Chrome · WebGPU
CVE-2026-2315
Logic Error in WebGPU
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
src/dawn/native/vulkan/PhysicalDeviceVk.cppwebgpu-cts/expectations.txt
Patch
From 4c7d0f5ecc872898bd236e423fbd2be5f8666992 Mon Sep 17 00:00:00 2001
From: Peter McNeeley <petermcneeley@google.com>
Date: Wed, 28 Jan 2026 06:05:12 -0800
Subject: [PATCH] [dawn] Disable extension workgroup zero init on pixel 10
Bug: 479242793
Change-Id: Ie53495eb7d2b9939abb3a17691e49a9f6369b9be
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/287195
Reviewed-by: dan sinclair <dsinclair@chromium.org>
Reviewed-by: Loko Kung <lokokung@google.com>
Commit-Queue: Peter McNeeley <petermcneeley@google.com>
---
diff --git a/src/dawn/native/vulkan/PhysicalDeviceVk.cpp b/src/dawn/native/vulkan/PhysicalDeviceVk.cpp
index c9fa553..f925819 100644
--- a/src/dawn/native/vulkan/PhysicalDeviceVk.cpp
+++ b/src/dawn/native/vulkan/PhysicalDeviceVk.cpp
@@ -1089,10 +1089,11 @@
// extension is available. Override the decision if it is not applicable or
// zeroInitializeWorkgroupMemoryFeatures.shaderZeroInitializeWorkgroupMemory == VK_FALSE.
// Never use the extension on Mali devices due to a known bug (see crbug.com/tint/2101).
+ // Pixel 10 workgroup zero init does not always work as expected (see crbug.com/479242793).
if (!GetDeviceInfo().HasExt(DeviceExt::ZeroInitializeWorkgroupMemory) ||
GetDeviceInfo().zeroInitializeWorkgroupMemoryFeatures.shaderZeroInitializeWorkgroupMemory ==
VK_FALSE ||
- IsAndroidARM()) {
+ IsAndroidARM() || IsPixel10()) {
deviceToggles->ForceSet(Toggle::VulkanUseZeroInitializeWorkgroupMemoryExtension, false);
}
// By default try to initialize workgroup memory with OpConstantNull according to the Vulkan
diff --git a/webgpu-cts/expectations.txt b/webgpu-cts/expectations.txt
index 9ed6a1a..5419551 100644
--- a/webgpu-cts/expectations.txt
+++ b/webgpu-cts/expectations.txt
@@ -1716,30 +1716,6 @@
crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,statement,discard:three_quarters:useStorageBuffers=true [ Failure ]
crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,statement,discard:uniform_read_loop:useStorageBuffers=true [ Failure ]
crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,statement,phony:executes:case="loop" [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=18 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=19 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=21 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=22 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=23 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=24 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=25 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=26 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=28 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=29 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=15 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=16 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=17 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=19 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=20 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=21 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=22 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=23 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=24 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=25 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=26 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=27 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=28 [ Failure ]
-crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=29 [ Failure ]
crbug.com/0000 [ android-pixel-10 ] webgpu:shader,validation,expression,call,builtin,textureSampleBaseClampToEdge:* [ Failure ]
crbug.com/0000 [ android-pixel-10 ] webgpu:shader,validation,expression,call,builtin,textureSampleBias:* [ Failure ]
crbug.com/0000 [ android-pixel-10 ] webgpu:shader,validation,expression,call,builtin,textureSampleCompare:* [ Failure ]
Loading diff…
Original Bug Report
reported by pe...@google.com
Use dawn workgroup zero init fallback for pixel 10
The vulkan extension for workgroup zero init may not always work as intended.
Use the tint fallback for now.
View on issue tracker
References
On This Page