Chrome · GPU
CVE-2026-14049
Logic Error in GPU
Overview
Low
Severity
5.3
CVSS
No
Exploited ITW
Fixed
Fix Status
Background
- `gpu::gles2::Logger`
- the GPU-process helper that formats and emits GL error/log messages for a command-buffer decoder context.
- `this_in_hex_`
- a
std::stringmember that pre-formatted the logger object’s ownthisheap address as hex into a fallback log prefix. - `GetLogPrefix()`
- the method that returns the string prepended to GL log messages, using the current debug marker or, if empty, the fallback prefix.
- ASLR
- Address Space Layout Randomization, the mitigation that makes heap/code addresses unpredictable to hinder exploitation.
Root Cause Analysis
The
Logger constructor built this_in_hex_ by formatting reinterpret_cast<uintptr_t>(this) into a string, and GetLogPrefix() returned that string whenever the debug marker was empty. Because GL error logs are observable to web content (e.g., via console/error surfaces), this leaked the logger object’s live heap address to the renderer/attacker, providing a deterministic ASLR bypass for the GPU process. The prefix logic existed only to work around a since-closed bug (crbug.com/242999), so the fix removes the this_in_hex_ member and its constructor formatting, and rewrites GetLogPrefix() to simply return debug_marker_manager_->GetMarker(). With no pointer ever embedded in log output, the information-disclosure primitive is eliminated.Key insight
The single mistake was embedding a raw
this heap pointer into attacker-observable GL log output; the fix deletes this_in_hex_ and returns only the debug marker from GetLogPrefix(), removing the address leak.Attack Path
- Trigger an empty-marker GL error
Web content drives WebGL/GPU operations that generate a synthesized GL error/log while no debug marker is set, so
GetLogPrefix()falls back tothis_in_hex_. - Leak the pointer
The emitted log prefix contains the hex
thisaddress of the GPU-processLoggerobject, which the attacker reads from the observable error/log output. - Defeat ASLR The disclosed heap address lets the attacker compute GPU-process layout, providing a deterministic ASLR bypass.
- Aid further exploitation The leaked address can be combined with a separate memory-corruption bug to build a reliable exploit (inferred); this patch addresses only the disclosure.
Impact Assessment
An attacker running web content gains a deterministic leak of a GPU-process heap address, defeating ASLR in that process and easing exploitation of a separate memory-corruption vulnerability. The precondition is the ability to trigger GL error logging that reaches observable output while no debug marker is present. The advisory classifies this as inappropriate implementation in GPU (an information disclosure / ASLR bypass); any chained code execution is (inferred) and no exploited-in-the-wild status is stated.
Changed Functions
| Function | Change | Notes |
|---|---|---|
disable_gl_error_limit_gpu/command_buffer/service/logger.cc |
modified |
Files Changed
gpu/command_buffer/service/logger.ccgpu/command_buffer/service/logger.h
Audit Directions
- Pointers in log/error stringsGrep for
reinterpret_cast<uintptr_t>(this),%p, and pointer formatting that flows into any log, error, or exception message reachable by web content. - Attacker-observable diagnostic outputAudit GPU/renderer diagnostic and console-error paths for embedded addresses or other layout-revealing values.
- Stale workaround codeReview prefix/fallback logic tied to closed bug references (like
crbug.com/242999) that may still expose sensitive data after the original defect was fixed.
Patch
From a4438e3326664624b9190b95e6ddeeab2b3cccd8 Mon Sep 17 00:00:00 2001
From: Arthur Sonzogni <arthursonzogni@chromium.org>
Date: Tue, 19 May 2026 07:21:34 -0700
Subject: [PATCH] Remove this_in_hex_ from gpu::gles2::Logger
The gpu::gles2::Logger class was leaking its heap address in GL error
logs by including its 'this' pointer in the fallback prefix string. This
provided a deterministic heap ASLR bypass for the GPU process.
The underlying bug is closed (crbug.com/242999), so this prefix logic
is no longer required. This patch removes the 'this_in_hex_' member and
its associated formatting code.
Bug: 41013722
Fixed: 501659888
Change-Id: I32b49c87eeaaea9c4c8c45a8fe97784b20e75f82
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7852758
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Auto-Submit: Arthur Sonzogni <arthursonzogni@chromium.org>
Commit-Queue: Corentin Wallez <cwallez@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1632839}
---
diff --git a/gpu/command_buffer/service/logger.cc b/gpu/command_buffer/service/logger.cc
index 3e100cb4..6b8f706 100644
--- a/gpu/command_buffer/service/logger.cc
+++ b/gpu/command_buffer/service/logger.cc
@@ -23,9 +23,6 @@
log_message_count_(0),
log_synthesized_gl_errors_(true),
disable_gl_error_limit_(disable_gl_error_limit) {
- this_in_hex_ =
- base::StringPrintf("GroupMarkerNotSet(crbug.com/242999)!:%" PRIXPTR,
- reinterpret_cast<uintptr_t>(this));
suppress_performance_logs_ =
base::CommandLine::ForCurrentProcess()->HasSwitch(
switches::kSuppressPerformanceLogs);
@@ -56,8 +53,7 @@
}
const std::string& Logger::GetLogPrefix() const {
- const std::string& prefix(debug_marker_manager_->GetMarker());
- return prefix.empty() ? this_in_hex_ : prefix;
+ return debug_marker_manager_->GetMarker();
}
bool Logger::SuppressPerformanceLogs() const {
diff --git a/gpu/command_buffer/service/logger.h b/gpu/command_buffer/service/logger.h
index 4830a453..6818a79 100644
--- a/gpu/command_buffer/service/logger.h
+++ b/gpu/command_buffer/service/logger.h
@@ -52,7 +52,6 @@
// Uses the current marker to add information to logs.
raw_ptr<const DebugMarkerManager> debug_marker_manager_;
const LogMessageCallback log_message_callback_;
- std::string this_in_hex_;
int log_message_count_;
bool log_synthesized_gl_errors_;
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page