Chrome · GPU
CVE-2026-14037
Logic Error in GPU
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
components/viz/service/frame_sinks/compositor_frame_sink_support.cccomponents/viz/service/frame_sinks/compositor_frame_sink_support_unittest.cc
Patch
From 8b19dcd1ffef5628f8b82b461884ef195470ffa2 Mon Sep 17 00:00:00 2001
From: Zhenyao Mo <zmo@chromium.org>
Date: Wed, 20 May 2026 08:59:31 -0700
Subject: [PATCH] viz: Support TreesInViz check in BindLayerContext
Bug: 496522611
Change-Id: I149e96384d9c161c6353a936ca90863accf1400c
TEST=viz_unittests
Change-Id: I149e96384d9c161c6353a936ca90863accf1400c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7861920
Auto-Submit: Zhenyao Mo <zmo@chromium.org>
Commit-Queue: Vasiliy Telezhnikov <vasilyt@chromium.org>
Reviewed-by: Vasiliy Telezhnikov <vasilyt@chromium.org>
Commit-Queue: Zhenyao Mo <zmo@chromium.org>
Reviewed-by: Tzarial <zork@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1633621}
---
diff --git a/components/viz/service/frame_sinks/compositor_frame_sink_support.cc b/components/viz/service/frame_sinks/compositor_frame_sink_support.cc
index d81eba6..8e3368626 100644
--- a/components/viz/service/frame_sinks/compositor_frame_sink_support.cc
+++ b/components/viz/service/frame_sinks/compositor_frame_sink_support.cc
@@ -624,6 +624,9 @@
void CompositorFrameSinkSupport::BindLayerContext(
mojom::PendingLayerContext& context,
mojom::LayerContextSettingsPtr settings) {
+ if (!base::FeatureList::IsEnabled(features::kTreesInViz)) {
+ return;
+ }
layer_context_ =
std::make_unique<LayerContextImpl>(this, context, std::move(settings));
}
diff --git a/components/viz/service/frame_sinks/compositor_frame_sink_support_unittest.cc b/components/viz/service/frame_sinks/compositor_frame_sink_support_unittest.cc
index bec1b6f..b18e905 100644
--- a/components/viz/service/frame_sinks/compositor_frame_sink_support_unittest.cc
+++ b/components/viz/service/frame_sinks/compositor_frame_sink_support_unittest.cc
@@ -2929,4 +2929,28 @@
support->SendCompositorFrameAck();
}
+TEST_P(AckOnSurfaceActivationWhenInteractiveTest,
+ TreesInVizDisabledDoesNotBindLayerContext) {
+ base::test::ScopedFeatureList scoped_feature_list;
+ scoped_feature_list.InitAndDisableFeature(features::kTreesInViz);
+ manager_->RegisterFrameSinkId(kAnotherArbitraryFrameSinkId,
+ true /* report_activation */);
+ MockCompositorFrameSinkClient mock_client;
+ auto support = std::make_unique<CompositorFrameSinkSupport>(
+ &mock_client, manager_.get(), kAnotherArbitraryFrameSinkId, kIsRoot);
+
+ auto context = mojom::PendingLayerContext::New();
+ mojo::AssociatedRemote<mojom::LayerContext> layer_context;
+ context->receiver = layer_context.BindNewEndpointAndPassReceiver();
+ MockLayerContextClient mock_layer_context_client;
+ mojo::AssociatedReceiver<mojom::LayerContextClient>
+ layer_context_client_receiver(
+ &mock_layer_context_client,
+ context->client.InitWithNewEndpointAndPassReceiver());
+
+ auto settings = mojom::LayerContextSettings::New();
+ support->BindLayerContext(*context, std::move(settings));
+ EXPECT_EQ(support->layer_context_for_testing(), nullptr);
+}
+
} // namespace viz
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/components/viz/service/frame_sinks/compositor_frame_sink_support_unittest.cc b/components/viz/service/frame_sinks/compositor_frame_sink_support_unittest.cc
index bec1b6f..b18e905 100644
--- a/components/viz/service/frame_sinks/compositor_frame_sink_support_unittest.cc
+++ b/components/viz/service/frame_sinks/compositor_frame_sink_support_unittest.cc
@@ -2929,4 +2929,28 @@
support->SendCompositorFrameAck();
}
+TEST_P(AckOnSurfaceActivationWhenInteractiveTest,
+ TreesInVizDisabledDoesNotBindLayerContext) {
+ base::test::ScopedFeatureList scoped_feature_list;
+ scoped_feature_list.InitAndDisableFeature(features::kTreesInViz);
+ manager_->RegisterFrameSinkId(kAnotherArbitraryFrameSinkId,
+ true /* report_activation */);
+ MockCompositorFrameSinkClient mock_client;
+ auto support = std::make_unique<CompositorFrameSinkSupport>(
+ &mock_client, manager_.get(), kAnotherArbitraryFrameSinkId, kIsRoot);
+
+ auto context = mojom::PendingLayerContext::New();
+ mojo::AssociatedRemote<mojom::LayerContext> layer_context;
+ context->receiver = layer_context.BindNewEndpointAndPassReceiver();
+ MockLayerContextClient mock_layer_context_client;
+ mojo::AssociatedReceiver<mojom::LayerContextClient>
+ layer_context_client_receiver(
+ &mock_layer_context_client,
+ context->client.InitWithNewEndpointAndPassReceiver());
+
+ auto settings = mojom::LayerContextSettings::New();
+ support->BindLayerContext(*context, std::move(settings));
+ EXPECT_EQ(support->layer_context_for_testing(), nullptr);
+}
+
} // namespace viz
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page