Low chrome UAF 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactUse after free in ANGLE
DescriptionUse after free in ANGLE
ComponentANGLE
Bug ClassUAF
Tracker497670996
Fix commita17389c0182a (angle/angle) +9/-11
CISA KEVNot listed
CreditedGoogle
Disclosed2026-06-30

Files Changed

  • src/libGLESv2/egl_ext_stubs.cpp
  • src/libGLESv2/egl_stubs.cpp
From a17389c0182affe7dc3863efe0ff4aa0e48178e0 Mon Sep 17 00:00:00 2001
From: Shahbaz Youssefi <syoussefi@chromium.org>
Date: Tue, 12 May 2026 15:23:44 -0400
Subject: [PATCH] Stop revalidating the sync object in ClientWaitSync

The entry point already gets the sync object to operate on, so the error
paths can directly use that instead of calling `GetSyncIfValid` to
validate and get it again.

This change also makes sure that a SyncID look up is not done in the
unlocked tail of the call.

Bug: chromium:497670996
Change-Id: If8a53f947a815acd51fb172f03ae5bdfc1dc8465
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7841557
Reviewed-by: Geoff Lang <geofflang@chromium.org>
Commit-Queue: Shahbaz Youssefi <syoussefi@chromium.org>
---

diff --git a/src/libGLESv2/egl_ext_stubs.cpp b/src/libGLESv2/egl_ext_stubs.cpp
index 1071199..91fb652 100644
--- a/src/libGLESv2/egl_ext_stubs.cpp
+++ b/src/libGLESv2/egl_ext_stubs.cpp
@@ -32,21 +32,20 @@
                                           GetDisplayIfValid(display), EGL_FALSE);
     gl::Context *currentContext = thread->getContext();
     EGLint syncStatus           = EGL_FALSE;
-    Sync *sync                  = display->getSync(syncID);
-    ANGLE_EGL_TRY_RETURN(thread,
-                         sync->clientWait(display, currentContext, flags, timeout, &syncStatus),
-                         "eglClientWaitSyncKHR", GetSyncIfValid(display, syncID), EGL_FALSE);
+    Sync *syncObject            = display->getSync(syncID);
+    ANGLE_EGL_TRY_RETURN(
+        thread, syncObject->clientWait(display, currentContext, flags, timeout, &syncStatus),
+        "eglClientWaitSyncKHR", syncObject, EGL_FALSE);
 
     // When performing CPU wait through UnlockedTailCall we need to handle any error conditions
     if (egl::Display::GetCurrentThreadUnlockedTailCall()->any())
     {
-        auto handleErrorStatus = [thread, display, syncID](void *result) {
+        auto handleErrorStatus = [thread, syncObject](void *result) {
             EGLint *eglResult = static_cast<EGLint *>(result);
             ASSERT(eglResult);
             if (*eglResult == EGL_FALSE)
             {
-                thread->setError(egl::Error(EGL_BAD_ALLOC), "eglClientWaitSyncKHR",
-                                 GetSyncIfValid(display, syncID));
+                thread->setError(egl::Error(EGL_BAD_ALLOC), "eglClientWaitSyncKHR", syncObject);
             }
             else
             {
diff --git a/src/libGLESv2/egl_stubs.cpp b/src/libGLESv2/egl_stubs.cpp
index 5b50837..d9db6c8 100644
--- a/src/libGLESv2/egl_stubs.cpp
+++ b/src/libGLESv2/egl_stubs.cpp
@@ -100,18 +100,17 @@
     Sync *syncObject            = display->getSync(syncID);
     ANGLE_EGL_TRY_RETURN(
         thread, syncObject->clientWait(display, currentContext, flags, timeout, &syncStatus),
-        "eglClientWaitSync", GetSyncIfValid(display, syncID), EGL_FALSE);
+        "eglClientWaitSync", syncObject, EGL_FALSE);
 
     // When performing CPU wait through UnlockedTailCall we need to handle any error conditions
     if (egl::Display::GetCurrentThreadUnlockedTailCall()->any())
     {
-        auto handleErrorStatus = [thread, display, syncID](void *result) {
+        auto handleErrorStatus = [thread, syncObject](void *result) {
             EGLint *eglResult = static_cast<EGLint *>(result);
             ASSERT(eglResult);
             if (*eglResult == EGL_FALSE)
             {
-                thread->setError(egl::Error(EGL_BAD_ALLOC), "eglClientWaitSync",
-                                 GetSyncIfValid(display, syncID));
+                thread->setError(egl::Error(EGL_BAD_ALLOC), "eglClientWaitSync", syncObject);
             }
             else
             {
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.