Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: A validation gap in GLCommonImageBackingFactory::CanCreateTexture allows the creation of compressed-format SharedImages with empty pixel data. This bypasses ANGLE’s initialization and Chromium’s automated clearing, allowing a compromised renderer to sample uninitialized Vulkan memory and leak cross-origin GPU data.

Affected files:

• gpu/command_buffer/service/shared_image/gl_common_image_backing_factory.cc
• gpu/command_buffer/service/shared_image/gl_texture_holder.cc
• gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc
• gpu/command_buffer/service/shared_image/egl_image_backing.cc

Estimated timestamp from git blame: 2018-12-11

1. Summary of the Issue (Meant for Human Triage)

A potential high-severity security vulnerability exists in Chromium’s GPU command buffer service due to a validation gap when creating compressed-format SharedImage textures. When a compromised renderer requests a new SharedImage with a compressed format (e.g., ETC1) but provides no initial pixel data, the validation logic inside GLCommonImageBackingFactory::CanCreateTexture is entirely bypassed. This bypass allows the creation of a compressed texture without performing the necessary dimension and bounds checks.

Because the release-build SharedContextState operates with validation disabled (KHR_no_error) and robust_resource_initialization=false, ANGLE marks the texture state as fully Initialized upon creation without staging any clear or memory upload. Furthermore, because ETC1 is not a color-renderable format, Chromium’s automated clearing mechanism (EnsureClear) fails because the framebuffer remains incomplete, preventing the texture from actually being cleared.

Since BeginSharedImageAccess is not strictly enforced on the service side by the passthrough command decoder, a compromised renderer can directly bind and draw/sample from this texture. When sampled, ANGLE’s Vulkan backend lazily allocates a VkImage from the process-wide Vulkan Memory Allocator (VMA) pool. Because ANGLE incorrectly believes the texture is already initialized, no robust clear is performed, allowing the renderer to read uninitialized GPU memory. As VMA is a process-wide suballocator, this memory can contain recycled contents from other origins, the compositor, or the OS, leading to cross-origin GPU memory disclosure.

Note: The following exploitation steps are suggested/potential, as our tooling agent does not currently have the ability to run a live proof-of-concept.

2. Proof-of-Concept & Detailed Execution Flow

An attacker from a compromised renderer process (A-RENDERER) on an Android device (where the GPU process is unsandboxed and ANGLE-Vulkan is the default backend) could trigger this vulnerability through the following potential execution sequence:

Step 1: Create a SharedImage with a Compressed Format and Empty Pixel Data

1. A-RENDERER sends a gpu.mojom.GpuChannel::FlushDeferredRequests IPC message containing a DeferredSharedImageRequest::kCreateSharedImage request.
2. The request specifies a mailbox M, format viz::mojom::SingleplanarFormat::ETC1, size (e.g., 64x64), usage SHARED_IMAGE_USAGE_GLES2_READ, and an empty pixel_data span (pixel_data.empty() == true).
3. The request reaches SharedImageStub::OnCreateSharedImage (gpu/ipc/service/shared_image_stub.cc), which calls SharedImageFactory::CreateSharedImage.

Step 2: SharedImage Factory Selection and Validation Bypass

4. SharedImageFactory iterates through available backing factories. On Android, WrappedSkImageBackingFactory rejects SHARED_IMAGE_USAGE_GLES2_READ (wrapped_sk_image_backing_factory.cc:145-147).
5. GLTextureImageBackingFactory evaluates the request via GLCommonImageBackingFactory::CanCreateTexture (gpu/command_buffer/service/shared_image/gl_common_image_backing_factory.cc:201).
6. During validation, the checks for compressed formats are incorrectly nested inside an if (!pixel_data.empty()) block:

// gpu/command_buffer/service/shared_image/gl_common_image_backing_factory.cc:220
  if (!pixel_data.empty()) {                                   // ← Gated on non-empty data
    DCHECK_EQ(format_infos.size(), 1u);
    const FormatInfo& format_info = format_infos[0];

    if (format_info.is_compressed) {
      if (!gles2::ValidateCompressedTexDimensions(...)) return false;   // SKIPPED
      if (!gles2::GetCompressedTexSizeInBytes(...)) return false;       // SKIPPED
      if (... pixel_data.size() != bytes_required) return false;        // SKIPPED
    }
    ...
  }
  return true;                                                 // ← Returns true without validation!

