Chrome · WebGL › GPU
CVE-2026-106239
Integer Overflow in WebGL (GPU)
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
gpu/config/gpu_driver_bug_list.json
Patch
From ffa67bc6b5b0d34e75eec39e6e961b29b08bdf4e Mon Sep 17 00:00:00 2001
From: Ken Russell <kbr@chromium.org>
Date: Fri, 11 Sep 2026 07:52:02 -0700
Subject: [PATCH] GPU: enable adjust_src_dst_region_for_blitframebuffer on Mali.
The adjust_src_dst_region_for_blitframebuffer workaround added some
time ago is needed on Mali GPUs as well.
Bug: 546630009
Change-Id: I73f55414ab5d43fbb48a724685d17d56b95d7eca
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8395847
Commit-Queue: Geoff Lang <geofflang@chromium.org>
Reviewed-by: Geoff Lang <geofflang@chromium.org>
Auto-Submit: Kenneth Russell <kbr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1696236}
---
diff --git a/gpu/config/gpu_driver_bug_list.json b/gpu/config/gpu_driver_bug_list.json
index 0804efc..5a120c8 100644
--- a/gpu/config/gpu_driver_bug_list.json
+++ b/gpu/config/gpu_driver_bug_list.json
@@ -3956,6 +3956,18 @@
"features": [
"recreate_mipmap_levels_before_generate"
]
+ },
+ {
+ "id": 499,
+ "description": "adjust src/dst region if blitting pixels outside framebuffer on Android Mali",
+ "cr_bugs": [546630009],
+ "os": {
+ "type": "android"
+ },
+ "gl_vendor": "ARM.*",
+ "features": [
+ "adjust_src_dst_region_for_blitframebuffer"
+ ]
}
]
}
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page