When buffer contents are modified, WebGLBuffer::InvalidateCacheRange walks every cached entry in mIndexRanges and invalidates those that overlap the modified [updateBegin, updateEnd) byte region. The overlap test computed the cached entry’s start as rangeBegin = range.byteOffset * indexByteSize, but range.byteOffset is already a byte offset, so multiplying it by indexByteSize inflated the start to a far larger, incorrect position. The invariant that a cached range’s [rangeBegin, rangeEnd) must describe the actual bytes it covers was therefore violated, and the guard if (rangeBegin >= updateEnd || rangeEnd <= updateBegin) continue; could conclude a genuinely overlapping update did not overlap and skip invalidation.

The fix sets rangeBegin = range.byteOffset directly, so the computed span matches the real byte extent and overlapping updates once again invalidate the stale cache entry. Because the cached maximum index is used to accept draw calls without rescanning, an un-invalidated stale entry lets the buffer be validated against out-of-date index bounds.

An attacker running untrusted JavaScript/WebGL in a web page can cause index-bounds validation to pass against stale cached data, driving out-of-bounds reads of vertex/buffer memory during draw calls. The corruption occurs in the process handling WebGL (the content/GPU path), and the only precondition is the ability to create a WebGL context, populate an index buffer, and rewrite it after a draw — all available to any web content. The metadata labels this a high-severity privilege escalation arising from the incorrect boundary condition.