PatchGap
Chrome · Video

CVE-2026-95318

OOB in Video
High watch CVSS 9.6 chrome OOB 🔧 Commit mapped 🧬 Trusting GPU driver quirks, clear state, or layout math

Overview

High
Severity
9.6
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactBuffer overflow in Video
DescriptionBuffer overflow in Video
ComponentVideo
Bug ClassOOB
Action tierwatch — corruption primitive but gated (uncommon) — not default-reachable
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.
Tracker556576976
Fix commit65c806562e43 (chromium/src) +17/-1
CWECWE-122 (Heap buffer overflow)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CISA KEVNot listed
Creditedalex.laboirie
Reported2026-09-03 (per vendor advisory)
Fix landed2026-09-11 (public git)
Disclosed2026-09-22
Patch gap11 days — fix public in source before the advisory

Background

Hardware AV1 decode
Chrome’s VideoDecoder path that offloads AV1 bitstream decoding to the GPU via VA-API, running inside the GPU process.
iHD driver
Intel’s media-driver (iHD) VA-API backend that performs the actual AV1 hardware decode and manages tile/surface buffer allocation.
AV1 tiling
an AV1 frame is partitioned into a grid of independently decodable tiles; the driver must allocate tile buffers sized to the bitstream’s declared tile columns/rows.
`gpu_driver_bug_list.json`
Chrome’s GpuDriverBugList data file matching GPU/driver identities to feature-disabling workarounds such as disable_accelerated_av1_decode.

Root Cause Analysis

Intel iHD media drivers older than 23.2.4 allocate too few tile buffers for AV1 decode relative to the tiling geometry declared in the bitstream. When Chrome hands such a driver an attacker-crafted AV1 stream whose tile column/row count exceeds the driver’s undersized allocation, the driver writes tile data past the end of the heap allocation, producing an out-of-bounds write and memory corruption inside the GPU process. The defect lives entirely in the closed-source Intel driver’s allocation logic, so Chrome cannot correct the buffer sizing from its own code. The only in-Chrome mitigation is to avoid the vulnerable code path: this change adds GpuDriverBugList entry id 500 that matches Linux Intel (vendor_id 0x8086) systems on driver versions < 23.2.4 and applies the disable_accelerated_av1_decode workaround. With hardware AV1 disabled, affected users fall back to software AV1 decoding, which does not exercise the driver’s faulty tile allocation.
Key insight
The vulnerability is not in Chrome code but in a third-party driver’s tile-buffer allocation, so it is remediated by identity-gating rather than by a code fix — Chrome disables the reachable hardware path for exactly the affected driver versions. Version-scoped disabling (< 23.2.4) preserves hardware acceleration for users who have already updated to a fixed driver.

Attack Path

  1. Victim on vulnerable driver a Linux user with an Intel GPU running an iHD driver older than 23.2.4 and hardware AV1 decode enabled.
  2. Attacker delivers AV1 any page, video element, or media the victim loads decodes an attacker-crafted AV1 stream.
  3. Malicious tiling the stream declares a tile grid whose count exceeds what the driver’s undersized allocation holds.
  4. OOB write the iHD driver writes tile data beyond the heap allocation, corrupting GPU-process memory.
  5. Corruption/exploit the resulting heap overflow is a memory-safety primitive in the GPU process, potentially escalatable to code execution.

Impact Assessment

Heap buffer overflow / memory corruption in the GPU process, reachable from any page or media that decodes AV1 with no special privileges. Exploitation is constrained to Linux users on Intel GPUs running iHD drivers older than 23.2.4, but within that population it is remotely triggerable and could allow GPU-process compromise. Users on driver >= 23.2.4 and non-Intel/non-Linux configurations are unaffected.

Files Changed

  • gpu/config/gpu_driver_bug_list.json

Audit Directions

  • Driver-version-scoped workarounds
    audit other GpuDriverBugList entries and hardware media paths (VP9, HEVC, H.264 tiles/slices) for driver allocations that trust bitstream-declared geometry without a Chrome-side bound; each is a candidate for the same undersized-allocation class.
  • Software-fallback completeness
    verify that disabling disable_accelerated_av1_decode reliably routes to software decode with no residual hardware code path, and that the version comparison (< on 23.2.4) correctly excludes patched drivers with unusual version strings.

Patch

view commit
From 65c806562e4398f592277398d2c646e1add3bd77 Mon Sep 17 00:00:00 2001
From: Ted Meyer <[email protected]>
Date: Fri, 11 Sep 2026 14:30:54 -0700
Subject: [PATCH] Add workaround for AV1 Issue in old iHD drivers

This will disable AV1 HW decode for ~9% of all linux users in the last
28 days according to UMA. This number represents 16% of all linux/intel
users, and 21% of all linux/intel/iHD users.

Fixed: 556576976
Change-Id: I65d6137bea6e8233d45c5ca450070d4736bb962a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8384191
Reviewed-by: Zhenyao Mo <[email protected]>
Commit-Queue: Zhenyao Mo <[email protected]>
Auto-Submit: Ted (Chromium) Meyer <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1696620}
---
diff --git a/gpu/config/gpu_driver_bug_list.json b/gpu/config/gpu_driver_bug_list.json
index 5a120c8..b142833 100644
--- a/gpu/config/gpu_driver_bug_list.json
+++ b/gpu/config/gpu_driver_bug_list.json
@@ -3948,7 +3948,7 @@
     },
     {
       "id": 498,
-"cr_bugs": [
+      "cr_bugs": [
         551065272
       ],
       "description": "Recreate mipmap levels before calling glGenerateMipmap on Mali GPUs",
@@ -3968,6 +3968,22 @@
       "features": [
         "adjust_src_dst_region_for_blitframebuffer"
       ]
+    },
+    {
+      "id": 500,
+      "cr_bugs": [556576976],
+      "description": "Older intel iHD drivers allocate too few tiles for AV1 decode, leading to potential memory corruption.",
+      "os": {
+        "type": "linux"
+      },
+      "vendor_id": "0x8086",
+      "driver_version": {
+        "op": "<",
+        "value": "23.2.4"
+      },
+      "features": [
+        "disable_accelerated_av1_decode"
+      ]
     }
   ]
 }
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
On This Page