PatchGap
Chrome · ANGLE

CVE-2026-76046

OOB in ANGLE
High chrome OOB 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactBuffer overflow in ANGLE
DescriptionBuffer overflow in ANGLE
ComponentANGLE
Bug ClassOOB
Tracker536581050
Fix commit8bbfb03f8fce (angle/angle) +28/-22
CISA KEVNot listed
CreditedGoogle
Disclosed2026-08-18

Files Changed

  • scripts/code_generation_hashes/ANGLE_format.json
  • scripts/code_generation_hashes/ANGLE_load_functions_table.json
  • scripts/code_generation_hashes/D3D11_format.json
  • scripts/code_generation_hashes/DXGI_format.json
  • scripts/code_generation_hashes/GL_copy_conversion_table.json
  • scripts/code_generation_hashes/GL_format_map.json
  • scripts/code_generation_hashes/Metal_default_shaders.json
  • scripts/code_generation_hashes/Metal_format_table.json
  • scripts/code_generation_hashes/OpenGL_dispatch_table.json
  • scripts/code_generation_hashes/Vulkan_format.json
  • scripts/code_generation_hashes/Vulkan_mandatory_format_support_table.json
  • scripts/code_generation_hashes/WebGPU_format.json
  • src/libANGLE/formatutils.cpp

Patch

view commit
From 8bbfb03f8fce362af0893d83bcf362b2cd08ac2a Mon Sep 17 00:00:00 2001
From: Amirali Abdolrashidi <[email protected]>
Date: Wed, 05 Aug 2026 13:59:45 -0700
Subject: [PATCH] Fix pixel size of RGBA10X6

  The format R10X6G10X6B10X6A10X6 is a 64-bit format with four 10-bit
components, each followed by 6 bits of padding. However, in the current
initialization in the internal format map, this format does not take
the padding spaces into account, resulting in the pixel size becoming
5 bytes (when inquired from a vk::Format object).

This change will apply the change to make sure the size of this format
is correctly set to 8 bytes.

* Updated the internal format map for the following format:
  GL_R10X6G10X6B10X6A10X6_UNORM_ANGLEX
  * (Corresponds to VK_FORMAT_R10X6G10X6B10X6A10X6_UNORM_4PACK16)
  * The padding is taken into account for all components, making the
    size of this format 8 bytes.

* Updated the script that generates the format table to fix the size
  of R10X6G10X6B10X6A10X6_UNORM.
  * (The size of format G10X6_B10X6R10X6_2PLANE_420_UNORM_3PACK16 was
    also fixed from 5 to 6 as a result.)

Bug: angleproject:409355677
Bug: chromium:536581050
Change-Id: I537522bb528ac6ded913ea44ece918dcd7fb13b8
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/8199952
Reviewed-by: Shahbaz Youssefi <[email protected]>
Reviewed-by: Yuxin Hu <[email protected]>
Commit-Queue: Amirali Abdolrashidi <[email protected]>
---

