A size or count is computed in a type too narrow to hold it

OOBIntegerOverflow 28 CVEs 28 mapped CWE-190CWE-131CWE-787 2025-01 → 2026-09

A byte size, element count, or index that can legally exceed a fixed-width type’s range is computed or stored in 32/16-bit, wraps to a small value, and then bounds an allocation or copy — producing an undersized buffer and an out-of-bounds write.

Invariant

A size, count, or index that can exceed a fixed-width type’s range must be computed and stored wide enough (size_t/uint64) and validated before it bounds an allocation or copy.

Mechanism

A size is computed in 32-bit or stored in a uint16_t/uint32_t: width*height*depth*bpp*layers, an IndexRange count, a debug-marker string length, D3D12 DepthOrArraySize, a Skia ResourceKey byte size. For large-but-legal dimensions the multiply or the store overflows and wraps to a small value.

The undersized allocation is then filled with the true (large) amount → heap buffer overflow; or the wrapped count is trusted by a downstream bounds check that now passes for an oversized draw/copy. All reachable from WebGL/WebGPU content that picks the dimensions.

Fix shape

Compute in size_t/uint64_t (stepwise, with static_asserts bounding the intermediates), wrap the result in CheckedNumeric and ValueOrDie(), cap the max element index below the wrap boundary, or return OOM when the value would exceed the field.

CVEs in this pattern

10 components · V8, ANGLE, Skia, Dawn, Media, Safebrowsing, WebRTC, Metrics, Chromecast, Turbofan

CVE	What	Component	Vendor	Severity	Month
CVE-2026-87529	LogicError in Media	Media	chrome	Medium	2026-09	🔧
CVE-2026-87546	TypeConfusion in Safebrowsing	Safebrowsing	chrome	Low	2026-09	🔧
CVE-2026-87630	IntegerOverflow in WebRTC	WebRTC	chrome	Medium	2026-09	🔧
CVE-2026-87654	OOB in ANGLE	ANGLE	chrome	High	2026-09	🔧
CVE-2026-91728	IntegerOverflow in V8	V8	chrome	High	2026-09	🔧
CVE-2026-95308	IntegerOverflow in Metrics	Metrics	chrome	Low	2026-09	🔧
CVE-2026-19174	IntegerOverflow in V8	V8	chrome	High	2026-08	🔧
CVE-2026-79292	IntegerOverflow in Chromecast	Chromecast	chrome	High	2026-08	🔧
CVE-2026-10921	IntegerOverflow in Daw	Dawn	chrome	High	2026-06	🔧
CVE-2026-11044	IntegerOverflow in ANGLE	ANGLE	chrome	Medium	2026-06	🔧
CVE-2026-10964	IntegerOverflow in V8	V8	chrome	High	2026-06	🔧
CVE-2026-10987	IntegerOverflow in V8	V8	chrome	High	2026-06	🔧
CVE-2026-11211	IntegerOverflow in V8	V8	chrome	Medium	2026-06	🔧
CVE-2026-14389	IntegerOverflow in Skia	Skia	chrome	Medium	2026-06	🔧
CVE-2026-14430	IntegerOverflow in V8	V8	chrome	High	2026-06	🔧
CVE-2026-9882	IntegerOverflow in ANGLE	ANGLE	chrome	Critical	2026-05	🔧
CVE-2026-7973	IntegerOverflow in Daw	Dawn	chrome	Medium	2026-05	🔧
CVE-2026-8519	IntegerOverflow in ANGLE	ANGLE	chrome	Critical	2026-05	🔧
CVE-2026-8567	IntegerOverflow in ANGLE	ANGLE	chrome	Medium	2026-05	🔧
CVE-2026-9968	IntegerOverflow in V8	V8	chrome	High	2026-05	🔧
CVE-2026-6298	OOB in Skia	Skia	chrome	Critical	2026-04	🔧
CVE-2026-6301	TypeConfusion in Turbofa	Turbofan	chrome	High	2026-04	🔧
CVE-2026-3536	IntegerOverflow in ANGLE	ANGLE	chrome	Critical	2026-03	🔧
CVE-2026-3538	IntegerOverflow in Skia	Skia	chrome	Critical	2026-03	🔧
CVE-2025-10891	IntegerOverflow in V8	V8	chrome	High	2025-09	🔧
CVE-2025-8011	TypeConfusion in V8	V8	chrome	High	2025-07	🔧
CVE-2025-6191	IntegerOverflow in V8	V8	chrome	High	2025-06	🔧
CVE-2025-0436	IntegerOverflow in Skia	Skia	chrome	High	2025-01	🔧

Hunt for siblings

Look for a size/count multiply in 32-bit feeding an allocation, and for size/length values stored in a narrower type than they can reach.

weggli (structural)

# Size multiply in narrow ints feeding an allocation:
weggli --cpp '{ int $n = $a * $b; _ = malloc($n); }'
# Length truncated on the way into a record:
weggli --cpp '{ $len = (uint32_t)$s.length(); }'

Mitigations that would catch this class

CheckedNumeric/base::CheckMul by construction for every size arithmetic
Fuzzing with maximal legal dimensions (the wrap boundary, e.g. 0x10000000, UINT16_MAX)
Static analysis for narrowing casts on size/length expressions

← All weakness patterns