PatchGap
Chrome · WebGL › GL

CVE-2026-9875

OOB in WebGL (GL)
Critical watch CVSS 9.6 chrome OOB 📄 Reporter bug report 🔧 Commit mapped

Overview

Critical
Severity
9.6
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactOut of bounds read in WebGL
DescriptionOut of bounds read in WebGL
ComponentWebGL
Sub-componentGL
Bug ClassOOB
Action tierwatch — information disclosure — security-relevant, below the RCE-class bar
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.
Tracker507508103
Fix commit4a6d53434044 (angle/angle) +70/-11
CWECWE-125 (Out-of-bounds read)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CISA KEVNot listed
CreditedAnonymous
Reported2026-04-29 · bounty $5000 (per vendor advisory)
Fix landed2026-05-12 (public git)
Disclosed2026-05-27
Patch gap15 days — fix public in source before the advisory

Background

`glInvalidateFramebuffer` / `glDiscardFramebufferEXT`
GL calls that hint the driver a framebuffer’s attachment contents are no longer needed, letting it skip storing or restoring them.
Framebuffer completeness
a framebuffer object (FBO) is “complete” only when all its attachments exist with matching, valid dimensions and formats; an incomplete FBO is not usable for normal rendering.
ANGLE `FeaturesGL`
ANGLE’s per-driver workaround/feature flags (declared in FeaturesGL_autogen.h / gl_features.json) toggled by conditions in renderergl_utils.cpp to route around buggy native GL drivers.
`dontInvalidateIncompleteFBOs`
the new feature flag that suppresses the invalidate/discard hint when the FBO is incomplete on affected Qualcomm drivers.

Root Cause Analysis

FramebufferGL::invalidate and FramebufferGL::invalidateSub forwarded the application-supplied attachment list (finalAttachmentsPtr and count) directly to the native driver via invalidateFramebuffer / discardFramebufferEXT / invalidateSubFramebuffer without checking whether the currently bound FBO was complete. On affected Qualcomm drivers (versions earlier than 881), the driver’s implementation of these hints processes the attachment list and the FBO’s attachment dimensions assuming a complete FBO, but an incomplete FBO may have missing or mismatched attachments that the enumerated list references. Because the invalidate hint describes attachments the incomplete FBO does not actually possess in a consistent state, the driver indexes into attachment metadata that is absent or undersized, producing an out-of-bounds read inside the driver. ANGLE trusted the driver to tolerate an incomplete FBO, but these drivers do not, and the hint is a purely optional optimization.

The fix computes skipInvalidate from dontInvalidateIncompleteFBOs.enabled && !checkStatus(context).isComplete() and skips the native call entirely when true, since dropping an invalidate hint has no functional effect.

Key insight
The invalidate/discard call is only a performance hint that is always safe to skip, so the correct fix is to gate it on FBO completeness rather than to sanitize the attachment list. The vulnerable state is reachable because ANGLE forwarded the hint for an FBO whose attachment set the driver could not safely enumerate.

Attack Path

  1. Create an incomplete FBO A WebGL page attaches textures/renderbuffers to a framebuffer such that it is intentionally incomplete (e.g., mismatched or missing attachments).
  2. Issue an invalidate call The page calls invalidateFramebuffer / invalidateSubFramebuffer (or triggers the discardFramebufferEXT path) naming attachments on the incomplete FBO.
  3. ANGLE forwards the hint FramebufferGL::invalidate / invalidateSub binds the FBO and passes finalAttachmentsPtr and count to the native Qualcomm driver without a completeness check.
  4. Driver reads out of bounds On Qualcomm drivers earlier than 881, the driver walks attachment metadata that the incomplete FBO lacks, reading beyond valid buffer bounds.

Impact Assessment

An attacker-controlled WebGL page on an affected Qualcomm device can trigger an out-of-bounds read within the GPU driver, potentially leaking adjacent driver/GPU memory or causing a crash. Because the read occurs in native driver code below ANGLE, its precise consequence depends on driver heap layout, but it constitutes an information-disclosure and stability risk reachable from untrusted web content.