7. Because pixel_data is empty, the compressed dimensions validation is completely bypassed, and CanCreateTexture returns true.

Step 3: Allocation of Texture with Spec-Invalid Arguments

8. During initialization, GLTextureHolder::Initialize is called (gpu/command_buffer/service/shared_image/gl_texture_holder.cc:145).
9. Because GL_ETC1_RGB8_OES is compressed, format_info.is_compressed is true and supports_storage is false, forcing the glCompressedTexImage2DFn branch:

// gpu/command_buffer/service/shared_image/gl_texture_holder.cc:212
} else if (format_info.is_compressed) {
  ScopedUnpackState scoped_unpack_state(!pixel_data.empty());
  gl::ScopedProgressReporter scoped_progress_reporter(progress_reporter_);
  api->glCompressedTexImage2DFn(format_desc_.target, 0,
                                format_desc_.image_internal_format,
                                size_.width(), size_.height(), /*border=*/0,
                                pixel_data.size(), pixel_data.data());  // 0, nullptr
}

10. The driver is invoked with imageSize = 0 and data = nullptr, despite non-zero dimensions, violating OpenGL ES / OES_compressed_ETC1_RGB8_texture specifications.

Step 4: ANGLE Bypasses Validation and Marks Texture as Initialized

11. This initialization occurs on the process-wide SharedContextState. In release builds, gpu_channel_manager.cc:917-920 configures this context with attribs.robust_resource_initialization = false and attribs.can_skip_validation = true.
12. ui/gl/gl_context_egl.cc:145-150 appends EGL_CONTEXT_OPENGL_NO_ERROR_KHR=EGL_TRUE.
13. ANGLE’s autogenerated entry point checks context->skipValidation() (which is true) and skips ValidateCompressedTexImage2D.
14. Inside Texture::setCompressedImage, ANGLE determines the initial state:

// third_party/angle/src/libANGLE/Texture.cpp:47
InitState DetermineInitState(const Context *context, Buffer *unpackBuffer, const uint8_t *pixels) {
    if (!context || !context->isRobustResourceInitEnabled())
        return InitState::Initialized;               // ← Since robust init is off, returns Initialized
    return (!pixels && !unpackBuffer) ? InitState::MayNeedInit : InitState::Initialized;
}

15. The texture’s mInitState is set to InitState::Initialized.
16. TextureVk::setSubImageImpl is invoked, but since unpackBuffer == nullptr and pixels == nullptr, no subresource update or upload is staged. The VkImage memory is left uninitialized.

Step 5: Chromium Clear-Tracking Remains Uncleared & EnsureClear Fails

17. Back in GLTextureImageBacking::InitializeGLTexture, SetCleared() is only called if !pixel_data.empty() (gl_texture_image_backing.cc:528). Since pixel_data is empty, the backing remains marked as uncleared in Chromium’s tracking.
18. A-RENDERER issues gles2::cmds::CreateAndTexStorage2DSharedImageINTERNAL to bind the mailbox to a client_id.
19. The passthrough decoder unconditionally maps client_id to the ANGLE service_id via texture_id_map.SetIDMapping (gles2_cmd_decoder_passthrough_doers.cc:4679).
20. It then attempts to clear the texture via EnsureClear (gles2_cmd_decoder_passthrough.cc:613).
21. EnsureClear attaches the uncleared texture to a framebuffer and calls glClearFn.
22. EnsureClear then checks glCheckFramebufferStatusEXTFn(GL_FRAMEBUFFER). However, GL_ETC1_RGB8_OES has textureAttachmentSupport = NeverSupported (third_party/angle/src/libANGLE/formatutils.cpp:1222).
23. The framebuffer is incomplete. glCheckFramebufferStatusEXTFn does not return GL_FRAMEBUFFER_COMPLETE, meaning representation_->SetCleared() is never called.

