- /dev/null +++ b/third_party/blink/web_tests/platform/mac-mac15-arm64/compositing/masks/mask-with-removed-filters-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/mac-mac15-arm64/virtual/scalefactor200/css3/filters/filter-change-repaint-composited-expected.png b/third_party/blink/web_tests/platform/mac-mac15-arm64/virtual/scalefactor200/css3/filters/filter-change-repaint-composited-expected.png new file mode 100644 index 0000000..d66505a5 --- /dev/null +++ b/third_party/blink/web_tests/platform/mac-mac15-arm64/virtual/scalefactor200/css3/filters/filter-change-repaint-composited-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/mac-mac15-arm64/virtual/scalefactor200/css3/filters/filter-change-repaint-expected.png b/third_party/blink/web_tests/platform/mac-mac15-arm64/virtual/scalefactor200/css3/filters/filter-change-repaint-expected.png new file mode 100644 index 0000000..3328ef8 --- /dev/null +++ b/third_party/blink/web_tests/platform/mac-mac15-arm64/virtual/scalefactor200/css3/filters/filter-change-repaint-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/mac/compositing/culling/filter-occlusion-blur-expected.png b/third_party/blink/web_tests/platform/mac/compositing/culling/filter-occlusion-blur-expected.png index 742df59..9269847 100644 --- a/third_party/blink/web_tests/platform/mac/compositing/culling/filter-occlusion-blur-expected.png +++ b/third_party/blink/web_tests/platform/mac/compositing/culling/filter-occlusion-blur-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/mac/compositing/masks/mask-with-added-filters-expected.png b/third_party/blink/web_tests/platform/mac/compositing/masks/mask-with-added-filters-expected.png index 637c612..43cde00 100644 --- a/third_party/blink/web_tests/platform/mac/compositing/masks/mask-with-added-filters-expected.png +++ b/third_party/blink/web_tests/platform/mac/compositing/masks/mask-with-added-filters-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/mac/compositing/masks/mask-with-removed-filters-expected.png b/third_party/blink/web_tests/platform/mac/compositing/masks/mask-with-removed-filters-expected.png index 2df70a3..e5b9d8c 100644 --- a/third_party/blink/web_tests/platform/mac/compositing/masks/mask-with-removed-filters-expected.png +++ b/third_party/blink/web_tests/platform/mac/compositing/masks/mask-with-removed-filters-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/mac/compositing/perspective-interest-rect-expected.png b/third_party/blink/web_tests/platform/mac/compositing/perspective-interest-rect-expected.png index 2e451a2..29c8c35b 100644 --- a/third_party/blink/web_tests/platform/mac/compositing/perspective-interest-rect-expected.png +++ b/third_party/blink/web_tests/platform/mac/compositing/perspective-interest-rect-expected.png Binary files differ diff --git a/third_party/blink/web_tests/platform/mac/compositing/transform-3d-scales-different-x-y-expected.png b/third_party/blink/web_tests/platform/mac/compositing/transform-3d-scales-different-x-y-expected.png index 876591172..93e87e7 100644 ... (truncated)
Loading diff…
Original Bug Report
reported by [email protected]
Potential cross-origin GPU memory leak in Skia Ganesh via uninitialized approx-fit padding
Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports without the Chrome Security team. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.
Overview: The Skia Ganesh backend in the GPU process potentially leaks cross-origin pixel data due to improper texture coordinate clamping when using linear filters on approx-fit textures. Malicious sites may be able to read stale GPU memory from other origins by sampling uninitialized padding texels in recycled scratch textures.
