Chrome · WebAudio
CVE-2026-8524
OOB in WebAudio
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifthird_party/blink/renderer/core/workers/worker_backing_thread.cc |
modified |
Files Changed
third_party/blink/renderer/core/workers/worker_backing_thread.ccthird_party/blink/renderer/core/workers/worker_backing_thread.hthird_party/blink/renderer/modules/webaudio/audio_worklet_global_scope.cc
Patch
From 5c37ebf855147997e7cbc84d8ef67ab142cc78b4 Mon Sep 17 00:00:00 2001 From: Michael Wilson <[email protected]> Date: Wed, 15 Apr 2026 03:37:44 -0700 Subject: [PATCH] Disable denormals before isolate creation for AudioWorklet threads This is to ensure consistency in the denormal flag state between the isolate and the global scope. Bug: 499565267 Change-Id: Iec7735bd6bc543da2ad08aea2f7bc716265dc54d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7744866 Reviewed-by: Hiroshige Hayashizaki <[email protected]> Commit-Queue: Michael Wilson <[email protected]> Reviewed-by: Hongchan Choi <[email protected]> Cr-Commit-Position: refs/heads/main@{#1615043} --- diff --git a/third_party/blink/renderer/core/workers/worker_backing_thread.cc b/third_party/blink/renderer/core/workers/worker_backing_thread.cc index 38d221a6..5997bed3 100644 --- a/third_party/blink/renderer/core/workers/worker_backing_thread.cc +++ b/third_party/blink/renderer/core/workers/worker_backing_thread.cc @@ -18,6 +18,7 @@ #include "third_party/blink/renderer/bindings/core/v8/v8_initializer.h" #include "third_party/blink/renderer/core/inspector/worker_thread_debugger.h" #include "third_party/blink/renderer/core/workers/worker_backing_thread_startup_data.h" +#include "third_party/blink/renderer/platform/audio/denormal_disabler.h" #include "third_party/blink/renderer/platform/heap/thread_state.h" #include "third_party/blink/renderer/platform/runtime_enabled_features.h" #include "third_party/blink/renderer/platform/scheduler/public/main_thread.h" @@ -91,6 +92,14 @@ ForegroundedIsolates().erase(isolate); } +bool IsDenormalDisabledThreadType(ThreadType type) { + // Disable denormals on WebAudio threads for performance reasons. See: + // https://esdiscuss.org/topic/float-denormal-issue-in-javascript-processor-node-in-web-audio-api + return type == ThreadType::kOfflineAudioWorkletThread || + type == ThreadType::kRealtimeAudioWorkletThread || + type == ThreadType::kSemiRealtimeAudioWorkletThread; +} + } // namespace // Wrapper functions defined in third_party/blink/public/web/blink.h @@ -119,7 +128,9 @@ WorkerBackingThread::WorkerBackingThread(const ThreadCreationParams& params) : backing_thread_(blink::NonMainThread::CreateThread( - ThreadCreationParams(params).SetSupportsGC(true))) {} + ThreadCreationParams(params).SetSupportsGC(true))), + is_denormal_disabled_thread_( + IsDenormalDisabledThreadType(params.thread_type)) {} WorkerBackingThread::~WorkerBackingThread() = default; @@ -127,6 +138,12 @@ const WorkerBackingThreadStartupData& startup_data) { DCHECK(backing_thread_->IsCurrentThread()); + // Denormals must be disabled before the V8 isolate is initialized so that the + // isolate's internal state and generated code respect the flag. + if (is_denormal_disabled_thread_) { + DenormalModifier::DisableDenormals(); + } + DCHECK(!isolate_); ThreadScheduler* scheduler = BackingThread().Scheduler(); isolate_ = V8PerIsolateData::Initialize( diff --git a/third_party/blink/renderer/core/workers/worker_backing_thread.h b/third_party/blink/renderer/core/workers/worker_backing_thread.h index 445aad71..4c5f3cc7 100644 --- a/third_party/blink/renderer/core/workers/worker_backing_thread.h +++ b/third_party/blink/renderer/core/workers/worker_backing_thread.h @@ -56,6 +56,7 @@ private: std::unique_ptr<blink::NonMainThread> backing_thread_; v8::Isolate* isolate_ = nullptr; + const bool is_denormal_disabled_thread_; }; } // namespace blink diff --git a/third_party/blink/renderer/modules/webaudio/audio_worklet_global_scope.cc b/third_party/blink/renderer/modules/webaudio/audio_worklet_global_scope.cc index b258751..e3c9d55 100644 --- a/third_party/blink/renderer/modules/webaudio/audio_worklet_global_scope.cc +++ b/third_party/blink/renderer/modules/webaudio/audio_worklet_global_scope.cc @@ -23,7 +23,6 @@ #include "third_party/blink/renderer/modules/webaudio/audio_worklet_processor.h" #include "third_party/blink/renderer/modules/webaudio/audio_worklet_processor_definition.h" #include "third_party/blink/renderer/modules/webaudio/cross_thread_audio_worklet_processor_info.h" -#include "third_party/blink/renderer/platform/audio/denormal_disabler.h" #include "third_party/blink/renderer/platform/bindings/callback_method_retriever.h" #include "third_party/blink/renderer/platform/heap/garbage_collected.h" #include "third_party/blink/renderer/platform/wtf/text/strcat.h" @@ -36,9 +35,6 @@ : WorkletGlobalScope(std::move(creation_params), thread->GetWorkerReportingProxy(), thread) { - // Disable denormals for performance. - DenormalModifier::DisableDenormals(); - // Audio is prone to jank introduced by e.g. the garbage collector. Workers // are generally put in a background mode (as they are non-visible). Audio is // an exception here, requiring low-latency behavior similar to any visible
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page