diff --git a/scripts/code_generation_hashes/ANGLE_format.json b/scripts/code_generation_hashes/ANGLE_format.json
index e949b15..5a1b819 100644
--- a/scripts/code_generation_hashes/ANGLE_format.json
+++ b/scripts/code_generation_hashes/ANGLE_format.json
@@ -2,9 +2,9 @@
   "src/libANGLE/renderer/FormatID_autogen.h":
     "2b5ac80521dc3ea477b9c748d48da95d",
   "src/libANGLE/renderer/Format_table_autogen.cpp":
-    "afcde858216b9e9a771b4867863415bd",
+    "80a6465f6125501d0b272b94041eaeb0",
   "src/libANGLE/renderer/angle_format.py":
-    "49c55a74e763b1cfd0d96c4b49b4e402",
+    "ad644811f7f2e1d0b4947534f839a11b",
   "src/libANGLE/renderer/angle_format_data.json":
     "f82d30f65cebd8c787ac0d29fa4c0221",
   "src/libANGLE/renderer/angle_format_map.json":
diff --git a/scripts/code_generation_hashes/ANGLE_load_functions_table.json b/scripts/code_generation_hashes/ANGLE_load_functions_table.json
index 9f90b2c5..a06aa16 100644
--- a/scripts/code_generation_hashes/ANGLE_load_functions_table.json
+++ b/scripts/code_generation_hashes/ANGLE_load_functions_table.json
@@ -1,6 +1,6 @@
 {
   "src/libANGLE/renderer/angle_format.py":
-    "49c55a74e763b1cfd0d96c4b49b4e402",
+    "ad644811f7f2e1d0b4947534f839a11b",
   "src/libANGLE/renderer/gen_load_functions_table.py":
     "10e66c76a350a1c70fadd2e10a28981e",
   "src/libANGLE/renderer/load_functions_data.json":
diff --git a/scripts/code_generation_hashes/D3D11_format.json b/scripts/code_generation_hashes/D3D11_format.json
index 4dbdd3a..3abe5c6 100644
--- a/scripts/code_generation_hashes/D3D11_format.json
+++ b/scripts/code_generation_hashes/D3D11_format.json
@@ -1,6 +1,6 @@
 {
   "src/libANGLE/renderer/angle_format.py":
-    "49c55a74e763b1cfd0d96c4b49b4e402",
+    "ad644811f7f2e1d0b4947534f839a11b",
   "src/libANGLE/renderer/d3d/d3d11/gen_texture_format_table.py":
     "c4257516b0b8430d745f81b7307174ad",
   "src/libANGLE/renderer/d3d/d3d11/texture_format_data.json":
diff --git a/scripts/code_generation_hashes/DXGI_format.json b/scripts/code_generation_hashes/DXGI_format.json
index 214b818..6a58b2a 100644
--- a/scripts/code_generation_hashes/DXGI_format.json
+++ b/scripts/code_generation_hashes/DXGI_format.json
@@ -1,6 +1,6 @@
 {
   "src/libANGLE/renderer/angle_format.py":
-    "49c55a74e763b1cfd0d96c4b49b4e402",
+    "ad644811f7f2e1d0b4947534f839a11b",
   "src/libANGLE/renderer/angle_format_map.json":
     "abad08e462a0839d1600d83f83bcad8b",
   "src/libANGLE/renderer/dxgi_format_data.json":
diff --git a/scripts/code_generation_hashes/GL_copy_conversion_table.json b/scripts/code_generation_hashes/GL_copy_conversion_table.json
index af3566a..a2d2ea2 100644
--- a/scripts/code_generation_hashes/GL_copy_conversion_table.json
+++ b/scripts/code_generation_hashes/GL_copy_conversion_table.json
@@ -6,5 +6,5 @@
   "src/libANGLE/gen_copy_conversion_table.py":
     "3b1f0182a41af78b44930fb415ff0fb6",
   "src/libANGLE/renderer/angle_format.py":
-    "49c55a74e763b1cfd0d96c4b49b4e402"
+    "ad644811f7f2e1d0b4947534f839a11b"
 }
diff --git a/scripts/code_generation_hashes/GL_format_map.json b/scripts/code_generation_hashes/GL_format_map.json
index a01ecac..56c4854 100644
--- a/scripts/code_generation_hashes/GL_format_map.json
+++ b/scripts/code_generation_hashes/GL_format_map.json
@@ -8,5 +8,5 @@
   "src/libANGLE/gen_format_map.py":
     "32b43aedcbad2aa5eaa47052cc8573ac",
   "src/libANGLE/renderer/angle_format.py":
-    "49c55a74e763b1cfd0d96c4b49b4e402"
+    "ad644811f7f2e1d0b4947534f839a11b"
 }
diff --git a/scripts/code_generation_hashes/Metal_default_shaders.json b/scripts/code_generation_hashes/Metal_default_shaders.json
index 71c7fbc..9ac6063 100644
--- a/scripts/code_generation_hashes/Metal_default_shaders.json
+++ b/scripts/code_generation_hashes/Metal_default_shaders.json
@@ -1,6 +1,6 @@
 {
   "src/libANGLE/renderer/angle_format.py":
-    "49c55a74e763b1cfd0d96c4b49b4e402",
+    "ad644811f7f2e1d0b4947534f839a11b",
   "src/libANGLE/renderer/angle_format_map.json":
     "abad08e462a0839d1600d83f83bcad8b",
   "src/libANGLE/renderer/gen_angle_format_table.py":
diff --git a/scripts/code_generation_hashes/Metal_format_table.json b/scripts/code_generation_hashes/Metal_format_table.json
index a262947..42cc71d 100644
--- a/scripts/code_generation_hashes/Metal_format_table.json
+++ b/scripts/code_generation_hashes/Metal_format_table.json
@@ -1,6 +1,6 @@
 {
   "src/libANGLE/renderer/angle_format.py":
-    "49c55a74e763b1cfd0d96c4b49b4e402",
+    "ad644811f7f2e1d0b4947534f839a11b",
   "src/libANGLE/renderer/angle_format_map.json":
     "abad08e462a0839d1600d83f83bcad8b",