Affected files:
third_party/skia/src/gpu/ganesh/effects/GrTextureEffect.hthird_party/skia/src/gpu/ganesh/effects/GrTextureEffect.cppthird_party/skia/src/gpu/ganesh/ops/TextureOp.cppthird_party/skia/src/gpu/ganesh/ops/QuadPerEdgeAA.cppthird_party/skia/src/gpu/ganesh/SurfaceContext.cppthird_party/skia/src/gpu/ganesh/GrResourceProvider.cppthird_party/skia/src/gpu/ganesh/GrBlurUtils.cppthird_party/skia/src/gpu/ganesh/Device_drawTexture.cpp
Estimated timestamp from git blame: 2020-01-24
Summary
In Chromium’s Skia Ganesh backend, the GrResourceCache is shared across all origins within the GPU process to facilitate Out-of-Process Rasterization (OOP-R). When complex filters (e.g., large blurs) are applied, Skia often allocates ‘approx-fit’ intermediate textures that are physically larger than their logical content. When these textures are recycled, their ‘padding’ region is not cleared. Due to a configuration choice in Chromium’s Skia build, the shader-based clamping logic for these textures may allow hardware bilinear samplers to fetch data from this uninitialized padding, leading to a potential cross-origin information leak.
Technical Details
In third_party/skia/src/gpu/ganesh/effects/GrTextureEffect.h, the constant kLinearInset defines the clamping boundary for texture subsets. It is calculated as 0.5f + kInsetEpsilon. In Chromium, the macro SK_USE_SAFE_INSET_FOR_TEXTURE_SAMPLING is not defined, resulting in kInsetEpsilon being 0.f.
// third_party/skia/src/gpu/ganesh/effects/GrTextureEffect.h
#if defined(SK_USE_SAFE_INSET_FOR_TEXTURE_SAMPLING)
inline static constexpr float kInsetEpsilon = 0.0001f;
#else
inline static constexpr float kInsetEpsilon = 0.f;
#endif
inline static constexpr float kLinearInset = 0.5f + kInsetEpsilon; // 0.5f in Chromium
When sampling a subset of width W, the shader clamps the coordinate to exactly W - 0.5. On many GPUs (especially mobile hardware using mediump), precision limits in the shader or the hardware bilinear unit can cause the sampler to fetch the texel at index W, which resides in the uninitialized padding.
Since GrResourceCache is shared across all GpuChannels (and thus all origins) in SharedContextState, a scratch texture previously used by a victim origin may be recycled for an attacker. If the attacker’s logical dimensions are smaller than the victim’s, the attacker can potentially sample the victim’s stale data in the padding. If the stale memory contains NaN or Inf bit patterns (common in F16/F32 textures), these values will propagate to the attacker’s output regardless of the sampling weight.
Potential Impact
This is a cross-origin information leak of GPU pixel data. An attacker could potentially reconstruct content rendered by other websites. On Android, the risk is elevated as the GPU process is currently unsandboxed by default.
Suggested Reproductions Steps (Hypothetical)
- From an attacker page, utilize a 2D canvas with a large CSS or Canvas filter (e.g.,
ctx.filter = 'blur(50px)') to force the allocation ofSkBackingFit::kApproxintermediate textures. - Prime the shared GPU scratch cache by having a different origin (victim) render content that uses similar approximate texture sizes.
- In the attacker’s context, draw the filtered content and sample the edges of the logical subset using linear filtering.
- Use a high-precision F16 canvas and additive blending (
globalCompositeOperation = 'lighter') to amplify subtle contributions from the padding texels. - Read back the edge pixels using
ctx.getImageData()to attempt reconstruction of the stale padding data.
Suggested Fix
Define SK_USE_SAFE_INSET_FOR_TEXTURE_SAMPLING in Chromium’s Skia configuration (e.g., in skia/config/SkUserConfig.h or via GN defines). This adds a small epsilon (0.0001f) to the inset, ensuring that hardware samplers remain strictly within the logical texel boundaries even in the presence of precision errors.
Evaluated with Chrome root at commit: b3153093eb3c78c3e88ccf562bcbc20437a04b0e
Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:
- If you are familiar with the severity guidelines, you may adjust the severity.
- If this is a false positive, and there’s no work to be done, please close as WAI.
- If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.
Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.
References
On This Page