PatchGap
Chrome · WebGL › GPU

CVE-2026-91726

OOB in WebGL (GPU)
Critical watch CVSS 4.7 chrome OOB 🔧 Commit mapped 🧬 Trusting GPU driver quirks, clear state, or layout math

Overview

Critical
Severity
4.7
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactOut of bounds read in WebGL
DescriptionOut of bounds read in WebGL
ComponentWebGL
Sub-componentGPU
Bug ClassOOB
Action tierwatch — information disclosure — security-relevant, below the RCE-class bar
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.
Tracker556870863
Fix commit1145ae564b46 (chromium/src) +13/-0
CWECWE-125 (Out-of-bounds read)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
CISA KEVNot listed
CreditedGoogle
Reported2026-09-03 (per vendor advisory)
Fix landed2026-09-10 (public git)
Disclosed2026-09-15
Patch gap5 days — fix public in source before the advisory

Background

Program binary cache
A GPU shader-caching layer that stores compiled GL program binaries keyed by a hash so that a previously compiled program can be reloaded via glProgramBinary instead of recompiling from source.
`disable_program_cache`
An existing Chrome GPU workaround feature that turns off the program binary cache, forcing every program to be compiled fresh from shader source.
`angle_gles`
The gl_type denoting ANGLE running on top of the platform’s native OpenGL ES driver (as opposed to ANGLE’s Vulkan or D3D backends); this is the only configuration that routes through the native blob cache on Android.
Blob cache
The driver-side cache (via EGL_ANDROID_blob_cache) that stores and retrieves compiled binaries by an opaque key supplied by the caller.

Root Cause Analysis

On Imagination’s native GLES driver, the key used to store and retrieve compiled program binaries in the blob cache is not sufficiently unique, so two structurally different GL programs can hash to the same cache key. When Chrome (via ANGLE over the native GLES driver) looks up a program in the cache, a colliding key can return a binary that was compiled for a different program. Loading that mismatched binary via program-binary restore makes the driver interpret the running program’s shader, uniform, and attribute data against the layout baked into the wrong binary. Because the offsets and sizes of that layout do not match the actual program’s data, the driver reads memory outside the bounds of the intended buffers — an out-of-bounds read. This affects only the angle_gles configuration on Android, which is the sole path that uses the native blob cache.

The fix applies the existing disable_program_cache feature to this driver/config so no cached binary is ever reloaded and every program is compiled fresh.

Key insight
The vulnerability is not in ANGLE or Chrome’s caching logic but in the Imagination driver’s cache-key generation, where distinct programs collide; the safe remedy is to stop trusting the cache entirely on that driver rather than to reformulate the key.

Attack Path

  1. Prime the cache On an affected Imagination-based Android device, a page compiles and uses a WebGL program that the driver stores in the native blob cache under a given key.
  2. Trigger a collision The page (or a subsequent page) compiles a second, structurally different program whose cache key collides with the first on the vulnerable driver.
  3. Force a mismatched load On lookup, the driver returns the binary compiled for the first program and loads it as the second program’s binary.
  4. Provoke the OOB read Drawing or querying with the mismatched program makes the driver read shader/uniform/attribute data against the wrong layout, reading out of bounds.
  5. Observe leaked data Mismatched reads surface as rendered output or query results, potentially exposing adjacent memory contents to the page.

Impact Assessment

This is an out-of-bounds read in the WebGL/GPU path, reachable from web content on affected Imagination-driver Android devices, that can leak GPU-process memory adjacent to the intended shader data. Confidentiality is the primary concern; the collision is driver-behavioral and does not by itself grant write primitives. The scope is limited to Android devices running ANGLE on top of Imagination’s native GLES driver.

Files Changed

  • gpu/config/gpu_driver_bug_list.json

Audit Directions

  • Cache-key collisions
    Review other driver/vendor configurations that rely on the native blob cache or glProgramBinary restore for similar key-uniqueness assumptions that could return binaries for the wrong program.
  • Mismatched binary loading
    Audit the ANGLE-over-native-GLES path for validation of restored program binaries, since a returned binary is trusted to match the requesting program without a layout consistency check.
  • Workaround coverage
    Verify that disable_program_cache truly suppresses all cache reload paths (not just writes) on angle_gles, and check for adjacent vendors on Android that route through the same native blob cache.

Patch

view commit
From 1145ae564b46dc2825d688e242433f323e7075c4 Mon Sep 17 00:00:00 2001
From: Ken Russell <[email protected]>
Date: Wed, 09 Sep 2026 17:09:19 -0700
Subject: [PATCH] GPU: disable program cache on Imagination's GLES drivers.

Blob cache entries can collide on Imagination's OpenGL ES drivers.
Apply the existing disable_program_cache workaround when ANGLE is
running on top of the native GLES driver, which is the only
configuration which uses the native blob cache. The validating command
decoder does not.

It wasn't feasible to write a regression test for the use of this
workaround. Verified on device that the workaround is enabled.

Fixed: 556870863
Change-Id: Ia4286872c07bc9432a57aa553500ad36d654ed5d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8360470
Auto-Submit: Kenneth Russell <[email protected]>
Reviewed-by: Geoff Lang <[email protected]>
Reviewed-by: Zhenyao Mo <[email protected]>
Commit-Queue: Kenneth Russell <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1695027}
---
diff --git a/gpu/config/gpu_driver_bug_list.json b/gpu/config/gpu_driver_bug_list.json
index 48409be9..ff90d1d 100644
--- a/gpu/config/gpu_driver_bug_list.json
+++ b/gpu/config/gpu_driver_bug_list.json
@@ -3915,6 +3915,19 @@
       "features": [
         "disable_dx12_info_collection"
       ]
+    },
+    {
+      "id": 496,
+      "cr_bugs": [556870863],
+      "description": "Program binary cache entries can collide in Imagination's GLES driver",
+      "os": {
+        "type": "android"
+      },
+      "gl_vendor": "Imagination.*",
+      "gl_type": "angle_gles",
+      "features": [
+        "disable_program_cache"
+      ]
     }
   ]
 }
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
On This Page