Closed Bug 2024852 (CVE-2026-12290) Opened 7 months ago Closed 5 months ago

CVE-2026-4439: Out of bounds memory access in llvm::UFWriterVolcanic::GenerateKernels via WebGL (on Pixel 10)

Categories

(Core :: Graphics, defect, P1)

Product:
Core
Component:
Graphics
Version:
Firefox 148
Platform:
Unspecified
Android
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
153 Branch
Tracking Flags:
Tracking Status
firefox-esr115 152+ fixed
firefox-esr140 152+ fixed
firefox149 --- wontfix
firefox150 --- wontfix
firefox151 --- wontfix
firefox152 + fixed
firefox153 + fixed

People

(Reporter: jayjayjazz, Assigned: emilio)

References

Details

(Keywords: csectype-bounds, reporter-external, sec-high, Whiteboard: [pp3][adv-main152+][adv-esr115.37+][adv-esr140.12+])

Attachments

(9 external files)

Actual results:

Google released a new version of Chrome fixing some security flaws. [1]

CVE-2026-4439: Out of bounds memory access in WebGL [2]
Severity by Google is "Critical".

Change description:
<<<
Optionally validate GL_MAX_*_UNIFORM_BLOCKS at compile time.

These were validated at link time but some drivers have compiler crashes
when compiling shaders with too many uniform blocks.
<<<
[3]

Affected files:
include/GLSLANG/ShaderLang.h
include/platform/autogen/FeaturesGL_autogen.h
include/platform/gl_features.json
src/compiler/translator/Compiler.cpp
src/compiler/translator/ParseContext.cpp
src/compiler/translator/ParseContext.h
src/compiler/translator/ShaderLang.cpp
src/libANGLE/Compiler.cpp
src/libANGLE/renderer/gl/ShaderGL.cpp
src/libANGLE/renderer/gl/renderergl_utils.cpp
src/tests/gl_tests/GLSLValidationTest.cpp
util/autogen/angle_features_autogen.cpp
util/autogen/angle_features_autogen.h

Commit, which addresses this security flaw: [4]

[1] https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_18.html
[2] https://issues.chromium.org/issues/475877320
[3] https://chromium-review.googlesource.com/c/angle/angle/+/7653195
[4] https://chromium.googlesource.com/angle/angle.git/+/05459080c9a323e89a52209efb799d6dc5b68a86

Expected results:

For me, it looks like Firefox is having the affected code in its tree. Could you check, if Firefox is also affected?

Flags: needinfo?(bhood)
Group: core-security → gfx-core-security
Keywords: reporter-external
Flags: needinfo?(bhood)

We are most likely affected, I don't see any validation preventing this issue in our WebGL code.

Ashley, what would be the next steps here? Should we apply patches to our vendored angle or revendor it?

Flags: needinfo?(ahale)

https://chromium-review.googlesource.com/c/angle/angle/+/7568089 commit comment says

Optionally validate GL_MAX_*_UNIFORM_BLOCKS at compile time.

These were validated at link time but some drivers have compiler crashes
when compiling shaders with too many uniform blocks.

https://chromium-review.googlesource.com/c/chromium/src/+/7568129 touches some gpu/ files not covered in the first patch, with the similar comment. This one mentions the OS being Android, which maybe also applies to the "some drivers" of the first patch?

Validate uniform block count limits at compile time on IMG.

Normally these limits are validated at link time but the IMG compiler
has issues when these limits are exceeded. Validate at compile time
instead.

See Also: → https://issues.chromium.org/issues/475877320, https://chromium-review.googlesource.com/c/angle/angle/+/7568089, https://chromium-review.googlesource.com/c/chromium/src/+/7568129

The Chrome reporter tested on pixel 10 update 01.06, and it looks like the problem they're working around is in the Mali GPU driver.

