High chrome UAF 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactUse after free in Skia
DescriptionUse after free in Skia
ComponentSkia
Sub-componentGanesh
Bug ClassUAF
Tracker577403270
Fix commitab9b798555a6 (skia) +1/-1
CISA KEVNot listed
CreditedGoogle
Disclosed2026-10-29

Files Changed

  • src/gpu/ganesh/gl/GrGLCaps.cpp
From ab9b798555a6cc38e7adeacb86ca6a99c5be5819 Mon Sep 17 00:00:00 2001
From: Michael Ludwig <michaelludwig@google.com>
Date: Mon, 26 Oct 2026 11:07:50 -0400
Subject: [PATCH] [ganesh] Don't set texImageFormat for BGRA as RGBx

GrGLCaps already set fExternalTexImageFormat = 0 (disabling writes)
when using BGRA8 texture with the RGBA8 color type. However, BGRA8 as
RGBx8 was configured to allow writes with RGBA8 data. This is allowed
for GL but not GLES. For consistency with BGRA-as-RGBA, this treats
BGRA-as-RGBx the same (instead of branching on the GL standard).

Bug: b/577403270
Change-Id: I70d01796f508139b5c62b735b1e2e18e32c6d612
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/1405636
Commit-Queue: Greg Daniel <egdaniel@google.com>
Auto-Submit: Michael Ludwig <michaelludwig@google.com>
Reviewed-by: Greg Daniel <egdaniel@google.com>
---
diff --git a/src/gpu/ganesh/gl/GrGLCaps.cpp b/src/gpu/ganesh/gl/GrGLCaps.cpp
index 7232d90..0a185ea 100644
--- a/src/gpu/ganesh/gl/GrGLCaps.cpp
+++ b/src/gpu/ganesh/gl/GrGLCaps.cpp
@@ -2196,7 +2196,7 @@
                     auto& ioFormat = ctInfo.fExternalIOFormats[ioIdx++];
                     ioFormat.fColorType = GrColorType::kRGB_888x;
                     ioFormat.fExternalType = GR_GL_UNSIGNED_BYTE;
-                    ioFormat.fExternalTexImageFormat = GR_GL_RGBA;
+                    ioFormat.fExternalTexImageFormat = 0;
                     ioFormat.fExternalReadFormat = GR_GL_RGBA;
                 }
             }
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.