Overview

High

Severity

—

CVSS

No

Exploited ITW

Fixed

Fix Status

ImpactUse after free in Dawn

DescriptionUse after free in Dawn

ComponentDawn

Bug ClassUAF

Tracker529878021

Fix commit8b692610bcff (dawn) +4/-3

CISA KEVNot listed

CreditedGoogle

Disclosed2026-09-08

Background

Dawn: Chromium’s WebGPU implementation, the native library that translates WebGPU API calls into backend graphics commands (Vulkan, Metal, D3D).
Vulkan Dynamic Rendering: a Vulkan feature (exposed via DeviceExt::DynamicRendering) that lets rendering begin without pre-created VkRenderPass/VkFramebuffer objects, which Dawn drives through the Toggle::VulkanUseDynamicRendering toggle.
Adapter toggle: a per-adapter feature switch in Dawn (set via adapterToggles->ForceSet / adapterToggles->Default) that enables or disables a backend codepath before device creation.
PowerVR / ImgTec: Imagination Technologies GPUs, identified by gpu_info::IsImgTec(GetVendorId()), whose Vulkan driver has a defect on the dynamic-rendering path.

Root Cause Analysis

Dawn’s Vulkan backend in PhysicalDeviceVk.cpp enabled the dynamic-rendering codepath by default for any adapter that reported DeviceExt::DynamicRendering support, guarding it only with a blocklist covering older Intel (<= gpu_info::IntelGen::Gen9) and ARM Mali-G68 devices. On Imagination/PowerVR GPUs the vendor driver has a known bug on that path that leads to a use-after-free, so the invariant that “an enabled backend feature must be safe on the reporting driver” was violated because the driver advertised the capability but mishandled its object lifetimes internally. Because the toggle was defaulted to true, every affected PowerVR device silently took the buggy codepath, allowing the driver’s UAF to be reached through normal WebGPU rendering.

The fix adds gpu_info::IsImgTec(GetVendorId()) to the disabling condition so adapterToggles->ForceSet(Toggle::VulkanUseDynamicRendering, false) runs on those GPUs, routing them back to the safe legacy render-pass path. This works because it prevents Dawn from ever exercising the driver code that triggers the use-after-free.

Key insight

The single mistake was trusting a driver’s advertised dynamicRendering support without accounting for a known-buggy vendor (Imagination), and the fix simply extends the existing driver blocklist with gpu_info::IsImgTec(GetVendorId()) so the unsafe codepath is force-disabled on those GPUs.

Attack Path

Vulnerable hardware The victim runs Chrome on a device with an Imagination/PowerVR GPU whose Vulkan driver reports DeviceExt::DynamicRendering support.
Reach WebGPU The victim visits attacker-controlled content that obtains a WebGPU device, which Dawn backs with the Vulkan backend and the default-enabled Toggle::VulkanUseDynamicRendering.
Trigger the path The page issues rendering work that exercises the dynamic-rendering codepath, invoking the PowerVR driver’s defective object handling.
Use-after-free The driver frees and then reuses an object on this path, producing a use-after-free within the GPU process’s driver interaction.

Impact Assessment

An attacker gains a use-after-free condition reachable from web content that renders via WebGPU, occurring in the GPU-process context where Dawn calls into the Vulkan driver. Exploitation preconditions are narrow: the victim must use a device with a vulnerable Imagination/PowerVR GPU and driver that advertises dynamic-rendering support, and must load content that drives WebGPU. Depending on how the freed memory is reused, this can lead to corruption of GPU-process state and potentially further compromise.

Files Changed

src/dawn/native/vulkan/PhysicalDeviceVk.cpp

Audit Directions

Capability-vs-safety blocklists
Audit other backend features that are defaulted on from an advertised extension/feature flag alone; each should have a vendor/driver blocklist and be reviewed as new buggy vendors surface.
Vendor coverage gaps
Review every gpu_info::Is* guard in Dawn’s toggle setup for missing vendors (e.g., Imagination, Qualcomm, other mobile GPUs) on paths that already blocklist Intel or ARM, since partial blocklists imply an incompletely surveyed driver-bug surface.
Driver-lifetime paths
Hunt for codepaths (like dynamic rendering) where object lifetime is managed inside the vendor driver rather than by Dawn, since UAFs there are invisible to Dawn’s own object tracking and only mitigable by disabling the path.

