Chrome · GPU
CVE-2026-8552
OOB in GPU
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
gpu/command_buffer/service/gles2_cmd_decoder.cc
Patch
From 397b3fab53f0e040db3f9ac9af5733c524fd772a Mon Sep 17 00:00:00 2001 From: Brandon Jones <[email protected]> Date: Thu, 02 Apr 2026 13:04:33 -0700 Subject: [PATCH] Use depth when updating 3D compressed textures The depth parameter was accidentally not considered in every case when clearing or decompressing 3D compressed textures. This change ensures that the memory allocated for clearing or decompressing is large enough to cover all specified depth layers. Bug: 498706958 Change-Id: Ic7cae42cf9adee07dda8754e2184a3ee988c1d09 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7727007 Reviewed-by: Kenneth Russell <[email protected]> Reviewed-by: Kai Ninomiya <[email protected]> Commit-Queue: Brandon Jones <[email protected]> Commit-Queue: Kenneth Russell <[email protected]> Auto-Submit: Brandon Jones <[email protected]> Cr-Commit-Position: refs/heads/main@{#1609454} --- diff --git a/gpu/command_buffer/service/gles2_cmd_decoder.cc b/gpu/command_buffer/service/gles2_cmd_decoder.cc index 4fb2911..d55fb20 100644 --- a/gpu/command_buffer/service/gles2_cmd_decoder.cc +++ b/gpu/command_buffer/service/gles2_cmd_decoder.cc @@ -12200,7 +12200,7 @@ GLsizei bytes_required = 0; if (!GetCompressedTexSizeInBytes("ClearCompressedTextureLevel3D", width, - height, 1, format, &bytes_required, + height, depth, format, &bytes_required, error_state_.get())) { return false; } @@ -12518,8 +12518,8 @@ auto* api = state.api(); uint32_t output_pixel_size = GLES2Util::ComputeImageGroupSize( info.decompressed_format, info.decompressed_type); - auto decompressed_data = - base::HeapArray<uint8_t>::Uninit(output_pixel_size * width * height); + auto decompressed_data = base::HeapArray<uint8_t>::Uninit( + output_pixel_size * width * height * depth); // If a PBO is bound, map it to decompress the data. const void* input_data = data;
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page