Chrome · WebGL
CVE-2026-9875
OOB in WebGL
Overview
Critical
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
include/platform/autogen/FeaturesGL_autogen.hinclude/platform/gl_features.jsonsrc/libANGLE/renderer/gl/FramebufferGL.cppsrc/libANGLE/renderer/gl/renderergl_utils.cppsrc/tests/gl_tests/FramebufferTest.cpputil/autogen/angle_features_autogen.cpputil/autogen/angle_features_autogen.h
Patch
From 4a6d53434044d4d955731bed2a085155260c5911 Mon Sep 17 00:00:00 2001
From: Ken Russell <kbr@chromium.org>
Date: Fri, 08 May 2026 18:12:55 -0700
Subject: [PATCH] GL: Add glInvalidateFramebuffer workaround for incomplete FBOs.
If the FBO is incomplete, skip the glInvalidateFramebuffer or
glDiscardFramebufferEXT calls. Apply this workaround to Qualcomm
drivers earlier than version 881.
Incorporate unit test from the bug report.
Co-authored with jetski-cli.
Bug: chromium:507508103
Change-Id: I8f3910b2d5cf4ae41dbe44d2550bc2cad021fea5
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7834009
Commit-Queue: Kenneth Russell <kbr@chromium.org>
Reviewed-by: Shahbaz Youssefi <syoussefi@chromium.org>
Reviewed-by: Geoff Lang <geofflang@chromium.org>
---
diff --git a/include/platform/autogen/FeaturesGL_autogen.h b/include/platform/autogen/FeaturesGL_autogen.h
index d30f958..058540a 100644
--- a/include/platform/autogen/FeaturesGL_autogen.h
+++ b/include/platform/autogen/FeaturesGL_autogen.h
@@ -164,6 +164,12 @@
&members,
};
+ FeatureInfo dontInvalidateIncompleteFBOs = {
+ "dontInvalidateIncompleteFBOs",
+ FeatureCategory::OpenGLWorkarounds,
+ &members,
+ };
+
FeatureInfo dontUseLoopsToInitializeVariables = {
"dontUseLoopsToInitializeVariables",
FeatureCategory::OpenGLWorkarounds,
diff --git a/include/platform/gl_features.json b/include/platform/gl_features.json
index 7232893..2a22682 100644
--- a/include/platform/gl_features.json
+++ b/include/platform/gl_features.json
@@ -185,6 +185,14 @@
"issue": ""
},
{
+ "name": "dont_invalidate_incomplete_FBOs",
+ "category": "Workarounds",
+ "description": [
+ "Skip invalidation calls if the framebuffer is incomplete."
+ ],
+ "issue": "http://crbug.com/507508103"
+ },
+ {
"name": "dont_use_loops_to_initialize_variables",
"category": "Workarounds",
"description": [
diff --git a/src/libANGLE/renderer/gl/FramebufferGL.cpp b/src/libANGLE/renderer/gl/FramebufferGL.cpp
index 55d1527..afb334e 100644
--- a/src/libANGLE/renderer/gl/FramebufferGL.cpp
+++ b/src/libANGLE/renderer/gl/FramebufferGL.cpp
@@ -501,18 +501,25 @@
const FunctionsGL *functions = GetFunctionsGL(context);
StateManagerGL *stateManager = GetStateManagerGL(context);
+ const angle::FeaturesGL &features = GetFeaturesGL(context);
+ const bool skipInvalidate =
+ features.dontInvalidateIncompleteFBOs.enabled && !checkStatus(context).isComplete();
+
// Since this function is just a hint, only call a native function if it exists.