   "src/libANGLE/renderer/metal/gen_mtl_format_table.py":
@@ -8,5 +8,5 @@
   "src/libANGLE/renderer/metal/mtl_format_map.json":
     "cb72edc9237cf806792b2e4066a27627",
   "src/libANGLE/renderer/metal/mtl_format_table_autogen.mm":
-    "5e518281148d86f1fb0b90dd5d548e26"
+    "6d7764d3ce7fcde1fcab38755e7fc13e"
 }
diff --git a/scripts/code_generation_hashes/OpenGL_dispatch_table.json b/scripts/code_generation_hashes/OpenGL_dispatch_table.json
index 0deced8..872fc3d 100644
--- a/scripts/code_generation_hashes/OpenGL_dispatch_table.json
+++ b/scripts/code_generation_hashes/OpenGL_dispatch_table.json
@@ -1,6 +1,6 @@
 {
   "src/libANGLE/renderer/angle_format.py":
-    "49c55a74e763b1cfd0d96c4b49b4e402",
+    "ad644811f7f2e1d0b4947534f839a11b",
   "src/libANGLE/renderer/gl/DispatchTableGL_autogen.cpp":
     "63851b2d41e02271ba657de853d58fdc",
   "src/libANGLE/renderer/gl/DispatchTableGL_autogen.h":
diff --git a/scripts/code_generation_hashes/Vulkan_format.json b/scripts/code_generation_hashes/Vulkan_format.json
index 82fccd2..4b22917 100644
--- a/scripts/code_generation_hashes/Vulkan_format.json
+++ b/scripts/code_generation_hashes/Vulkan_format.json
@@ -1,6 +1,6 @@
 {
   "src/libANGLE/renderer/angle_format.py":
-    "49c55a74e763b1cfd0d96c4b49b4e402",
+    "ad644811f7f2e1d0b4947534f839a11b",
   "src/libANGLE/renderer/angle_format_map.json":
     "abad08e462a0839d1600d83f83bcad8b",
   "src/libANGLE/renderer/vulkan/gen_vk_format_table.py":
diff --git a/scripts/code_generation_hashes/Vulkan_mandatory_format_support_table.json b/scripts/code_generation_hashes/Vulkan_mandatory_format_support_table.json
index 2f12f92..fa5a332 100644
--- a/scripts/code_generation_hashes/Vulkan_mandatory_format_support_table.json
+++ b/scripts/code_generation_hashes/Vulkan_mandatory_format_support_table.json
@@ -1,6 +1,6 @@
 {
   "src/libANGLE/renderer/angle_format.py":
-    "49c55a74e763b1cfd0d96c4b49b4e402",
+    "ad644811f7f2e1d0b4947534f839a11b",
   "src/libANGLE/renderer/vulkan/gen_vk_mandatory_format_support_table.py":
     "a9fd6f3ff2b584aff382364489146c76",
   "src/libANGLE/renderer/vulkan/vk_format_map.json":
diff --git a/scripts/code_generation_hashes/WebGPU_format.json b/scripts/code_generation_hashes/WebGPU_format.json
index 5380ce4..f2b684a 100644
--- a/scripts/code_generation_hashes/WebGPU_format.json
+++ b/scripts/code_generation_hashes/WebGPU_format.json
@@ -1,6 +1,6 @@
 {
   "src/libANGLE/renderer/angle_format.py":
-    "49c55a74e763b1cfd0d96c4b49b4e402",
+    "ad644811f7f2e1d0b4947534f839a11b",
   "src/libANGLE/renderer/angle_format_map.json":
     "abad08e462a0839d1600d83f83bcad8b",
   "src/libANGLE/renderer/wgpu/gen_wgpu_format_table.py":
diff --git a/src/libANGLE/formatutils.cpp b/src/libANGLE/formatutils.cpp
index 0e6d9b3..52331f9 100644
--- a/src/libANGLE/formatutils.cpp
+++ b/src/libANGLE/formatutils.cpp
@@ -1109,7 +1109,10 @@
     // Special format which is not really supported, so always false for all supports.
     AddRGBAFormat(&map, GL_BGR565_ANGLEX,     true,  5,  6,  5,  0, 0, GL_BGRA_EXT,     GL_UNSIGNED_SHORT_5_6_5,           GL_UNSIGNED_NORMALIZED, false, NeverSupported,                                    NeverSupported,  NeverSupported,                                    NeverSupported,                                NeverSupported);
     AddRGBAFormat(&map, GL_BGR10_A2_ANGLEX,   true, 10, 10, 10,  2, 0, GL_BGRA_EXT,     GL_UNSIGNED_INT_2_10_10_10_REV,    GL_UNSIGNED_NORMALIZED, false, NeverSupported,                                    NeverSupported,  NeverSupported,                                    NeverSupported,                                NeverSupported);
-    AddRGBAFormat(&map, GL_R10X6G10X6B10X6A10X6_UNORM_ANGLEX,   true, 10, 10, 10,  10, 0, GL_RGBA,    GL_UNSIGNED_SHORT,   GL_UNSIGNED_NORMALIZED, false, RequireES<3, 0>,                                    NeverSupported,  NeverSupported,                                    NeverSupported,                                NeverSupported);
+
+    // R10X6G10X6B10X6A10X6 has no explicit support on GL. Each component has 10 bits of data and
+    // 6 bits of padding (24 bits of padding in total).
+    AddRGBAXFormat(&map, GL_R10X6G10X6B10X6A10X6_UNORM_ANGLEX,   true, FB< 10,  10,  10,  10, 24, 0>(), GL_RGBA,    GL_UNSIGNED_SHORT,   GL_UNSIGNED_NORMALIZED, false, RequireES<3, 0>,                                    NeverSupported,  NeverSupported,                                    NeverSupported,                                NeverSupported);
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
On This Page