Chrome · WebGL
CVE-2026-85050
OOB in WebGL
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
include/platform/autogen/FeaturesGL_autogen.hinclude/platform/gl_features.jsonsrc/libANGLE/renderer/gl/TextureGL.cppsrc/libANGLE/renderer/gl/renderergl_utils.cpputil/autogen/angle_features_autogen.cpputil/autogen/angle_features_autogen.h
Patch
From 921d48815f191d63b93aeb9c9921ba6dd95b054e Mon Sep 17 00:00:00 2001
From: Brandon Jones <bajones@chromium.org>
Date: Thu, 20 Aug 2026 13:54:51 -0700
Subject: [PATCH] Insert flush before generateMipmap on IMG
Adds a feature which forces a flush before generating a mipmap,
which avoids a bad state in the IMG driver if the texture's base
level is still bound to an active FBO.
Fixed: chromium:549350408
Change-Id: Id69684690a0fb04a45e0fca7d912bac68f82052c
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/8265721
Commit-Queue: Kenneth Russell <kbr@chromium.org>
Reviewed-by: Geoff Lang <geofflang@chromium.org>
Reviewed-by: Kenneth Russell <kbr@chromium.org>
---
diff --git a/include/platform/autogen/FeaturesGL_autogen.h b/include/platform/autogen/FeaturesGL_autogen.h
index 58c6372..487cfbe 100644
--- a/include/platform/autogen/FeaturesGL_autogen.h
+++ b/include/platform/autogen/FeaturesGL_autogen.h
@@ -734,6 +734,12 @@
&members,
};
+ FeatureInfo flushBeforeGenerateMipmap = {
+ "flushBeforeGenerateMipmap",
+ FeatureCategory::OpenGLWorkarounds,
+ &members,
+ };
+
FeatureInfo splitLevel0PboFullSubImage2D = {
"splitLevel0PboFullSubImage2D",
FeatureCategory::OpenGLWorkarounds,
diff --git a/include/platform/gl_features.json b/include/platform/gl_features.json
index 18a3244..7d9f4bb 100644
--- a/include/platform/gl_features.json
+++ b/include/platform/gl_features.json
@@ -963,6 +963,14 @@
"issue": "http://crbug.com/475877320"
},
{
+ "name": "flush_before_generate_mipmap",
+ "category": "Workarounds",
+ "description": [
+ "Force a flush before calling generateMipmap to work around driver bugs."
+ ],
+ "issue": "http://crbug.com/549350408"
+ },
+ {
"name": "split_level_0_pbo_full_sub_image_2D",
"category": "Workarounds",
"description": [
diff --git a/src/libANGLE/renderer/gl/TextureGL.cpp b/src/libANGLE/renderer/gl/TextureGL.cpp
index 63fc458..52c5e88 100644
--- a/src/libANGLE/renderer/gl/TextureGL.cpp
+++ b/src/libANGLE/renderer/gl/TextureGL.cpp
@@ -1622,6 +1622,13 @@
StateManagerGL *stateManager = GetStateManagerGL(context);
const angle::FeaturesGL &features = GetFeaturesGL(context);
+ if (features.flushBeforeGenerateMipmap.enabled)
+ {
+ // Force a flush before generating the mipmap, which avoids a bad state in the IMG driver if
+ // the texture's base level is still bound to an active FBO.
+ ANGLE_GL_TRY(context, functions->flush());
+ }
+
stateManager->bindTexture(getType(), mTextureID);
bool recreateMipmapLevelsBeforeGenerate =
diff --git a/src/libANGLE/renderer/gl/renderergl_utils.cpp b/src/libANGLE/renderer/gl/renderergl_utils.cpp
index daded80..2190fd8 100644
--- a/src/libANGLE/renderer/gl/renderergl_utils.cpp
+++ b/src/libANGLE/renderer/gl/renderergl_utils.cpp
@@ -2748,6 +2748,10 @@
// Disable EXT_clear_texture entirely on IMG as a speculative fix for driver crashes.
ANGLE_FEATURE_CONDITION(features, disableClearTexture, IsPowerVR(vendor));
+ // Forces a flush before generating a mipmap, which avoids a bad state in the IMG driver if
+ // the texture's base level is still bound to an active FBO.
+ ANGLE_FEATURE_CONDITION(features, flushBeforeGenerateMipmap, IsPowerVR(vendor));
+
// IMG GL drivers crash while compiling shaders with more than the limit of uniform blocks.
ANGLE_FEATURE_CONDITION(features, validateMaxPerStageUniformBlocksAtCompileTime,
IsPowerVR(vendor));
diff --git a/util/autogen/angle_features_autogen.cpp b/util/autogen/angle_features_autogen.cpp
index 2d2096b..5f52c9e 100644
--- a/util/autogen/angle_features_autogen.cpp
+++ b/util/autogen/angle_features_autogen.cpp
@@ -189,6 +189,7 @@
{Feature::FlushAfterEndingTransformFeedback, "flushAfterEndingTransformFeedback"},
{Feature::FlushAfterStreamVertexData, "flushAfterStreamVertexData"},
{Feature::FlushBeforeDeleteTextureIfCopiedTo, "flushBeforeDeleteTextureIfCopiedTo"},
+ {Feature::FlushBeforeGenerateMipmap, "flushBeforeGenerateMipmap"},
{Feature::FlushOnFramebufferChange, "flushOnFramebufferChange"},
{Feature::FlushQueriesBeforeDeletingOrUnbindingFbo, "flushQueriesBeforeDeletingOrUnbindingFbo"},
{Feature::ForceAtomicValueResolution, "forceAtomicValueResolution"},
diff --git a/util/autogen/angle_features_autogen.h b/util/autogen/angle_features_autogen.h
index 0d329ff..99b3126 100644
--- a/util/autogen/angle_features_autogen.h
+++ b/util/autogen/angle_features_autogen.h
@@ -189,6 +189,7 @@
FlushAfterEndingTransformFeedback,
FlushAfterStreamVertexData,
FlushBeforeDeleteTextureIfCopiedTo,
+ FlushBeforeGenerateMipmap,
FlushOnFramebufferChange,
FlushQueriesBeforeDeletingOrUnbindingFbo,
ForceAtomicValueResolution,
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page