Chrome · WebGL
CVE-2026-85050
OOB in WebGL
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
include/platform/autogen/FeaturesGL_autogen.hinclude/platform/gl_features.jsonsrc/libANGLE/renderer/gl/TextureGL.cppsrc/libANGLE/renderer/gl/renderergl_utils.cpputil/autogen/angle_features_autogen.cpputil/autogen/angle_features_autogen.h
Patch
From 921d48815f191d63b93aeb9c9921ba6dd95b054e Mon Sep 17 00:00:00 2001 From: Brandon Jones <[email protected]> Date: Thu, 20 Aug 2026 13:54:51 -0700 Subject: [PATCH] Insert flush before generateMipmap on IMG Adds a feature which forces a flush before generating a mipmap, which avoids a bad state in the IMG driver if the texture's base level is still bound to an active FBO. Fixed: chromium:549350408 Change-Id: Id69684690a0fb04a45e0fca7d912bac68f82052c Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/8265721 Commit-Queue: Kenneth Russell <[email protected]> Reviewed-by: Geoff Lang <[email protected]> Reviewed-by: Kenneth Russell <[email protected]> --- diff --git a/include/platform/autogen/FeaturesGL_autogen.h b/include/platform/autogen/FeaturesGL_autogen.h index 58c6372..487cfbe 100644 --- a/include/platform/autogen/FeaturesGL_autogen.h +++ b/include/platform/autogen/FeaturesGL_autogen.h @@ -734,6 +734,12 @@ &members, }; + FeatureInfo flushBeforeGenerateMipmap = { + "flushBeforeGenerateMipmap", + FeatureCategory::OpenGLWorkarounds, + &members, + }; + FeatureInfo splitLevel0PboFullSubImage2D = { "splitLevel0PboFullSubImage2D", FeatureCategory::OpenGLWorkarounds, diff --git a/include/platform/gl_features.json b/include/platform/gl_features.json index 18a3244..7d9f4bb 100644 --- a/include/platform/gl_features.json +++ b/include/platform/gl_features.json @@ -963,6 +963,14 @@ "issue": "http://crbug.com/475877320" }, { + "name": "flush_before_generate_mipmap", + "category": "Workarounds", + "description": [ + "Force a flush before calling generateMipmap to work around driver bugs." + ], + "issue": "http://crbug.com/549350408" + }, + { "name": "split_level_0_pbo_full_sub_image_2D", "category": "Workarounds", "description": [ diff --git a/src/libANGLE/renderer/gl/TextureGL.cpp b/src/libANGLE/renderer/gl/TextureGL.cpp index 63fc458..52c5e88 100644 --- a/src/libANGLE/renderer/gl/TextureGL.cpp +++ b/src/libANGLE/renderer/gl/TextureGL.cpp @@ -1622,6 +1622,13 @@ StateManagerGL *stateManager = GetStateManagerGL(context); const angle::FeaturesGL &features = GetFeaturesGL(context); + if (features.flushBeforeGenerateMipmap.enabled) + { + // Force a flush before generating the mipmap, which avoids a bad state in the IMG driver if + // the texture's base level is still bound to an active FBO. + ANGLE_GL_TRY(context, functions->flush()); + } + stateManager->bindTexture(getType(), mTextureID); bool recreateMipmapLevelsBeforeGenerate = diff --git a/src/libANGLE/renderer/gl/renderergl_utils.cpp b/src/libANGLE/renderer/gl/renderergl_utils.cpp index daded80..2190fd8 100644 --- a/src/libANGLE/renderer/gl/renderergl_utils.cpp +++ b/src/libANGLE/renderer/gl/renderergl_utils.cpp @@ -2748,6 +2748,10 @@ // Disable EXT_clear_texture entirely on IMG as a speculative fix for driver crashes. ANGLE_FEATURE_CONDITION(features, disableClearTexture, IsPowerVR(vendor)); + // Forces a flush before generating a mipmap, which avoids a bad state in the IMG driver if + // the texture's base level is still bound to an active FBO. + ANGLE_FEATURE_CONDITION(features, flushBeforeGenerateMipmap, IsPowerVR(vendor)); + // IMG GL drivers crash while compiling shaders with more than the limit of uniform blocks. ANGLE_FEATURE_CONDITION(features, validateMaxPerStageUniformBlocksAtCompileTime, IsPowerVR(vendor)); diff --git a/util/autogen/angle_features_autogen.cpp b/util/autogen/angle_features_autogen.cpp index 2d2096b..5f52c9e 100644 --- a/util/autogen/angle_features_autogen.cpp +++ b/util/autogen/angle_features_autogen.cpp @@ -189,6 +189,7 @@ {Feature::FlushAfterEndingTransformFeedback, "flushAfterEndingTransformFeedback"}, {Feature::FlushAfterStreamVertexData, "flushAfterStreamVertexData"}, {Feature::FlushBeforeDeleteTextureIfCopiedTo, "flushBeforeDeleteTextureIfCopiedTo"}, + {Feature::FlushBeforeGenerateMipmap, "flushBeforeGenerateMipmap"}, {Feature::FlushOnFramebufferChange, "flushOnFramebufferChange"}, {Feature::FlushQueriesBeforeDeletingOrUnbindingFbo, "flushQueriesBeforeDeletingOrUnbindingFbo"}, {Feature::ForceAtomicValueResolution, "forceAtomicValueResolution"}, diff --git a/util/autogen/angle_features_autogen.h b/util/autogen/angle_features_autogen.h index 0d329ff..99b3126 100644 --- a/util/autogen/angle_features_autogen.h +++ b/util/autogen/angle_features_autogen.h @@ -189,6 +189,7 @@ FlushAfterEndingTransformFeedback, FlushAfterStreamVertexData, FlushBeforeDeleteTextureIfCopiedTo, + FlushBeforeGenerateMipmap, FlushOnFramebufferChange, FlushQueriesBeforeDeletingOrUnbindingFbo, ForceAtomicValueResolution,
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page