Files Changed

  • include/platform/autogen/FeaturesGL_autogen.h
  • include/platform/gl_features.json
  • src/libANGLE/renderer/gl/FramebufferGL.cpp
  • src/libANGLE/renderer/gl/renderergl_utils.cpp
  • src/tests/gl_tests/FramebufferTest.cpp
  • util/autogen/angle_features_autogen.cpp
  • util/autogen/angle_features_autogen.h

Audit Directions

  • Hint calls forwarding untrusted attachment lists
    Audit other GL wrappers (discard, invalidate, multisample resolves) that pass application attachment counts/enums to native drivers without validating FBO completeness first.
  • Completeness assumptions in driver forwarding
    Look for ANGLE paths that assume the native driver tolerates incomplete or partially-defined FBOs; gate optional hints on checkStatus(context).isComplete().
  • Driver-version-scoped workarounds
    Review whether the Qualcomm < 881 condition matches the true set of affected drivers, since too-narrow version bounds can leave other buggy driver builds exposed.

Patch

view commit
From 4a6d53434044d4d955731bed2a085155260c5911 Mon Sep 17 00:00:00 2001
From: Ken Russell <[email protected]>
Date: Fri, 08 May 2026 18:12:55 -0700
Subject: [PATCH] GL: Add glInvalidateFramebuffer workaround for incomplete FBOs.

If the FBO is incomplete, skip the glInvalidateFramebuffer or
glDiscardFramebufferEXT calls. Apply this workaround to Qualcomm
drivers earlier than version 881.

Incorporate unit test from the bug report.

Co-authored with jetski-cli.

Bug: chromium:507508103
Change-Id: I8f3910b2d5cf4ae41dbe44d2550bc2cad021fea5
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7834009
Commit-Queue: Kenneth Russell <[email protected]>
Reviewed-by: Shahbaz Youssefi <[email protected]>
Reviewed-by: Geoff Lang <[email protected]>
---

diff --git a/include/platform/autogen/FeaturesGL_autogen.h b/include/platform/autogen/FeaturesGL_autogen.h
index d30f958..058540a 100644
--- a/include/platform/autogen/FeaturesGL_autogen.h
+++ b/include/platform/autogen/FeaturesGL_autogen.h
@@ -164,6 +164,12 @@
         &members,
     };
 
+    FeatureInfo dontInvalidateIncompleteFBOs = {
+        "dontInvalidateIncompleteFBOs",
+        FeatureCategory::OpenGLWorkarounds,
+        &members,
+    };
+
     FeatureInfo dontUseLoopsToInitializeVariables = {
         "dontUseLoopsToInitializeVariables",
         FeatureCategory::OpenGLWorkarounds,
diff --git a/include/platform/gl_features.json b/include/platform/gl_features.json
index 7232893..2a22682 100644
--- a/include/platform/gl_features.json
+++ b/include/platform/gl_features.json
@@ -185,6 +185,14 @@
             "issue": ""
         },
         {
+            "name": "dont_invalidate_incomplete_FBOs",
+            "category": "Workarounds",
+            "description": [
+                "Skip invalidation calls if the framebuffer is incomplete."
+            ],
+            "issue": "http://crbug.com/507508103"
+        },
+        {
             "name": "dont_use_loops_to_initialize_variables",
             "category": "Workarounds",
             "description": [
diff --git a/src/libANGLE/renderer/gl/FramebufferGL.cpp b/src/libANGLE/renderer/gl/FramebufferGL.cpp
index 55d1527..afb334e 100644
--- a/src/libANGLE/renderer/gl/FramebufferGL.cpp
+++ b/src/libANGLE/renderer/gl/FramebufferGL.cpp
@@ -501,18 +501,25 @@
     const FunctionsGL *functions = GetFunctionsGL(context);
     StateManagerGL *stateManager = GetStateManagerGL(context);
 
