Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: A vulnerability in CompoundImageBacking allows a compromised renderer to read uninitialized GPU VRAM. If a transient backing’s proactive copy-back fails under memory pressure, subsequent reads skip synchronization, allowing the read of uninitialized textures that bypass the IsCleared() gate.

Affected files:

• gpu/command_buffer/service/shared_image/compound_image_backing.cc
• gpu/command_buffer/service/shared_image/wrapped_sk_image_backing.cc
• gpu/command_buffer/service/shared_image/shared_image_representation.cc

Estimated timestamp from git blame: 2026-05-07

1. Summary of the Issue (Meant for Human Triage)

A potential security vulnerability exists in CompoundImageBacking due to an oversight in handling proactive copy-back failures for transient backings. This vulnerability allows a compromised renderer to bypass synchronization and read physically uninitialized, driver-recycled GPU VRAM, presenting a significant cross-origin data exposure risk (GPU-XO).

When the features::kUseDynamicBackingAllocations flag is enabled (currently FEATURE_DISABLED_BY_DEFAULT), CompoundImageBacking supports dynamic lazy creation of GPU backings. If a transient backing is created (e.g., inside a thread-safe container like DrDC/WebView) and written to, its content must be proactively copied back to permanent backings inside NotifyEndAccess. If this proactive copy-back fails (which an attacker can induce by causing staging-buffer allocation failures via memory-pressure spraying), the code logs an error and continues without updating the permanent backing’s content_id_.

Subsequently, a read access on a lazily allocated GPU backing triggers NotifyBeginAccess. Because no permanent backing matches the latest_content_id_, GetElementWithLatestContent() returns nullptr. This causes the entire synchronization block to be skipped. NotifyBeginAccess returns true (success). Because the CompoundImageBacking container was artificially marked fully cleared upon creation with a shared memory backing, the outer IsCleared() validation passes. The renderer then reads directly from the physically uninitialized backend GPU texture, leaking cross-origin graphical content from recycled driver VRAM.

2. Proof-of-Concept & Detailed Execution Flow

Note: Our tooling agent does not have the ability to run code. The steps below are a potential, theoretically verified sequence based on static analysis of the codebase.

Step-by-Step Sequence:

1. Precondition: The feature features::kUseDynamicBackingAllocations must be enabled.
2. Container Creation: A compromised renderer (A-RENDERER) sends a mojom::DeferredSharedImageRequest{kCreateSharedImageWithBuffer} IPC over its GpuChannel to create a CompoundImageBacking backed by a SHARED_MEMORY_BUFFER.
3. The renderer specifies usage flags (e.g., SHARED_IMAGE_USAGE_DISPLAY_READ | SHARED_IMAGE_USAGE_CPU_WRITE_ONLY) causing SharedImageFactory::CreateSharedImage to fall back to CompoundImageBacking::Create.
4. During initialization, CompoundImageBacking::ComputeIsThreadSafe evaluates factory->shared_image_manager_->display_context_on_another_thread() to true (e.g., on DrDC or WebView). This forces is_thread_safe to true, making the CompoundImageBacking a thread-safe container.
5. The constructor initializes the primary shared memory backing as elements_[0], sets has_shm_backing_ = true, and crucially marks the compound container as fully cleared via SetClearedRectInternal(gfx::Rect(size)) (compound_image_backing.cc:1157).
6. The container initializes latest_content_id_ = 1 and elements_[0].content_id_ = 1.
7. Transient Write Access: The renderer initiates a Write access on a stream (e.g., kSkia) that triggers dynamic backing allocation.
8. GetOrAllocateBacking falls back to SharedImageFactory to dynamically allocate a new GPU backing (CreateBackingFromBackingFactory).
9. Because the compound container is thread-safe but the new GPU backing is not, the code treats it as a transient backing (compound_image_backing.cc:2038). It is returned via out_transient_backing and not added to the permanent elements_ list.
10. The wrapper calls NotifyBeginAccess on the transient backing with mode = kWrite.
11. GetElementWithLatestContent() returns elements_[0]. copy_manager_->CopyImage successfully syncs data. latest_content_id_ increments to 2. Because it is transient, access_element is nullptr, so no permanent element’s content_id_ is updated.
12. Induced Copy Failure: The wrapper calls EndWriteAccess, invoking NotifyEndAccess(backing, kWrite). This detects the transient backing and attempts a proactive copy-back to elements_[0] (compound_image_backing.cc:1361).
13. The attacker concurrently induces extreme GPU memory pressure (e.g., spraying SharedImages), exhausting staging/transfer buffers. The copy_manager_->CopyImage fails.
14. The code logs "DCSI: Proactive copy ... failed." but critically continues without updating elements_[0].content_id_ to 2 (compound_image_backing.cc:1370). The transient backing is destroyed. latest_content_id_ is 2, but the permanent element has 1.
15. Uninitialized Read: The renderer initiates a Read access (e.g., ReadbackARGBImagePixelsINTERNALImmediate) using a stream that requires a new permanent GPU backing (e.g., GLTextureImageBacking).
16. GetOrAllocateBacking allocates the new GPU backing. Because has_shm_backing_ is true, backing->SetCleared() is called unconditionally (compound_image_backing.cc:2106).
17. This prematurely marks the new backing as physically initialized, despite containing recycled, uninitialized driver VRAM. It is added as elements_[1] with content_id_ = 0.
18. NotifyBeginAccess is called with mode = kRead.
19. GetElementWithLatestContent() looks for an element with content_id_ == 2. Since elements_[0] is 1 and elements_[1] is 0, it returns nullptr (compound_image_backing.cc:1953).
20. Because latest_content_element is nullptr, the physical synchronization block (if (latest_content_element)) is bypassed entirely (compound_image_backing.cc:1262).
21. NotifyBeginAccess returns true (success).
22. The representation wrapper (e.g., SkiaGaneshImageRepresentation::BeginScopedReadAccess) checks IsCleared(). This delegates to CompoundImageBacking::ClearedRect(), which returns the full image bounds set in Step 5.
23. The gate passes. The renderer reads the newly allocated, physically uninitialized GPU backing. Backend texture allocations (Vulkan, D3D, Metal) do not zero-fill in release builds, exposing recycled driver VRAM to the attacker.

