PatchGap
Chrome · WebGPU › Dawn

CVE-2026-2315

Logic Error in WebGPU (Dawn)
High watch CVSS 8.8 chrome Logic Error 📄 Reporter bug report 🔧 Commit mapped

Overview

High
Severity
8.8
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInappropriate implementation in WebGPU
DescriptionInappropriate implementation in WebGPU
ComponentWebGPU
Sub-componentDawn
Bug ClassLogic Error
Action tierwatch — information disclosure — security-relevant, below the RCE-class bar
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.
Tracker479242793
Fix commit4c7d0f5ecc87 (dawn) +2/-25
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA KEVNot listed
CreditedGoogle
Reported2026-01-27 (per vendor advisory)
Fix landed2026-01-28 (public git)
Disclosed2026-02-10
Patch gap13 days — fix public in source before the advisory

Background

Workgroup memory zero-initialization
WGSL requires workgroup (and function/private) variables to start zeroed, so Dawn must guarantee that shader-visible memory never exposes stale contents from earlier GPU work.
`VK_KHR_zero_initialize_workgroup_memory`
a Vulkan extension (DeviceExt::ZeroInitializeWorkgroupMemory) that lets the driver perform this zeroing, instead of Dawn/Tint emitting explicit initialization code.
`Toggle::VulkanUseZeroInitializeWorkgroupMemoryExtension`
the Dawn device toggle that selects whether to rely on the driver extension; when force-set to false, Dawn falls back to its own initialization (the context comment mentions OpConstantNull).
`IsPixel10()` / `IsAndroidARM()`
Dawn device-identification predicates used to apply per-device driver workarounds.

Root Cause Analysis

In src/dawn/native/vulkan/PhysicalDeviceVk.cpp (the enclosing function is not named in the hunk), Dawn decides whether to trust the driver’s VK_KHR_zero_initialize_workgroup_memory support; it already refused to use it when the extension is missing, when shaderZeroInitializeWorkgroupMemory == VK_FALSE, or on IsAndroidARM() devices because of a known Mali bug. On Pixel 10 the extension is advertised and enabled, but the added comment states that its “workgroup zero init does not always work as expected”, so shaders could observe non-zero initial values where WGSL guarantees zero. The removed webgpu-cts/expectations.txt lines confirm the symptom: webgpu:shader,execution,zero_init:compute,zero_init cases for addressSpace="function" and addressSpace="private" were failing on android-pixel-10.

The fix tightens the condition by adding || IsPixel10(), so the toggle is ForceSet(..., false) on Pixel 10 and Dawn uses its own zero-initialization path instead of trusting the driver; with that change the CTS failure expectations could be deleted.

Key insight
Dawn trusted a driver-advertised zero-initialization feature on a device whose implementation was faulty, breaking WGSL’s no-uninitialized-memory guarantee; the fix adds the device to the existing deny-list so Dawn performs initialization itself.

Attack Path

  1. Run on an affected device The victim uses Chrome with WebGPU on a Pixel 10, where the Vulkan backend previously enabled VulkanUseZeroInitializeWorkgroupMemoryExtension.
  2. Submit a compute shader A web page creates a WebGPU compute pipeline whose shader declares variables it reads before writing, relying on WGSL’s zero-initialization guarantee.
  3. Read non-zero initial values Because driver zero-init “does not always work as expected”, the shader observes values that should have been zero, as shown by the failing zero_init CTS cases.
  4. Exfiltrate stale GPU data The page copies those values into a buffer and reads them back; if the stale contents originate from other GPU work (other origins, the compositor, other apps), this would be a cross-origin information leak (inferred — the patch does not show where the stale data comes from).

Impact Assessment

The vendor advisory rates this high (“Inappropriate implementation in WebGPU”); no exploited-in-the-wild status is given in the supplied metadata. The precondition is specific hardware/driver: only Pixel 10 devices using Dawn’s Vulkan backend are affected, and the trigger is ordinary web content that can use WebGPU (no flag or extension is implied by the diff). The demonstrated defect is a broken zero-initialization guarantee in GPU shader memory; disclosure of other processes’ or origins’ GPU data is (inferred).