+    const angle::FeaturesGL &features = GetFeaturesGL(context);
+    const bool skipInvalidate =
+        features.dontInvalidateIncompleteFBOs.enabled && !checkStatus(context).isComplete();
+
     // Since this function is just a hint, only call a native function if it exists.
-    if (functions->invalidateFramebuffer)
+    if (!skipInvalidate)
     {
-        stateManager->bindFramebuffer(GL_FRAMEBUFFER, mFramebufferID);
-        functions->invalidateFramebuffer(GL_FRAMEBUFFER, static_cast<GLsizei>(count),
-                                         finalAttachmentsPtr);
-    }
-    else if (functions->discardFramebufferEXT)
-    {
-        stateManager->bindFramebuffer(GL_FRAMEBUFFER, mFramebufferID);
-        functions->discardFramebufferEXT(GL_FRAMEBUFFER, static_cast<GLsizei>(count),
-                                         finalAttachmentsPtr);
+        if (functions->invalidateFramebuffer)
+        {
+            stateManager->bindFramebuffer(GL_FRAMEBUFFER, mFramebufferID);
+            functions->invalidateFramebuffer(GL_FRAMEBUFFER, static_cast<GLsizei>(count),
+                                             finalAttachmentsPtr);
+        }
+        else if (functions->discardFramebufferEXT)
+        {
+            stateManager->bindFramebuffer(GL_FRAMEBUFFER, mFramebufferID);
+            functions->discardFramebufferEXT(GL_FRAMEBUFFER, static_cast<GLsizei>(count),
+                                             finalAttachmentsPtr);
+        }
     }
 
     return angle::Result::Continue;
@@ -535,9 +542,13 @@
     const FunctionsGL *functions = GetFunctionsGL(context);
     StateManagerGL *stateManager = GetStateManagerGL(context);
 
+    const angle::FeaturesGL &features = GetFeaturesGL(context);
+    const bool skipInvalidate =
+        features.dontInvalidateIncompleteFBOs.enabled && !checkStatus(context).isComplete();
+
     // Since this function is just a hint and not available until OpenGL 4.3, only call it if it is
     // available.
-    if (functions->invalidateSubFramebuffer)
+    if (!skipInvalidate && functions->invalidateSubFramebuffer)
     {
         stateManager->bindFramebuffer(GL_FRAMEBUFFER, mFramebufferID);
         functions->invalidateSubFramebuffer(GL_FRAMEBUFFER, static_cast<GLsizei>(count),
diff --git a/src/libANGLE/renderer/gl/renderergl_utils.cpp b/src/libANGLE/renderer/gl/renderergl_utils.cpp
index d19126b..1eadd4b 100644
--- a/src/libANGLE/renderer/gl/renderergl_utils.cpp
+++ b/src/libANGLE/renderer/gl/renderergl_utils.cpp
@@ -2730,6 +2730,10 @@
     ANGLE_FEATURE_CONDITION(features, recreateFboUponFlush,
                             !isMesa && isQualcomm && qualcommVersion < 878);
 
+    // http://crbug.com/507508103
+    ANGLE_FEATURE_CONDITION(features, dontInvalidateIncompleteFBOs,
+                            !isMesa && isQualcomm && qualcommVersion < 881);
+
     // glGenerateMipmap may silently fail on mesa, leaving mips that are expected to be recreated to
     // match the base level in their original shape, hidden from ANGLE and its validation.
     ANGLE_FEATURE_CONDITION(features, recreateMipmapLevelsBeforeGenerate, isMesa);
diff --git a/src/tests/gl_tests/FramebufferTest.cpp b/src/tests/gl_tests/FramebufferTest.cpp
index e7aa934..cc92e28 100644
--- a/src/tests/gl_tests/FramebufferTest.cpp
+++ b/src/tests/gl_tests/FramebufferTest.cpp
@@ -608,6 +608,34 @@
     EXPECT_GL_NO_ERROR();
 }
 