Step 6: Renderer Bypasses BeginAccess and Samples Uninitialized Memory

24. A-RENDERER deliberately omits gles2::cmds::BeginSharedImageAccessDirectCHROMIUM. The passthrough decoder does not enforce calling BeginAccess for bound textures (gles2_cmd_decoder_passthrough.cc:596-597).
25. A-RENDERER sends gles2::cmds::BindTexture, which resolves to the ANGLE service_id using the already-populated texture_id_map.
26. A-RENDERER sets up a fragment shader that executes texture2D() to sample the bound texture, binds an RGBA8 framebuffer, and issues gles2::cmds::DrawArrays.
27. When ANGLE evaluates the bound texture during the draw call, it calls ensureInitialized on the Texture object. Because the level was already marked as InitState::Initialized (Step 14), ensureInitialized short-circuits.
28. ANGLE’s Vulkan backend lazily allocates the underlying VkImage(VK_FORMAT_ETC2_R8G8B8_UNORM_BLOCK) from the process-wide Vulkan Memory Allocator (vk::Renderer / VMA pool).
29. Because the state is Initialized, no robust clear is performed. The shader executes, directly sampling the uninitialized VkDeviceMemory backing the VkImage.
30. A-RENDERER issues gles2::cmds::ReadPixels to exfiltrate the sampled values. Because VMA operates as a single, process-wide suballocator, this memory can contain recycled data from other origins, the compositor, or OS surfaces.

Proposed Fix

Move the compressed format validation in GLCommonImageBackingFactory::CanCreateTexture outside of the if (!pixel_data.empty()) check. The dimensions, limits, and supported formats must be checked regardless of whether initial data is provided. The if (!pixel_data.empty()) gate should only wrap the specific check that validates pixel_data.size() == bytes_required.

3. Technical Verification Details (Automated Audit Logs - Reviewers may skip this section)

> The vulnerability is valid and highly exploitable. By exploiting a validation gap in GLCommonImageBackingFactory::CanCreateTexture where compressed-format dimension checks are skipped for empty pixel_data, a compromised renderer can create an ETC1 SharedImage with no initial data. > > Since the SharedContextState is created with robust_resource_initialization=false and validation disabled, ANGLE marks the texture’s InitState as Initialized and stages no upload. Chromium’s EnsureClear attempts to clear the texture by attaching it to an FBO, but fails because ETC1 is not color-renderable (framebuffer incomplete), resulting in SetCleared() being skipped. > > Crucially, the passthrough command decoder does not enforce BeginSharedImageAccess on the service side. The renderer can directly bind the texture and sample it. When sampled in a WebGL context, ANGLE’s robust-init validation is bypassed because the texture is already marked Initialized. The Vulkan backend lazily allocates a VkImage from the process-wide Vulkan Memory Allocator (VMA) without clearing it, returning uninitialized memory to the renderer. > > I am rating this as High (S1) rather than the report’s Medium (S2). The report author conservatively rated it S2 because they didn’t trace cross-origin VMA recycling end-to-end. However, because VMA operates as a single process-wide suballocator for the entire GPU process (vk::Renderer owns a single vk::Allocator), any recycled memory can inherently belong to other origins, the compositor, or the OS. This constitutes a cross-origin GPU-memory disclosure, which is S1 (High) per the severity guidelines.

Environmental Assumptions & Risk Factors Confirmed:

• VMA Pooling: Confirmed via third_party/angle/src/libANGLE/renderer/vulkan/vk_renderer.cpp:2847 that mAllocator.init() builds a single vk::Allocator for the GPU process. Any recycled memory blocks are shared across different contexts and origins, making cross-origin data disclosure deterministic.
• Android Backend: ANGLE-Vulkan is the default backend on Android devices, where the GPU process is unsandboxed on many configurations.
• SharedContextState Attributes: Verified via gpu/ipc/service/gpu_channel_manager.cc:909-923 and ui/gl/gl_features.cc:230-241. In Android release builds (!DCHECK_IS_ON()), kDefaultEnableANGLEValidation is disabled. This results in can_skip_validation=true and robust_resource_initialization=false being passed, which causes ui/gl/gl_context_egl.cc:145-150 to initialize the EGL context with EGL_CONTEXT_OPENGL_NO_ERROR_KHR=EGL_TRUE.
• ETC1 Renderability: Verified via third_party/angle/src/libANGLE/formatutils.cpp:1222 that GL_ETC1_RGB8_OES uses NeverSupported for textureAttachmentSupport.
• Passthrough Enforcements: Verified via gpu/command_buffer/service/gles2_cmd_decoder_passthrough_doers.cc:493-536 (DoBindTexture) and gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc:596-599 that there is no automatic enforcement of BeginSharedImageAccessDirectCHROMIUM for bound textures.

Evaluated with Chrome root at commit: b96d2ec58f4f5f92b540a723966b199d6e9951b4

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

• If you are familiar with the severity guidelines, you may adjust the severity.
• If this is a false positive, and there’s no work to be done, please close as WAI.
• If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.