Files Changed

  • src/dawn/native/vulkan/PhysicalDeviceVk.cpp
  • webgpu-cts/expectations.txt

Audit Directions

  • Driver-feature trust lists
    Review other places where Dawn enables a toggle purely because a Vulkan/Metal/D3D feature bit is advertised (robustness, zero-init, robust buffer access) and check per-vendor/per-device CTS failure expectations for hints of broken drivers.
  • CTS expectations as security signals
    webgpu-cts/expectations.txt entries for zero_init, robust_access or out-of-bounds tests on a specific device may indicate unenforced security invariants, not just correctness gaps.
  • All address spaces
    Confirm that the fallback initialization covers workgroup, function and private variables, since the removed failures span function and private address spaces as well.

Patch

view commit
From 4c7d0f5ecc872898bd236e423fbd2be5f8666992 Mon Sep 17 00:00:00 2001
From: Peter McNeeley <[email protected]>
Date: Wed, 28 Jan 2026 06:05:12 -0800
Subject: [PATCH] [dawn] Disable extension workgroup zero init on pixel 10

Bug: 479242793
Change-Id: Ie53495eb7d2b9939abb3a17691e49a9f6369b9be
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/287195
Reviewed-by: dan sinclair <[email protected]>
Reviewed-by: Loko Kung <[email protected]>
Commit-Queue: Peter McNeeley <[email protected]>
---

diff --git a/src/dawn/native/vulkan/PhysicalDeviceVk.cpp b/src/dawn/native/vulkan/PhysicalDeviceVk.cpp
index c9fa553..f925819 100644
--- a/src/dawn/native/vulkan/PhysicalDeviceVk.cpp
+++ b/src/dawn/native/vulkan/PhysicalDeviceVk.cpp
@@ -1089,10 +1089,11 @@
     // extension is available. Override the decision if it is not applicable or
     // zeroInitializeWorkgroupMemoryFeatures.shaderZeroInitializeWorkgroupMemory == VK_FALSE.
     // Never use the extension on Mali devices due to a known bug (see crbug.com/tint/2101).
+    // Pixel 10 workgroup zero init does not always work as expected (see crbug.com/479242793).
     if (!GetDeviceInfo().HasExt(DeviceExt::ZeroInitializeWorkgroupMemory) ||
         GetDeviceInfo().zeroInitializeWorkgroupMemoryFeatures.shaderZeroInitializeWorkgroupMemory ==
             VK_FALSE ||
-        IsAndroidARM()) {
+        IsAndroidARM() || IsPixel10()) {
         deviceToggles->ForceSet(Toggle::VulkanUseZeroInitializeWorkgroupMemoryExtension, false);
     }
     // By default try to initialize workgroup memory with OpConstantNull according to the Vulkan
diff --git a/webgpu-cts/expectations.txt b/webgpu-cts/expectations.txt
index 9ed6a1a..5419551 100644
--- a/webgpu-cts/expectations.txt
+++ b/webgpu-cts/expectations.txt
@@ -1716,30 +1716,6 @@
 crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,statement,discard:three_quarters:useStorageBuffers=true [ Failure ]
 crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,statement,discard:uniform_read_loop:useStorageBuffers=true [ Failure ]
 crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,statement,phony:executes:case="loop" [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=18 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=19 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=21 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=22 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=23 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=24 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=25 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=26 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=28 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=29 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=15 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=16 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=17 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=19 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=20 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=21 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=22 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=23 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=24 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=25 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=26 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=27 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=28 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=29 [ Failure ]
 crbug.com/0000 [ android-pixel-10 ] webgpu:shader,validation,expression,call,builtin,textureSampleBaseClampToEdge:* [ Failure ]
 crbug.com/0000 [ android-pixel-10 ] webgpu:shader,validation,expression,call,builtin,textureSampleBias:* [ Failure ]
 crbug.com/0000 [ android-pixel-10 ] webgpu:shader,validation,expression,call,builtin,textureSampleCompare:* [ Failure ]
Loading diff…

Original Bug Report

reported by [email protected]

Use dawn workgroup zero init fallback for pixel 10

The vulkan extension for workgroup zero init may not always work as intended. Use the tint fallback for now.
View on issue tracker
On This Page