+// Covers invalidating an incomplete framebuffer with a depth/stencil attachment.
+// This should be a no-op, but should not crash on buggy drivers.
+TEST_P(FramebufferTest_ES3, InvalidateIncompleteDepthStencil)
+{
+    GLTexture texture;
+    glBindTexture(GL_TEXTURE_2D_ARRAY, texture);
+    // 2 levels, GL_RGBA8, 4x4, 1 layer
+    glTexStorage3D(GL_TEXTURE_2D_ARRAY, 2, GL_RGBA8, 4, 4, 1);
+
+    GLFramebuffer framebuffer;
+    glBindFramebuffer(GL_FRAMEBUFFER, framebuffer);
+
+    // Try to attach level 2 (out of range) to GL_DEPTH_STENCIL_ATTACHMENT.
+    // This makes the framebuffer incomplete.
+    glFramebufferTextureLayer(GL_FRAMEBUFFER, GL_DEPTH_STENCIL_ATTACHMENT, texture, 2, 0);
+    EXPECT_GL_NO_ERROR();
+
+    // Verify the framebuffer is incomplete.
+    EXPECT_GLENUM_EQ(GL_FRAMEBUFFER_INCOMPLETE_ATTACHMENT,
+                     glCheckFramebufferStatus(GL_FRAMEBUFFER));
+
+    std::vector<GLenum> attachments;
+    attachments.push_back(GL_DEPTH_STENCIL_ATTACHMENT);
+
+    glInvalidateFramebuffer(GL_FRAMEBUFFER, 1, attachments.data());
+    EXPECT_GL_NO_ERROR();
+}
+
 // Covers sub-invalidating an incomplete framebuffer. This should be a no-op, but should not error.
 TEST_P(FramebufferTest_ES3, SubInvalidateIncomplete)
 {
diff --git a/util/autogen/angle_features_autogen.cpp b/util/autogen/angle_features_autogen.cpp
index 59306b6..ffe34a2 100644
--- a/util/autogen/angle_features_autogen.cpp
+++ b/util/autogen/angle_features_autogen.cpp
@@ -122,6 +122,7 @@
     {Feature::DisallowMixedDepthStencilLoadOpNoneAndLoad, "disallowMixedDepthStencilLoadOpNoneAndLoad"},
     {Feature::DoesSRGBClearsOnLinearFramebufferAttachments, "doesSRGBClearsOnLinearFramebufferAttachments"},
     {Feature::DontInitializeUninitializedLocals, "dontInitializeUninitializedLocals"},
+    {Feature::DontInvalidateIncompleteFBOs, "dontInvalidateIncompleteFBOs"},
     {Feature::DontUseLoopsToInitializeVariables, "dontUseLoopsToInitializeVariables"},
     {Feature::DoubleDepthBiasConstantFactor, "doubleDepthBiasConstantFactor"},
     {Feature::DropDepthStencilClearOnInvalidate, "dropDepthStencilClearOnInvalidate"},
diff --git a/util/autogen/angle_features_autogen.h b/util/autogen/angle_features_autogen.h
index 4c46125..8dc083f 100644
--- a/util/autogen/angle_features_autogen.h
+++ b/util/autogen/angle_features_autogen.h
@@ -122,6 +122,7 @@
     DisallowMixedDepthStencilLoadOpNoneAndLoad,
     DoesSRGBClearsOnLinearFramebufferAttachments,
     DontInitializeUninitializedLocals,
+    DontInvalidateIncompleteFBOs,
     DontUseLoopsToInitializeVariables,
     DoubleDepthBiasConstantFactor,
     DropDepthStencilClearOnInvalidate,
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/src/tests/gl_tests/FramebufferTest.cpp b/src/tests/gl_tests/FramebufferTest.cpp
index e7aa934..cc92e28 100644
--- a/src/tests/gl_tests/FramebufferTest.cpp
+++ b/src/tests/gl_tests/FramebufferTest.cpp
@@ -608,6 +608,34 @@
     EXPECT_GL_NO_ERROR();
 }
 
+// Covers invalidating an incomplete framebuffer with a depth/stencil attachment.
+// This should be a no-op, but should not crash on buggy drivers.
+TEST_P(FramebufferTest_ES3, InvalidateIncompleteDepthStencil)
+{
+    GLTexture texture;
+    glBindTexture(GL_TEXTURE_2D_ARRAY, texture);
+    // 2 levels, GL_RGBA8, 4x4, 1 layer
+    glTexStorage3D(GL_TEXTURE_2D_ARRAY, 2, GL_RGBA8, 4, 4, 1);
+
+    GLFramebuffer framebuffer;
+    glBindFramebuffer(GL_FRAMEBUFFER, framebuffer);
+
+    // Try to attach level 2 (out of range) to GL_DEPTH_STENCIL_ATTACHMENT.
+    // This makes the framebuffer incomplete.
+    glFramebufferTextureLayer(GL_FRAMEBUFFER, GL_DEPTH_STENCIL_ATTACHMENT, texture, 2, 0);
+    EXPECT_GL_NO_ERROR();
+
+    // Verify the framebuffer is incomplete.
+    EXPECT_GLENUM_EQ(GL_FRAMEBUFFER_INCOMPLETE_ATTACHMENT,
+                     glCheckFramebufferStatus(GL_FRAMEBUFFER));
+
+    std::vector<GLenum> attachments;
+    attachments.push_back(GL_DEPTH_STENCIL_ATTACHMENT);
+
+    glInvalidateFramebuffer(GL_FRAMEBUFFER, 1, attachments.data());
+    EXPECT_GL_NO_ERROR();
+}
+
 // Covers sub-invalidating an incomplete framebuffer. This should be a no-op, but should not error.
 TEST_P(FramebufferTest_ES3, SubInvalidateIncomplete)
 {
Loading diff…

Original Bug Report

reported by [email protected]

memory corruption in qualcomm gpu lead sandbox escape

Security Bug

Important: Please do not change the component of this bug manually.