- if (functions->invalidateFramebuffer)
+ if (!skipInvalidate)
{
- stateManager->bindFramebuffer(GL_FRAMEBUFFER, mFramebufferID);
- functions->invalidateFramebuffer(GL_FRAMEBUFFER, static_cast<GLsizei>(count),
- finalAttachmentsPtr);
- }
- else if (functions->discardFramebufferEXT)
- {
- stateManager->bindFramebuffer(GL_FRAMEBUFFER, mFramebufferID);
- functions->discardFramebufferEXT(GL_FRAMEBUFFER, static_cast<GLsizei>(count),
- finalAttachmentsPtr);
+ if (functions->invalidateFramebuffer)
+ {
+ stateManager->bindFramebuffer(GL_FRAMEBUFFER, mFramebufferID);
+ functions->invalidateFramebuffer(GL_FRAMEBUFFER, static_cast<GLsizei>(count),
+ finalAttachmentsPtr);
+ }
+ else if (functions->discardFramebufferEXT)
+ {
+ stateManager->bindFramebuffer(GL_FRAMEBUFFER, mFramebufferID);
+ functions->discardFramebufferEXT(GL_FRAMEBUFFER, static_cast<GLsizei>(count),
+ finalAttachmentsPtr);
+ }
}
return angle::Result::Continue;
@@ -535,9 +542,13 @@
const FunctionsGL *functions = GetFunctionsGL(context);
StateManagerGL *stateManager = GetStateManagerGL(context);
+ const angle::FeaturesGL &features = GetFeaturesGL(context);
+ const bool skipInvalidate =
+ features.dontInvalidateIncompleteFBOs.enabled && !checkStatus(context).isComplete();
+
// Since this function is just a hint and not available until OpenGL 4.3, only call it if it is
// available.
- if (functions->invalidateSubFramebuffer)
+ if (!skipInvalidate && functions->invalidateSubFramebuffer)
{
stateManager->bindFramebuffer(GL_FRAMEBUFFER, mFramebufferID);
functions->invalidateSubFramebuffer(GL_FRAMEBUFFER, static_cast<GLsizei>(count),
diff --git a/src/libANGLE/renderer/gl/renderergl_utils.cpp b/src/libANGLE/renderer/gl/renderergl_utils.cpp
index d19126b..1eadd4b 100644
--- a/src/libANGLE/renderer/gl/renderergl_utils.cpp
+++ b/src/libANGLE/renderer/gl/renderergl_utils.cpp
@@ -2730,6 +2730,10 @@
ANGLE_FEATURE_CONDITION(features, recreateFboUponFlush,
!isMesa && isQualcomm && qualcommVersion < 878);
+ // http://crbug.com/507508103
+ ANGLE_FEATURE_CONDITION(features, dontInvalidateIncompleteFBOs,
+ !isMesa && isQualcomm && qualcommVersion < 881);
+
// glGenerateMipmap may silently fail on mesa, leaving mips that are expected to be recreated to
// match the base level in their original shape, hidden from ANGLE and its validation.
ANGLE_FEATURE_CONDITION(features, recreateMipmapLevelsBeforeGenerate, isMesa);
diff --git a/src/tests/gl_tests/FramebufferTest.cpp b/src/tests/gl_tests/FramebufferTest.cpp
index e7aa934..cc92e28 100644
--- a/src/tests/gl_tests/FramebufferTest.cpp
+++ b/src/tests/gl_tests/FramebufferTest.cpp
@@ -608,6 +608,34 @@
EXPECT_GL_NO_ERROR();
}
+// Covers invalidating an incomplete framebuffer with a depth/stencil attachment.
+// This should be a no-op, but should not crash on buggy drivers.
+TEST_P(FramebufferTest_ES3, InvalidateIncompleteDepthStencil)
+{
+ GLTexture texture;
+ glBindTexture(GL_TEXTURE_2D_ARRAY, texture);
+ // 2 levels, GL_RGBA8, 4x4, 1 layer
+ glTexStorage3D(GL_TEXTURE_2D_ARRAY, 2, GL_RGBA8, 4, 4, 1);
+
+ GLFramebuffer framebuffer;
+ glBindFramebuffer(GL_FRAMEBUFFER, framebuffer);
+
+ // Try to attach level 2 (out of range) to GL_DEPTH_STENCIL_ATTACHMENT.
+ // This makes the framebuffer incomplete.
+ glFramebufferTextureLayer(GL_FRAMEBUFFER, GL_DEPTH_STENCIL_ATTACHMENT, texture, 2, 0);
+ EXPECT_GL_NO_ERROR();
+
+ // Verify the framebuffer is incomplete.
+ EXPECT_GLENUM_EQ(GL_FRAMEBUFFER_INCOMPLETE_ATTACHMENT,
+ glCheckFramebufferStatus(GL_FRAMEBUFFER));
+
+ std::vector<GLenum> attachments;
+ attachments.push_back(GL_DEPTH_STENCIL_ATTACHMENT);
+
+ glInvalidateFramebuffer(GL_FRAMEBUFFER, 1, attachments.data());
+ EXPECT_GL_NO_ERROR();
+}
+
// Covers sub-invalidating an incomplete framebuffer. This should be a no-op, but should not error.
