PatchGap
PatchGap · Weakness Pattern

Trusting GPU driver quirks, clear state, or layout math

WP-GPU-DRIVER
OOBUninitializedMemory 26 CVEs 26 mapped CWE-787CWE-125CWE-908CWE-1284 2026-05 → 2026-09

ANGLE, Dawn, Skia, and WebRTC repeatedly trust a GPU driver to behave as the graphics spec promises, honor an advertised capability, or compute a texture layout correctly, and trust their own cached view of driver binding/clear state. When the driver diverges, or when a stale binding, missing dirty bit, or wrong stride/block/level arithmetic sneaks a size mismatch into a copy, upload, blit, or clear, the result is an out-of-bounds access or memory that is used before it is initialized. Fixes almost never patch the driver; they blocklist or identity-gate the buggy vendor, sidestep the reachable code path, or correct the host-side layout math.

Invariant
The geometry, capability, and initialization state a graphics call relies on must be independently validated or conservatively bounded on the host side, never inferred from a driver’s word or a cached binding that may have silently diverged.

Mechanism

Three recurring mechanisms appear. First, host code trusts a driver quirk or advertised capability, e.g. Mali 32-bit stride wrap (CVE-2026-17726), a PowerVR level-size miscompute for non-zero base levels (CVE-2026-19157, CVE-2026-95350), or an Imagination dynamicRendering/cache defect (CVE-2026-87520, CVE-2026-91726). Second, a cache or clear operates on stale or wrongly-scoped state: a buffer rebind that never set mLocalDirtyBits (CVE-2026-10881, CVE-2026-10883), or a clear aimed at the client-bound draw framebuffer instead of the backbuffer (CVE-2026-87576). Third, host-side byte-layout math is wrong: chroma stride rounded down (CVE-2026-87430, CVE-2026-95322) or compressed textures measured in pixels rather than blocks (CVE-2026-9122, CVE-2026-95284). Each drives an OOB write or leaves memory uninitialized.

Fix shape

Blocklist or identity-gate the affected driver, or restructure the call to avoid the buggy fast path (split uploads, stage oversized levels, reset the base level to 0, recreate the texture), or correct the stride/block/dirty-bit computation on the host side.

CVEs in this pattern

6 components · WebGL, ANGLE, Dawn, GPU, WebRTC, Video
CVEWhatComponentVendorSeverityMonth
CVE-2026-84333 UAF in Daw Dawn chrome High 2026-09 🔧
CVE-2026-87430 OOB in WebRTC WebRTC chrome Low 2026-09 🔧
CVE-2026-87438 OOB in WebGL WebGL chrome Critical 2026-09 🔧
CVE-2026-87488 UAF in WebGL WebGL chrome Critical 2026-09 🔧
CVE-2026-87520 UAF in Daw Dawn chrome High 2026-09 🔧
CVE-2026-87576 UninitializedMemory in GPU GPU chrome Medium 2026-09 🔧
CVE-2026-91726 OOB in WebGL WebGL chrome Critical 2026-09 🔧
CVE-2026-93372 OOB in WebGL WebGL chrome Critical 2026-09 🔧
CVE-2026-95281 OOB in ANGLE ANGLE chrome Critical 2026-09 🔧
CVE-2026-95284 OOB in ANGLE ANGLE chrome Critical 2026-09 🔧
CVE-2026-95318 OOB in Video Video chrome High 2026-09 🔧
CVE-2026-95322 OOB in GPU GPU chrome Critical 2026-09 🔧
CVE-2026-95329 OOB in WebGL WebGL chrome Critical 2026-09 🔧
CVE-2026-95349 OOB in WebGL WebGL chrome Critical 2026-09 🔧
CVE-2026-95350 OOB in ANGLE ANGLE chrome Critical 2026-09 🔧
CVE-2026-95357 OOB in GPU GPU chrome Critical 2026-09 🔧
CVE-2026-19157 OOB in ANGLE ANGLE chrome Critical 2026-08 🔧
CVE-2026-76034 OOB in WebGL WebGL chrome Critical 2026-08 🔧
CVE-2026-76036 OOB in Daw Dawn chrome Critical 2026-08 🔧
CVE-2026-79282 UAF in ANGLE ANGLE chrome Critical 2026-08 🔧
CVE-2026-17726 IntegerOverflow in WebGL WebGL chrome High 2026-07 🔧
CVE-2026-17810 UninitializedMemory in Daw Dawn chrome Medium 2026-07 🔧
CVE-2026-10881 OOB in ANGLE ANGLE chrome Critical 2026-06 🔧
CVE-2026-10883 OOB in ANGLE ANGLE chrome Critical 2026-06 🔧
CVE-2026-9122 OOB in GPU GPU chrome Medium 2026-05 🔧
CVE-2026-9876 UAF in WebGL WebGL chrome Critical 2026-05 🔧

Hunt for siblings

Auditors and scanners should flag graphics call sites that consume a driver-reported limit or capability without a conservative clamp, cache updates that mutate a binding without a matching dirty bit, and pixel/stride math that omits block-compression or chroma-rounding cases; fuzzers should vary base level, NPOT/odd dimensions, and compressed formats.

Mitigations that would catch this class

  • Maintain per-vendor/per-version driver blocklists and force safe fallback paths for known-buggy hardware rather than trusting advertised capabilities.
  • Validate texture dimensions, mip-level extents, and buffer strides on the host against conservative known-safe bounds before handing them to the driver.
  • Keep cache/dirty-bit bookkeeping authoritative so every internal binding or state change is reflected before the next sync/transfer.
← All weakness patterns