Please READ THIS FAQ before filing a bug: https://chromium.googlesource.com/chromium/src/+/HEAD/docs/security/faq.md

Please see the following link for instructions on filing security bugs: https://www.chromium.org/Home/chromium-security/reporting-security-bugs

Reports may be eligible for reward payments under the Chrome VRP: https://g.co/chrome/vrp

NOTE: Security bugs are normally made public once a fix has been widely deployed.

VULNERABILITY DETAILS

This vulnerability ultimately caused a crash in glInvalidateFramebuffer.

VERSION Chrome Version: [147.0.7727.111] + [stable]

Operating System: [samsung/pa1qzcx/pa1q:16/BP2A.250605.031.A3/S9310ZCSABZD1_CHCABZD1:user/release-keys ]

REPRODUCTION CASE

1.luach chrome on S25

2.open poc.html

3.logcat | grep DEBU

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION

Type of crash: [GPU]

04-29 08:53:38.572 19717 19717 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
04-29 08:53:38.572 19717 19717 F DEBUG   : Build fingerprint: 'samsung/pa1qzcx/pa1q:16/BP2A.250605.031.A3/S9310ZCSABZD1_CHCABZD1:user/release-keys'
04-29 08:53:38.572 19717 19717 F DEBUG   : Revision: '11'
04-29 08:53:38.572 19717 19717 F DEBUG   : ABI: 'arm64'
04-29 08:53:38.572 19717 19717 F DEBUG   : Processor: '4'
04-29 08:53:38.572 19717 19717 F DEBUG   : Timestamp: 2026-04-29 08:53:38.445931008+0900
04-29 08:53:38.572 19717 19717 F DEBUG   : Process uptime: 11s
04-29 08:53:38.572 19717 19717 F DEBUG   : Cmdline: com.android.chrome:privileged_process0
04-29 08:53:38.572 19717 19717 F DEBUG   : pid: 19431, tid: 19457, name: CrGpuMain  >>> com.android.chrome:privileged_process0 <<<
04-29 08:53:38.572 19717 19717 F DEBUG   : uid: 10398
04-29 08:53:38.572 19717 19717 F DEBUG   : tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE)
04-29 08:53:38.572 19717 19717 F DEBUG   : pac_enabled_keys: 000000000000000f (PR_PAC_APIAKEY, PR_PAC_APIBKEY, PR_PAC_APDAKEY, PR_PAC_APDBKEY)
04-29 08:53:38.572 19717 19717 F DEBUG   : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x00da000000008199
04-29 08:53:38.572 19717 19717 F DEBUG   :     x0  b400007515af8ae0  x1  b4000074c5b700b0  x2  0000000000000002  x3  0000000000000000
04-29 08:53:38.572 19717 19717 F DEBUG   :     x4  0000000000000002  x5  0000007414395a50  x6  0000000000000000  x7  0000000000000000
04-29 08:53:38.572 19717 19717 F DEBUG   :     x8  b4000074d5b03fd0  x9  8761fa37f6e82302  x10 0000000000000002  x11 0000000000000000
04-29 08:53:38.572 19717 19717 F DEBUG   :     x12 0000000000000400  x13 fffffffffdffffff  x14 00000074147b1a00  x15 0000000000000000
04-29 08:53:38.573 19717 19717 F DEBUG   :     x16 0000000000000017  x17 000000000000483f  x18 000000741701c000  x19 b400007515af8ae0
04-29 08:53:38.573 19717 19717 F DEBUG   :     x20 b400007575b96160  x21 a6da000000008101  x22 fffffffffdffffff  x23 0000000000000000
04-29 08:53:38.573 19717 19717 F DEBUG   :     x24 0000006e004b0380  x25 0000000000000001  x26 0000000000000000  x27 0000000000000000
04-29 08:53:38.573 19717 19717 F DEBUG   :     x28 000000000000821a  x29 00000074186e1870
04-29 08:53:38.573 19717 19717 F DEBUG   :     lr  0072c4f414395a9c  sp  00000074186e1870  pc  0000007414395af8  pst 0000000000001000
04-29 08:53:38.573 19717 19717 F DEBUG   : 31 total frames
04-29 08:53:38.573 19717 19717 F DEBUG   : backtrace:
