adf0c557b6d774238c2a1625ecffa8c1bfec231b  [M151] Validate framebufferTextureMultiviewOVR target, attachment

The bug at a glance

framebufferTextureMultiviewOVR previously passed the WebGL target and attachment enums through to the command buffer without the standard framebuffer-function validation, which the author states could cause resource-tracking issues for out-of-range values; it was deemed worth a release-branch cherry-pick (M151) but the described impact is bounded resource-tracking inconsistency rather than a demonstrated memory-corruption primitive, so low-to-medium.

Any web page using the OVR_multiview2 WebGL2 extension can call framebufferTextureMultiviewOVR with an out-of-range target or attachment; without validation the renderer’s framebuffer attachment bookkeeping can be driven into an invalid state, a classic WebGL attack surface for GPU-process confusion.

Root cause

In ovr_multiview_2.cc the OVR_multiview2::framebufferTextureMultiviewOVR path validated texture target, layer, and level but never validated the framebuffer target and attachment arguments. The patch adds a ValidateFramebufferFuncParameters(“framebufferTextureMultiviewOVR”, target, attachment) check (the same validation framebufferTexture2D uses) and returns early on failure, so an out-of-range target/attachment is rejected before reaching attachment tracking and the GL command buffer.

Key code

Adds framebuffer target/attachment validation before the OVR multiview attach

+    if (!static_cast<WebGL2RenderingContextBase*>(scoped.Context())
+             ->ValidateFramebufferFuncParameters(
+                 "framebufferTextureMultiviewOVR", target, attachment)) {
+      return;
+    }

Patch walkthrough

• third_party/blink/renderer/modules/webgl/ovr_multiview_2.cc — Inserts the standard ValidateFramebufferFuncParameters check so target and attachment are validated identically to framebufferTexture2D; previously out-of-range enums flowed into framebuffer attachment tracking unchecked, risking inconsistent resource state in the renderer/GPU bookkeeping.

Background

OVR_multiview2 — WebGL2 extension that attaches a texture’s array layers to a framebuffer for multiview (e.g. stereo VR) rendering.

ValidateFramebufferFuncParameters — Shared WebGL2 helper that checks the framebuffer target and attachment-point enums are in the allowed set for the current context.

Attachment tracking — Blink’s per-framebuffer bookkeeping of which textures/renderbuffers occupy each attachment point, used for completeness and lifetime management.

Vulnerability window

1. Reachability — Reachable from ordinary web content in a stock build via a WebGL2 context plus the OVR_multiview2 extension; no flag or special gesture required.
2. Trigger — Script calls framebufferTextureMultiviewOVR with an out-of-range target or attachment enum.
3. Primitive — Unvalidated values reach framebuffer attachment tracking, producing inconsistent resource-tracking state (inferred extent; diff cites resource-tracking issues, not confirmed corruption).

Proof of concept

Conceptually: obtain a WebGL2 context, enable OVR_multiview2, create a framebuffer and 2D array texture, then invoke framebufferTextureMultiviewOVR passing a bogus target/attachment enum value outside the valid set; pre-patch this bypassed validation. No exploit code provided.

Exploitation

1. Setup — Create WebGL2 context and enable the OVR_multiview2 extension from untrusted script.
2. Trigger — Call framebufferTextureMultiviewOVR with out-of-range target/attachment to reach the unvalidated path.
3. Impact — Drive framebuffer attachment bookkeeping into an invalid state; any further escalation to memory corruption is unshown and (inferred).

Detection & hunting

For defenders and detection engineers:

• grep ‘framebufferTextureMultiviewOVR’ and nearby Validate calls* — Audit multiview/framebuffer entry points for a ValidateFramebufferFuncParameters call on target+attachment before attachment tracking.
• weggli for WebGL framebuffer entry points lacking ValidateFramebufferFuncParameters — Flag any WebGL framebufferTexture* variant that validates texture args but not the framebuffer target/attachment.

Audit directions

• Other WebGL/WebGL2 framebuffer attachment methods (framebufferTextureLayer, framebufferRenderbuffer, extension-provided attach calls) — Confirm each performs the same target/attachment validation as framebufferTexture2D before touching attachment tracking or the command buffer.