High chrome OOB 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactHeap buffer overflow in GPU
DescriptionHeap buffer overflow in GPU
ComponentGPU
Bug ClassOOB
Tracker498706958
Fix commit397b3fab53f0 (chromium/src) +3/-3
CISA KEVNot listed
CreditedGoogle
Disclosed2026-05-12

Files Changed

  • gpu/command_buffer/service/gles2_cmd_decoder.cc
From 397b3fab53f0e040db3f9ac9af5733c524fd772a Mon Sep 17 00:00:00 2001
From: Brandon Jones <bajones@chromium.org>
Date: Thu, 02 Apr 2026 13:04:33 -0700
Subject: [PATCH] Use depth when updating 3D compressed textures

The depth parameter was accidentally not considered in every case when
clearing or decompressing 3D compressed textures. This change ensures
that the memory allocated for clearing or decompressing is large enough
to cover all specified depth layers.

Bug: 498706958
Change-Id: Ic7cae42cf9adee07dda8754e2184a3ee988c1d09
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7727007
Reviewed-by: Kenneth Russell <kbr@chromium.org>
Reviewed-by: Kai Ninomiya <kainino@chromium.org>
Commit-Queue: Brandon Jones <bajones@chromium.org>
Commit-Queue: Kenneth Russell <kbr@chromium.org>
Auto-Submit: Brandon Jones <bajones@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1609454}
---

diff --git a/gpu/command_buffer/service/gles2_cmd_decoder.cc b/gpu/command_buffer/service/gles2_cmd_decoder.cc
index 4fb2911..d55fb20 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder.cc
+++ b/gpu/command_buffer/service/gles2_cmd_decoder.cc
@@ -12200,7 +12200,7 @@
 
   GLsizei bytes_required = 0;
   if (!GetCompressedTexSizeInBytes("ClearCompressedTextureLevel3D", width,
-                                   height, 1, format, &bytes_required,
+                                   height, depth, format, &bytes_required,
                                    error_state_.get())) {
     return false;
   }
@@ -12518,8 +12518,8 @@
   auto* api = state.api();
   uint32_t output_pixel_size = GLES2Util::ComputeImageGroupSize(
       info.decompressed_format, info.decompressed_type);
-  auto decompressed_data =
-      base::HeapArray<uint8_t>::Uninit(output_pixel_size * width * height);
+  auto decompressed_data = base::HeapArray<uint8_t>::Uninit(
+      output_pixel_size * width * height * depth);
 
   // If a PBO is bound, map it to decompress the data.
   const void* input_data = data;
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.