Patch

view commit

From 8b692610bcff3452945acf376290c6d753bfc833 Mon Sep 17 00:00:00 2001
From: Brandon Jones <[email protected]>
Date: Mon, 13 Jul 2026 19:57:16 -0700
Subject: [PATCH] Suppress Vulkan Dynamic Rendering path on PowerVR

There's a known driver issue with Imagination devices that can
cause a use-after-free when the dynamic rendering Vulkan codepath
is used. Blocklist dynamic rendering on Imagination GPUs to avoid
the issue.

Fixes: 529878021
Change-Id: I8d41e6d521c90a0b76e6a1033da7947a9ca5513c
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/324115
Reviewed-by: Kai Ninomiya <[email protected]>
Commit-Queue: Brandon Jones <[email protected]>
---

diff --git a/src/dawn/native/vulkan/PhysicalDeviceVk.cpp b/src/dawn/native/vulkan/PhysicalDeviceVk.cpp
index 0a8b8aa..be51e7b 100644
--- a/src/dawn/native/vulkan/PhysicalDeviceVk.cpp
+++ b/src/dawn/native/vulkan/PhysicalDeviceVk.cpp
@@ -987,13 +987,14 @@
     // because they affect whether or not the MSAARenderToSingleSampled feature is available.
 
     // Use dynamic rendering by default if the corresponding extension is available.
-    // Also disable on older Intel devices and ARM Mali-G68 devices which have been observed to have
-    // driver issues with the dynamic rendering path.
+    // Also disable on older Intel devices, ARM Mali-G68 devices, and PowerVR devices, all of which
+    // have been observed to have driver issues with the dynamic rendering path.
     if (!GetDeviceInfo().HasExt(DeviceExt::DynamicRendering) ||
         GetDeviceInfo().dynamicRenderingFeatures.dynamicRendering == VK_FALSE ||
         (gpu_info::IsIntel(GetVendorId()) &&
          gpu_info::GetIntelGen(GetVendorId(), GetDeviceId()) <= gpu_info::IntelGen::Gen9) ||
-        (gpu_info::IsARM(GetVendorId()) && gpu_info::IsMaliG68(GetDeviceId()))) {
+        (gpu_info::IsARM(GetVendorId()) && gpu_info::IsMaliG68(GetDeviceId())) ||
+        gpu_info::IsImgTec(GetVendorId())) {
         adapterToggles->ForceSet(Toggle::VulkanUseDynamicRendering, false);
     } else {
         adapterToggles->Default(Toggle::VulkanUseDynamicRendering, true);

Loading diff…

Original Bug Report

reported by [email protected]

A use-after-free in the IMG Vulkan user-mode driver's dynamic-rendering attachment cache reachable from WebGPU

Summary

A use-after-free in the Imagination PowerVR Vulkan user-mode driver’s dynamic-rendering attachment cache is reachable from WebGPU. The driver maintains an LRU cache of render-attachment state keyed on image view handles; when a cached entry is evicted while still referenced by an in-flight render pass, a subsequent render pass reads and writes freed heap memory.

Attack surface: WebGPU, reachable from an untrusted web page in the default Chrome for Android configuration.
Impact: Heap use-after-free in the unsandboxed Chrome GPU process.
Severity: High.
Mitigation: A Chrome-layer mitigation in Dawn disables the Vulkan dynamic-rendering code path on affected drivers, falling back to explicit render-pass objects, which do not use the vulnerable cache.

Android bug reference: 528137174

View on issue tracker

References

Vendor advisory Fix commit Bug tracker NVD

CVE-2026-87520