ANGLE — EXT_texture_norm16 PBO Type Confusion PoC

Targets: Android Chrome (direct) & Windows Chrome with --use-angle=gl or --use-angle=gles.

Reproduction Notes

Android Chrome (direct):
  1. Open this page in Chrome for Android.
  2. The page should trigger a renderer process crash.
  3. Check chrome://crashes for the crash report.

Windows Chrome (OpenGL backend):
  1. Launch Chrome with:  chrome.exe --use-angle=gl  (or --use-angle=gles)
  2. Open this page.
  3. The renderer process should crash.
  4. Without the flag, Chrome uses D3D11 which does not route through FramebufferGL.cpp.

Crash location (from ANGLE ASan build):
  RearrangeEXTTextureNorm16Pixels()
  src/libANGLE/renderer/gl/FramebufferGL.cpp:462
  dstPixel[0] = srcPixel[0];   // write to clientPixels=(GLubyte*)PBO_OFFSET = (GLubyte*)0x10000
                               // attacker-controlled — NOT a null deref

Root cause:
  readPixelsAllAtOnce() calls setPixelPackState() but never setPixelPackBuffer(nullptr).
  The native glReadPixels call type-confuses the CPU heap pointer (tmpPixels) as a
  GPU PBO byte offset → GPU OOB write at ~heap address.
  Contrast with safe path: BlitGL.cpp:864-865 (CVE-2026-6296 fix).