Chrome · WebGL › GL
CVE-2026-103628
OOB in WebGL (GL)
Overview
Critical
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
src/libANGLE/renderer/gl/renderergl_utils.cppsrc/libANGLE/renderer/gl/TextureGL.cppinclude/platform/gl_features.json
Patch
From cdea97f48c9fcdad495c4c9a3fff95afbc3f29c9 Mon Sep 17 00:00:00 2001
From: Brandon Jones <bajones@chromium.org>
Date: Tue, 15 Sep 2026 14:09:44 -0700
Subject: [PATCH] GL: Change mipmap workaround from flush to forcefullyFlush
An existing workaround for IMG GPUs inserts a flush prior to any
generateMipmaps calls, but a separate issue was discovered with the
same GPUs that requires a forced flush or finish to resolve. Updates
the flush to a forcefullyFlush to ensure that the issue is avoided.
Bug: chromium:549995090
Change-Id: Ifd7d45b9fcf26f4755730c770e9dae5e84688f52
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/8414369
Reviewed-by: Geoff Lang <geofflang@chromium.org>
Reviewed-by: Kenneth Russell <kbr@chromium.org>
Auto-Submit: Brandon Jones <bajones@chromium.org>
Commit-Queue: Shahbaz Youssefi <syoussefi@chromium.org>
---
diff --git a/include/platform/gl_features.json b/include/platform/gl_features.json
index 82506cf..2a90427 100644
--- a/include/platform/gl_features.json
+++ b/include/platform/gl_features.json
@@ -977,7 +977,7 @@
"description": [
"Force a flush before calling generateMipmap to work around driver bugs."
],
- "issue": "http://crbug.com/549350408"
+ "issue": "http://crbug.com/549350408 https://crbug.com/549995090"
},
{
"name": "split_level_0_pbo_full_sub_image_2D",
diff --git a/src/libANGLE/renderer/gl/TextureGL.cpp b/src/libANGLE/renderer/gl/TextureGL.cpp
index 71fb6e7..0ae680b 100644
--- a/src/libANGLE/renderer/gl/TextureGL.cpp
+++ b/src/libANGLE/renderer/gl/TextureGL.cpp
@@ -1844,9 +1844,8 @@
if (features.flushBeforeGenerateMipmap.enabled)
{
- // Force a flush before generating the mipmap, which avoids a bad state in the IMG driver if
- // the texture's base level is still bound to an active FBO.
- ANGLE_GL_TRY(context, functions->flush());
+ // Force a flush before generating the mipmap, which avoids bad states in the IMG driver.
+ ANGLE_GL_TRY(context, stateManager->forcefullyFlush());
}
stateManager->bindTexture(getType(), mTextureID);
diff --git a/src/libANGLE/renderer/gl/renderergl_utils.cpp b/src/libANGLE/renderer/gl/renderergl_utils.cpp
index 558a872..060321a 100644
--- a/src/libANGLE/renderer/gl/renderergl_utils.cpp
+++ b/src/libANGLE/renderer/gl/renderergl_utils.cpp
@@ -2758,8 +2758,7 @@
// Disable EXT_clear_texture entirely on IMG as a speculative fix for driver crashes.
ANGLE_FEATURE_CONDITION(features, disableClearTexture, IsPowerVR(vendor));
- // Forces a flush before generating a mipmap, which avoids a bad state in the IMG driver if
- // the texture's base level is still bound to an active FBO.
+ // Forces a flush before generating a mipmap, which avoids bad states in the IMG driver.
ANGLE_FEATURE_CONDITION(features, flushBeforeGenerateMipmap, IsPowerVR(vendor));
// IMG GL drivers crash while compiling shaders with more than the limit of uniform blocks.
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page