TEST_P(FramebufferTest_ES3, SubInvalidateIncomplete)
{
diff --git a/util/autogen/angle_features_autogen.cpp b/util/autogen/angle_features_autogen.cpp
index 59306b6..ffe34a2 100644
--- a/util/autogen/angle_features_autogen.cpp
+++ b/util/autogen/angle_features_autogen.cpp
@@ -122,6 +122,7 @@
{Feature::DisallowMixedDepthStencilLoadOpNoneAndLoad, "disallowMixedDepthStencilLoadOpNoneAndLoad"},
{Feature::DoesSRGBClearsOnLinearFramebufferAttachments, "doesSRGBClearsOnLinearFramebufferAttachments"},
{Feature::DontInitializeUninitializedLocals, "dontInitializeUninitializedLocals"},
+ {Feature::DontInvalidateIncompleteFBOs, "dontInvalidateIncompleteFBOs"},
{Feature::DontUseLoopsToInitializeVariables, "dontUseLoopsToInitializeVariables"},
{Feature::DoubleDepthBiasConstantFactor, "doubleDepthBiasConstantFactor"},
{Feature::DropDepthStencilClearOnInvalidate, "dropDepthStencilClearOnInvalidate"},
diff --git a/util/autogen/angle_features_autogen.h b/util/autogen/angle_features_autogen.h
index 4c46125..8dc083f 100644
--- a/util/autogen/angle_features_autogen.h
+++ b/util/autogen/angle_features_autogen.h
@@ -122,6 +122,7 @@
DisallowMixedDepthStencilLoadOpNoneAndLoad,
DoesSRGBClearsOnLinearFramebufferAttachments,
DontInitializeUninitializedLocals,
+ DontInvalidateIncompleteFBOs,
DontUseLoopsToInitializeVariables,
DoubleDepthBiasConstantFactor,
DropDepthStencilClearOnInvalidate,
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/src/tests/gl_tests/FramebufferTest.cpp b/src/tests/gl_tests/FramebufferTest.cpp
index e7aa934..cc92e28 100644
--- a/src/tests/gl_tests/FramebufferTest.cpp
+++ b/src/tests/gl_tests/FramebufferTest.cpp
@@ -608,6 +608,34 @@
EXPECT_GL_NO_ERROR();
}
+// Covers invalidating an incomplete framebuffer with a depth/stencil attachment.
+// This should be a no-op, but should not crash on buggy drivers.
+TEST_P(FramebufferTest_ES3, InvalidateIncompleteDepthStencil)
+{
+ GLTexture texture;
+ glBindTexture(GL_TEXTURE_2D_ARRAY, texture);
+ // 2 levels, GL_RGBA8, 4x4, 1 layer
+ glTexStorage3D(GL_TEXTURE_2D_ARRAY, 2, GL_RGBA8, 4, 4, 1);
+
+ GLFramebuffer framebuffer;
+ glBindFramebuffer(GL_FRAMEBUFFER, framebuffer);
+
+ // Try to attach level 2 (out of range) to GL_DEPTH_STENCIL_ATTACHMENT.
+ // This makes the framebuffer incomplete.
+ glFramebufferTextureLayer(GL_FRAMEBUFFER, GL_DEPTH_STENCIL_ATTACHMENT, texture, 2, 0);
+ EXPECT_GL_NO_ERROR();
+
+ // Verify the framebuffer is incomplete.
+ EXPECT_GLENUM_EQ(GL_FRAMEBUFFER_INCOMPLETE_ATTACHMENT,
+ glCheckFramebufferStatus(GL_FRAMEBUFFER));
+
+ std::vector<GLenum> attachments;
+ attachments.push_back(GL_DEPTH_STENCIL_ATTACHMENT);
+
+ glInvalidateFramebuffer(GL_FRAMEBUFFER, 1, attachments.data());
+ EXPECT_GL_NO_ERROR();
+}
+
// Covers sub-invalidating an incomplete framebuffer. This should be a no-op, but should not error.
TEST_P(FramebufferTest_ES3, SubInvalidateIncomplete)
{
Loading diff…
Original Bug Report
reported by ha...@gmail.com
memory corruption in qualcomm gpu lead sandbox escape
Security Bug
Important: Please do not change the component of this bug manually.
