Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports without the security team.

Overview: A Use-After-Free vulnerability exists in the macOS GPU process where a WebGL context can be destroyed without unregistering its GL debug callback if the context is lost. A shared IOSurfaceBackingEGLState can keep the underlying GL context alive, allowing a subsequent glDeleteTextures call on the lost context to trigger the stale callback, leading to RCE.

Affected files:

• gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc
• gpu/command_buffer/service/shared_image/iosurface_image_backing.mm
• gpu/command_buffer/service/gles2_cmd_decoder_passthrough_doers.cc

Estimated timestamp from git blame: 2026-02-17

Description

A potential Use-After-Free (UAF) vulnerability has been identified in the GLES2 passthrough decoder, specifically affecting macOS via IOSurfaceBackingEGLState. The issue stems from a combination of GL context retention across different decoders and a failure to clear the KHR_debug callback during decoder destruction when a context is lost.

When a passthrough decoder imports a macOS IOSurface-backed SharedImage, IOSurfaceImageBacking::RetainGLTexture creates an IOSurfaceBackingEGLState object that holds a strong scoped_refptr to the decoder’s gl::GLContext. This EGL state is cached in egl_state_map_ and shared across decoders on the same thread.

When a decoder is destroyed, GLES2DecoderPassthroughImpl::Destroy(bool have_context) skips unregistering the glDebugMessageCallbackKHR if have_context is false (e.g., if WEBGL_lose_context was previously called). This leaves a stale pointer to the freed decoder in ANGLE’s C API.

If another decoder keeps the IOSurfaceBackingEGLState (and thus the underlying GL context) alive, releasing the SharedImage later will cause ~IOSurfaceBackingEGLState to call glDeleteTextures via ui::ScopedMakeCurrent. If a GPU reset is induced before this release, ANGLE emits a GL_CONTEXT_LOST error debug message during the delete call, synchronously invoking the stale callback and leading to a virtual call (GetLogger()) on the freed decoder memory.

Potential Attack Steps

These are suggested steps based on static analysis:

1. Setup Contexts: In a compromised renderer, create two WebGL contexts (Decoder A and Decoder B) that map to separate passthrough decoders in the GPU process.
2. Import SharedImage: Create an IOSurface-backed SharedImage and import it into Decoder A. This causes IOSurfaceBackingEGLState to capture a strong reference to Decoder A’s gl::GLContext.
3. Share EGL State: Import the same SharedImage into Decoder B. Decoder B now holds a reference to the same IOSurfaceBackingEGLState.
4. Simulate Context Loss: Delete the texture in Decoder A and call WEBGL_lose_context.loseContext() on Decoder A. This marks Decoder A as lost.
5. Destroy Decoder A: Destroy Decoder A. The cleanup skips unregistering the ANGLE debug callback because have_context is false. The callback user_param is now a dangling pointer to the freed Decoder A.
6. Heap Spray: Spray the GPU process heap to place a fake vtable at Decoder A’s old address.
7. Induce Real Context Loss: Submit an expensive shader to induce a legitimate GPU hang, causing ANGLE to internally mark devices as lost.
8. Trigger UAF: Delete the texture in Decoder B. Decoder B drops its reference, destroying IOSurfaceBackingEGLState. Its destructor attempts to execute glDeleteTextures using Decoder A’s resurrected context. ANGLE generates a GL_CONTEXT_LOST error, firing the stale callback with the dangling pointer and executing the fake vtable.

MiraclePtr bypass

The vulnerability bypasses MiraclePtr/BackupRefPtr because the user_param is registered as a const void* within ANGLE’s C API structure, crossing an FFI boundary where C++ smart pointers cannot protect it.

Suggested Fix

Ensure that the GL debug callback is unconditionally cleared during the destruction of the passthrough decoder, regardless of whether the context is considered lost.

In gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc, modify GLES2DecoderPassthroughImpl::Destroy:

  // Unconditionally clear the debug callback to prevent UAF.
  if (api()) {
      api()->glDebugMessageCallbackKHRFn(nullptr, nullptr);
  }

Evaluated with Chrome root at commit: f200f57a19490707ff8bc7aa5de3cbc443a3afad

Results so far have been promising, but there can be wrong deductions. If this proves to be a false positive, please close as WAI; data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.