04-29 08:53:38.573 19717 19717 F DEBUG   :       #00 pc 0000000000185af8  /vendor/lib64/egl/libGLESv2_adreno.so (!!!0000!15308ad94fb9d06ecc441bc7d751ce!e4a2ccdb56!+56) (BuildId: 02d4e5bda5f7509bf3ae03a0a2d87766)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #01 pc 0000000000185a98  /vendor/lib64/egl/libGLESv2_adreno.so (!!!0000!00392d1e72e084bd76e3a9667b1d57!e4a2ccdb56!+72) (BuildId: 02d4e5bda5f7509bf3ae03a0a2d87766)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #02 pc 000000000020cd48  /vendor/lib64/egl/libGLESv2_adreno.so (!!!0000!3a076a0f5bf41e4bcac9395c0e1375!e4a2ccdb56!+648) (BuildId: 02d4e5bda5f7509bf3ae03a0a2d87766)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #03 pc 00000000090151a8  /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #04 pc 0000000008ffcab8  /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #05 pc 00000000090141c8  /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #06 pc 00000000072d4f58  /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #07 pc 00000000072d4468  /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #08 pc 00000000072d4194  /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #09 pc 00000000072d403c  /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #10 pc 00000000072d3fac  /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #11 pc 0000000007309f58  /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #12 pc 00000000076dec98  /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #13 pc 0000000005ed7474  /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #14 pc 0000000005e5b244  /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #15 pc 0000000005e5adac  /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #16 pc 000000000767d4d8  /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #17 pc 0000000005ef9164  /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #18 pc 0000000005e35060  /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #19 pc 0000000005e3144c  /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #20 pc 0000000005e311b8  /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #21 pc 00000000002d7d90  /system/framework/arm64/boot.oat (art_jni_trampoline+112) (BuildId: 1dfca4cf5b8b42c8355c90c8df5ea0c828c6d4b5)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #22 pc 0000000000689408  /apex/com.android.art/lib64/libart.so (nterp_helper+152) (BuildId: eb4ec0f1d1c7267591d83fa87cb36390)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #23 pc 00000000000e1346  /data/app/~~NZPtaYUqIYoCKjhy8J1FXw==/com.android.chrome-DV-Die4gK059hfQy4GokQQ==/base.apk (offset 0x20b000) (oq3.run+574)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #24 pc 00000000000a9500  /system/framework/arm64/boot.oat (java.lang.Thread.run+64) (BuildId: 1dfca4cf5b8b42c8355c90c8df5ea0c828c6d4b5)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #25 pc 0000000000317194  /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+612) (BuildId: eb4ec0f1d1c7267591d83fa87cb36390)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #26 pc 0000000000302838  /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+216) (BuildId: eb4ec0f1d1c7267591d83fa87cb36390)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #27 pc 00000000004c8298  /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallback(void*)+932) (BuildId: eb4ec0f1d1c7267591d83fa87cb36390)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #28 pc 00000000004c7ee4  /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallbackWithUffdGc(void*)+8) (BuildId: eb4ec0f1d1c7267591d83fa87cb36390)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #29 pc 0000000000082740  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+184) (BuildId: 61a049a7ad18156ebc52d8d483539df9)
04-29 08:53:38.573 19717 19717 F DEBUG   :       #30 pc 0000000000074b98  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+68) (BuildId: 61a049a7ad18156ebc52d8d483539df9)
04-29 09:02:43.375 21600 21600 I QCCEventLogger: Logging from Module qti.qcc.system, eventId QCCAppStart, type DEBUG, payloadSize 21

You can also compile a standalone poc.c version separately, which makes it easier to determine the cause. Qualcomm Developer allows you to enable MTE locally and fully reconstruct the vulnerability.

CREDIT INFORMATION

Reporter credit: [Anymous]

View on issue tracker
Links in the report
On This Page