Please READ THIS FAQ before filing a bug: https://chromium.googlesource.com/chromium/src/+/HEAD/docs/security/faq.md
Please see the following link for instructions on filing security bugs: https://www.chromium.org/Home/chromium-security/reporting-security-bugs
Reports may be eligible for reward payments under the Chrome VRP: https://g.co/chrome/vrp
NOTE: Security bugs are normally made public once a fix has been widely deployed.
VULNERABILITY DETAILS
This vulnerability ultimately caused a crash in glInvalidateFramebuffer.
VERSION Chrome Version: [147.0.7727.111] + [stable]
Operating System: [samsung/pa1qzcx/pa1q:16/BP2A.250605.031.A3/S9310ZCSABZD1_CHCABZD1:user/release-keys ]
REPRODUCTION CASE
1.luach chrome on S25
2.open poc.html
3.logcat | grep DEBU
FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash: [GPU]
04-29 08:53:38.572 19717 19717 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
04-29 08:53:38.572 19717 19717 F DEBUG : Build fingerprint: 'samsung/pa1qzcx/pa1q:16/BP2A.250605.031.A3/S9310ZCSABZD1_CHCABZD1:user/release-keys'
04-29 08:53:38.572 19717 19717 F DEBUG : Revision: '11'
04-29 08:53:38.572 19717 19717 F DEBUG : ABI: 'arm64'
04-29 08:53:38.572 19717 19717 F DEBUG : Processor: '4'
04-29 08:53:38.572 19717 19717 F DEBUG : Timestamp: 2026-04-29 08:53:38.445931008+0900
04-29 08:53:38.572 19717 19717 F DEBUG : Process uptime: 11s
04-29 08:53:38.572 19717 19717 F DEBUG : Cmdline: com.android.chrome:privileged_process0
04-29 08:53:38.572 19717 19717 F DEBUG : pid: 19431, tid: 19457, name: CrGpuMain >>> com.android.chrome:privileged_process0 <<<
04-29 08:53:38.572 19717 19717 F DEBUG : uid: 10398
04-29 08:53:38.572 19717 19717 F DEBUG : tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE)
04-29 08:53:38.572 19717 19717 F DEBUG : pac_enabled_keys: 000000000000000f (PR_PAC_APIAKEY, PR_PAC_APIBKEY, PR_PAC_APDAKEY, PR_PAC_APDBKEY)
04-29 08:53:38.572 19717 19717 F DEBUG : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x00da000000008199
04-29 08:53:38.572 19717 19717 F DEBUG : x0 b400007515af8ae0 x1 b4000074c5b700b0 x2 0000000000000002 x3 0000000000000000
04-29 08:53:38.572 19717 19717 F DEBUG : x4 0000000000000002 x5 0000007414395a50 x6 0000000000000000 x7 0000000000000000
04-29 08:53:38.572 19717 19717 F DEBUG : x8 b4000074d5b03fd0 x9 8761fa37f6e82302 x10 0000000000000002 x11 0000000000000000
04-29 08:53:38.572 19717 19717 F DEBUG : x12 0000000000000400 x13 fffffffffdffffff x14 00000074147b1a00 x15 0000000000000000
04-29 08:53:38.573 19717 19717 F DEBUG : x16 0000000000000017 x17 000000000000483f x18 000000741701c000 x19 b400007515af8ae0
04-29 08:53:38.573 19717 19717 F DEBUG : x20 b400007575b96160 x21 a6da000000008101 x22 fffffffffdffffff x23 0000000000000000
04-29 08:53:38.573 19717 19717 F DEBUG : x24 0000006e004b0380 x25 0000000000000001 x26 0000000000000000 x27 0000000000000000
04-29 08:53:38.573 19717 19717 F DEBUG : x28 000000000000821a x29 00000074186e1870
04-29 08:53:38.573 19717 19717 F DEBUG : lr 0072c4f414395a9c sp 00000074186e1870 pc 0000007414395af8 pst 0000000000001000
04-29 08:53:38.573 19717 19717 F DEBUG : 31 total frames
04-29 08:53:38.573 19717 19717 F DEBUG : backtrace:
04-29 08:53:38.573 19717 19717 F DEBUG : #00 pc 0000000000185af8 /vendor/lib64/egl/libGLESv2_adreno.so (!!!0000!15308ad94fb9d06ecc441bc7d751ce!e4a2ccdb56!+56) (BuildId: 02d4e5bda5f7509bf3ae03a0a2d87766)
04-29 08:53:38.573 19717 19717 F DEBUG : #01 pc 0000000000185a98 /vendor/lib64/egl/libGLESv2_adreno.so (!!!0000!00392d1e72e084bd76e3a9667b1d57!e4a2ccdb56!+72) (BuildId: 02d4e5bda5f7509bf3ae03a0a2d87766)
04-29 08:53:38.573 19717 19717 F DEBUG : #02 pc 000000000020cd48 /vendor/lib64/egl/libGLESv2_adreno.so (!!!0000!3a076a0f5bf41e4bcac9395c0e1375!e4a2ccdb56!+648) (BuildId: 02d4e5bda5f7509bf3ae03a0a2d87766)