Suggested Fix: In CompoundImageBacking::NotifyBeginAccess, if latest_content_element returns nullptr but latest_content_id_ > 1 (meaning valid data existed but was lost during a failed proactive copy-back), NotifyBeginAccess should explicitly return false to abort the read. Alternatively, in NotifyEndAccess, if the proactive copy-back fails, the container should be marked into a degraded/invalid state that forces subsequent accesses to fail gracefully.

3. Technical Verification Details (Automated Audit Logs)

> Severity: High (S1) > Brief Notes / Reasoning: > The primary variant described in the report is invalid (S4). NotifyBeginAccess is declared as [[nodiscard]] bool, and all representation wrappers (e.g., WrappedSkiaGaneshCompoundImageRepresentation::BeginReadAccess) explicitly check its return value. If CopyImage fails, NotifyBeginAccess returns false, and the wrapper early-returns, safely preventing the read. The report’s claim that it returns void and falls through is incorrect for the current codebase. > > However, the secondary sub-variant (latest_content_element == nullptr) is structurally valid. When features::kUseDynamicBackingAllocations is enabled, a transient backing can be created. During a write access on a transient backing, NotifyBeginAccess increments latest_content_id_. If the proactive copy-back to the SHM backing in NotifyEndAccess fails (e.g., due to staging buffer allocation failure from memory pressure), no permanent element’s content_id_ is updated. A subsequent read on a lazily-allocated GPU backing causes GetElementWithLatestContent() to return nullptr. NotifyBeginAccess skips the copy block entirely and returns true. The read proceeds on the GPU backing, which was marked SetCleared() at creation without being initialized. This results in a cross-origin GPU-memory disclosure (S1 - High Severity). > > Per the severity guidelines, since the valid variant is behind an off-by-default flag (FEATURE_DISABLED_BY_DEFAULT) with no field trial, we assess the severity AS IF the flag were on (S1), but note Security_Impact-None.

Code Reachability Proofs & Evaluated Logic:

1. ComputeIsThreadSafe Logic: gpu/command_buffer/service/shared_image/compound_image_backing.cc:928-932

   if (!is_thread_safe && base::FeatureList::IsEnabled(features::kUseDynamicBackingAllocations)) {
     is_thread_safe = factory->shared_image_manager_->display_context_on_another_thread();
   }
   

2. GetOrAllocateBacking transient backing allocation: gpu/command_buffer/service/shared_image/compound_image_backing.cc:2038-2041

   if (is_thread_safe() && !new_backing->is_thread_safe()) {
     out_transient_backing = std::move(new_backing);
     return out_transient_backing.get();
   }
   

3. NotifyEndAccess Proactive Copy-Back Failure: gpu/command_buffer/service/shared_image/compound_image_backing.cc:1367-1372

   if (copy_manager_->CopyImage(backing, dst_backing)) {
     element.content_id_ = latest_content_id_;
   } else {
     LOG(ERROR) << "DCSI: Proactive copy from " << backing->GetName()
                << " to " << dst_backing->GetName() << " failed.";
   }
   

4. NotifyBeginAccess Synchronization Skip: gpu/command_buffer/service/shared_image/compound_image_backing.cc:1258-1262

   ElementHolder* latest_content_element = GetElementWithLatestContent();
   bool updated_backing = false;
   bool copy_succeeded = false;
   if (latest_content_element) {
     // [Bypassed because latest_content_element is nullptr]
   }
   // Falls through to: return true;
   

5. CreateBackingFromBackingFactory Premature Clear: gpu/command_buffer/service/shared_image/compound_image_backing.cc:2105-2107

   if (has_shm_backing_) {
     backing->SetCleared();
   }
   

Environmental Assumptions:

• features::kUseDynamicBackingAllocations must be explicitly enabled.
• Target environments include Vulkan, D3D, or Metal backends where createBackendTexture allocations are recycled and not zero-filled in Release builds to avoid overhead (wrapped_sk_image_backing.cc:232-237).

Evaluated with Chrome root at commit: b96d2ec58f4f5f92b540a723966b199d6e9951b4

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

• If you are familiar with the severity guidelines, you may adjust the severity.
• If this is a false positive, and there’s no work to be done, please close as WAI.
• If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.