Chrome · Tint
CVE-2026-79239
OOB in Tint
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
DEPSthird_party/dawn
Patch
From 04b6fe5db4b17cca6e57f943f5294ce0c1f34e0b Mon Sep 17 00:00:00 2001
From: chromium-autoroll@skia-public.iam.gserviceaccount.com <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Date: Tue, 30 Jun 2026 19:40:57 -0700
Subject: [PATCH] Roll Dawn from 91b1d3ff310e to 2de4c5673a7e (5 revisions)
https://dawn.googlesource.com/dawn.git/+log/91b1d3ff310e..2de4c5673a7e
2026-07-01 jrprice@google.com [uniformity] Merge variables for short-circuiting RHS
2026-06-30 dsinclair@chromium.org [resource_table] Sync code to documented functionality.
2026-06-30 jrprice@google.com Add regression test for an IMG shader compiler crash
2026-06-30 alanbaker@google.com [wgsl] Add subgroupMatrixLoad/Store resolver validation
2026-06-30 chrome-branch-day@chops-service-accounts.iam.gserviceaccount.com Activate dawn M151
If this roll has caused a breakage, revert this CL and stop the roller
using the controls here:
https://autoroll.skia.org/r/dawn-chromium-autoroll
Please CC cwallez@google.com,dneto@google.com on the revert to ensure that a human
is aware of the problem.
To file a bug in Dawn: https://bugs.chromium.org/p/dawn/issues/entry
To file a bug in Chromium: https://bugs.chromium.org/p/chromium/issues/entry
To report a problem with the AutoRoller itself, please file a bug:
https://issues.skia.org/issues/new?component=1389291&template=1850622
Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+doc/main/autoroll/README.md
Cq-Include-Trybots: luci.chromium.try:dawn-android-arm-deps-rel;luci.chromium.try:dawn-android-arm64-deps-rel;luci.chromium.try:dawn-linux-x64-deps-rel;luci.chromium.try:dawn-mac-x64-deps-rel;luci.chromium.try:dawn-mac-arm64-deps-rel;luci.chromium.try:dawn-win10-x64-deps-rel;luci.chromium.try:dawn-win10-x86-deps-rel;luci.chromium.try:dawn-win11-arm64-deps-rel;luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:gpu-fyi-cq-mac-arm64;luci.chromium.try:win_optional_gpu_tests_rel;luci.chromium.try:gpu-fyi-cq-android-arm64
Bug: chromium:479179409,chromium:520781436,chromium:527993420
Tbr: dneto@google.com
Change-Id: Ie1eab575fce017f8b14663845545ecc2232e64c7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8028095
Bot-Commit: chromium-autoroll@skia-public.iam.gserviceaccount.com <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Commit-Queue: chromium-autoroll@skia-public.iam.gserviceaccount.com <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#1655221}
---
diff --git a/DEPS b/DEPS
index aa3a20b..1c3ab88 100644
--- a/DEPS
+++ b/DEPS
@@ -431,7 +431,7 @@
# Three lines of non-changing comments so that
# the commit queue can handle CLs rolling feed
# and whatever else without interference from each other.
- 'dawn_revision': '91b1d3ff310ec9cf6a52e21c6555547dafe774e1',
+ 'dawn_revision': '2de4c5673a7e8c582d92c9f381d382c903ad3d7b',
# Three lines of non-changing comments so that
# the commit queue can handle CLs rolling feed
# and whatever else without interference from each other.
diff --git a/third_party/dawn b/third_party/dawn
index 91b1d3f..2de4c56 160000
--- a/third_party/dawn
+++ b/third_party/dawn
@@ -1 +1 @@
-Subproject commit 91b1d3ff310ec9cf6a52e21c6555547dafe774e1
+Subproject commit 2de4c5673a7e8c582d92c9f381d382c903ad3d7b
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page