04-29 08:53:38.573 19717 19717 F DEBUG : #03 pc 00000000090151a8 /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG : #04 pc 0000000008ffcab8 /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG : #05 pc 00000000090141c8 /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG : #06 pc 00000000072d4f58 /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG : #07 pc 00000000072d4468 /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG : #08 pc 00000000072d4194 /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG : #09 pc 00000000072d403c /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG : #10 pc 00000000072d3fac /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG : #11 pc 0000000007309f58 /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG : #12 pc 00000000076dec98 /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG : #13 pc 0000000005ed7474 /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG : #14 pc 0000000005e5b244 /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG : #15 pc 0000000005e5adac /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG : #16 pc 000000000767d4d8 /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG : #17 pc 0000000005ef9164 /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG : #18 pc 0000000005e35060 /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG : #19 pc 0000000005e3144c /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG : #20 pc 0000000005e311b8 /data/app/~~jc6tK6agABvdATeOmce48Q==/com.google.android.trichromelibrary_772711133-oHunpAMWjmcv7EV5TiVMeg==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: 61365ef44cd4d1d3897904e966c0abdf0b41035b)
04-29 08:53:38.573 19717 19717 F DEBUG : #21 pc 00000000002d7d90 /system/framework/arm64/boot.oat (art_jni_trampoline+112) (BuildId: 1dfca4cf5b8b42c8355c90c8df5ea0c828c6d4b5)
04-29 08:53:38.573 19717 19717 F DEBUG : #22 pc 0000000000689408 /apex/com.android.art/lib64/libart.so (nterp_helper+152) (BuildId: eb4ec0f1d1c7267591d83fa87cb36390)
04-29 08:53:38.573 19717 19717 F DEBUG : #23 pc 00000000000e1346 /data/app/~~NZPtaYUqIYoCKjhy8J1FXw==/com.android.chrome-DV-Die4gK059hfQy4GokQQ==/base.apk (offset 0x20b000) (oq3.run+574)
04-29 08:53:38.573 19717 19717 F DEBUG : #24 pc 00000000000a9500 /system/framework/arm64/boot.oat (java.lang.Thread.run+64) (BuildId: 1dfca4cf5b8b42c8355c90c8df5ea0c828c6d4b5)
04-29 08:53:38.573 19717 19717 F DEBUG : #25 pc 0000000000317194 /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+612) (BuildId: eb4ec0f1d1c7267591d83fa87cb36390)
04-29 08:53:38.573 19717 19717 F DEBUG : #26 pc 0000000000302838 /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+216) (BuildId: eb4ec0f1d1c7267591d83fa87cb36390)
04-29 08:53:38.573 19717 19717 F DEBUG : #27 pc 00000000004c8298 /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallback(void*)+932) (BuildId: eb4ec0f1d1c7267591d83fa87cb36390)
04-29 08:53:38.573 19717 19717 F DEBUG : #28 pc 00000000004c7ee4 /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallbackWithUffdGc(void*)+8) (BuildId: eb4ec0f1d1c7267591d83fa87cb36390)
04-29 08:53:38.573 19717 19717 F DEBUG : #29 pc 0000000000082740 /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+184) (BuildId: 61a049a7ad18156ebc52d8d483539df9)
04-29 08:53:38.573 19717 19717 F DEBUG : #30 pc 0000000000074b98 /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+68) (BuildId: 61a049a7ad18156ebc52d8d483539df9)
04-29 09:02:43.375 21600 21600 I QCCEventLogger: Logging from Module qti.qcc.system, eventId QCCAppStart, type DEBUG, payloadSize 21
You can also compile a standalone poc.c version separately, which makes it easier to determine the cause. Qualcomm Developer allows you to enable MTE locally and fully reconstruct the vulnerability.
CREDIT INFORMATION
Reporter credit: [Anymous]
References
On This Page