Low chrome OOB 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactOut of bounds read in Tint
DescriptionOut of bounds read in Tint
ComponentTint
Bug ClassOOB
Tracker520781436
Fix commit2de4c5673a7e (dawn) +2/-2
CISA KEVNot listed
CreditedMichal Andryskowski, Imperial College London
Disclosed2026-08-25

Files Changed

  • DEPS
  • third_party/dawn
From 04b6fe5db4b17cca6e57f943f5294ce0c1f34e0b Mon Sep 17 00:00:00 2001
From: chromium-autoroll@skia-public.iam.gserviceaccount.com <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Date: Tue, 30 Jun 2026 19:40:57 -0700
Subject: [PATCH] Roll Dawn from 91b1d3ff310e to 2de4c5673a7e (5 revisions)

https://dawn.googlesource.com/dawn.git/+log/91b1d3ff310e..2de4c5673a7e

2026-07-01 jrprice@google.com [uniformity] Merge variables for short-circuiting RHS
2026-06-30 dsinclair@chromium.org [resource_table] Sync code to documented functionality.
2026-06-30 jrprice@google.com Add regression test for an IMG shader compiler crash
2026-06-30 alanbaker@google.com [wgsl] Add subgroupMatrixLoad/Store resolver validation
2026-06-30 chrome-branch-day@chops-service-accounts.iam.gserviceaccount.com Activate dawn M151

If this roll has caused a breakage, revert this CL and stop the roller
using the controls here:
https://autoroll.skia.org/r/dawn-chromium-autoroll
Please CC cwallez@google.com,dneto@google.com on the revert to ensure that a human
is aware of the problem.

To file a bug in Dawn: https://bugs.chromium.org/p/dawn/issues/entry
To file a bug in Chromium: https://bugs.chromium.org/p/chromium/issues/entry

To report a problem with the AutoRoller itself, please file a bug:
https://issues.skia.org/issues/new?component=1389291&template=1850622

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+doc/main/autoroll/README.md

Cq-Include-Trybots: luci.chromium.try:dawn-android-arm-deps-rel;luci.chromium.try:dawn-android-arm64-deps-rel;luci.chromium.try:dawn-linux-x64-deps-rel;luci.chromium.try:dawn-mac-x64-deps-rel;luci.chromium.try:dawn-mac-arm64-deps-rel;luci.chromium.try:dawn-win10-x64-deps-rel;luci.chromium.try:dawn-win10-x86-deps-rel;luci.chromium.try:dawn-win11-arm64-deps-rel;luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:gpu-fyi-cq-mac-arm64;luci.chromium.try:win_optional_gpu_tests_rel;luci.chromium.try:gpu-fyi-cq-android-arm64
Bug: chromium:479179409,chromium:520781436,chromium:527993420
Tbr: dneto@google.com
Change-Id: Ie1eab575fce017f8b14663845545ecc2232e64c7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8028095
Bot-Commit: chromium-autoroll@skia-public.iam.gserviceaccount.com <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Commit-Queue: chromium-autoroll@skia-public.iam.gserviceaccount.com <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#1655221}
---

diff --git a/DEPS b/DEPS
index aa3a20b..1c3ab88 100644
--- a/DEPS
+++ b/DEPS
@@ -431,7 +431,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
-  'dawn_revision': '91b1d3ff310ec9cf6a52e21c6555547dafe774e1',
+  'dawn_revision': '2de4c5673a7e8c582d92c9f381d382c903ad3d7b',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
diff --git a/third_party/dawn b/third_party/dawn
index 91b1d3f..2de4c56 160000
--- a/third_party/dawn
+++ b/third_party/dawn
@@ -1 +1 @@
-Subproject commit 91b1d3ff310ec9cf6a52e21c6555547dafe774e1
+Subproject commit 2de4c5673a7e8c582d92c9f381d382c903ad3d7b
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.