OS: Unspecified → Android
Summary: CVE-2026-4439: Out of bounds memory access in WebGL → CVE-2026-4439: Out of bounds memory access in WebGL (with Mali GPU)
Keywords: keep-hidden
Whiteboard: [keep hidden while Chrome bug is hidden]
Summary: CVE-2026-4439: Out of bounds memory access in WebGL (with Mali GPU) → CVE-2026-4439: Out of bounds memory access in llvm::UFWriterVolcanic::GenerateKernels via WebGL (Mali GPU)

We should assume Firefox would be affected on devices with those drivers since ANGLE itself wasn't doing anything wrong. We could easily get this into a Fenix 149.0.x point release, but would we need an ESR-140 fix also? We don't have Fenix ESR releases, but would the same Mali drivers be used by any version of Linux?

Status: UNCONFIRMED → NEW
status-firefox149: --- → affected
status-firefox150: --- → affected
status-firefox151: --- → affected
status-firefox-esr140: --- → ?
tracking-firefox149: --- → +
tracking-firefox150: --- → +
tracking-firefox151: --- → +
Ever confirmed: true
Keywords: sec-critical
Severity: -- → S2
Severity: S2 → S1
Priority: -- → P1

Not sure if this is useful but I attempted to backport the angle commit listed in the first comment https://chromium.googlesource.com/angle/angle.git/+/05459080c9a323e89a52209efb799d6dc5b68a86

https://treeherder.mozilla.org/jobs?repo=try&group_state=expanded&revision=5d5058d611dd32240f177f021470bc5db146e713

Build seems to be working, tests pending.

The bug is marked as tracked for firefox149 (release), tracked for firefox150 (beta) and tracked for firefox151 (nightly). However, the bug still isn't assigned.

:bhood, could you please find an assignee for this tracked bug? If you disagree with the tracking decision, please talk with the release managers.

For more information, please visit BugBot documentation.

Flags: needinfo?(bhood)

Marking as sec-high instead of sec-crit because it's limited to specific Android devices and the PoC is not public

Keywords: sec-critical → sec-high

(In reply to Timothy Nikkel (:tnikkel) from comment #8)

Not sure if this is useful but I attempted to backport the angle commit listed in the first comment https://chromium.googlesource.com/angle/angle.git/+/05459080c9a323e89a52209efb799d6dc5b68a86

https://treeherder.mozilla.org/jobs?repo=try&group_state=expanded&revision=5d5058d611dd32240f177f021470bc5db146e713

Build seems to be working, tests pending.

I don't think the patch above is actually turning on validatePerStageMaxUniformBlocks

(In reply to Jeff Muizelaar [:jrmuizel] from comment #11)

I don't think the patch above is actually turning on validatePerStageMaxUniformBlocks

Thanks. I don't really know this code but here is an attempt at doing that

https://treeherder.mozilla.org/jobs?repo=try&revision=dded04d239bacade04e94dfe811dae98d262244f

It has an android build if someone has a pixel 10 to test with.

Jamie, do you have a Pixel 10 you can verify the fix on?

Flags: needinfo?(bhood) → needinfo?(jnicol)

On a Pixel 10 with the latest nightly GVE installed from mozregression I get a segfault when opening the attached testcase.

With Timothy's build I do not get a segfault, and I see this error message in logcat:

03-31 11:04:59.107 20568 20582 W Isolated Web Content: [JavaScript Warning: "WebGL warning: linkProgram: Must have a compiled vertex shader attached:
03-31 11:04:59.107 20568 20582 W Isolated Web Content: SHADER_INFO_LOG:
03-31 11:04:59.107 20568 20582 W Isolated Web Content: ERROR: 0:4: '' : uniform block count greater than per stage maximum uniform blocks
03-31 11:04:59.107 20568 20582 W Isolated Web Content: "]

So it seems like it works to me

Flags: needinfo?(jnicol)

Also note the Pixel 10 has an Imagination PowerVR GPU, not Mali. That's what the "IMG" in the commit messages in comment 3 refers to. I just want to confirm that the reference to "Mali" in comment 4 was just a mistake (Pixels 6 through 9 did indeed have Mali GPUs so easily done!) rather than there also being a bug on Mali that we must additionally fix?

Flags: needinfo?(dveditz)

I double-checked and I can't find any mention of Mali (or any other driver) specifically; I must have assumed that based on Pixel-related driver bugs we've run into on older Pixel devices.

Flags: needinfo?(dveditz)
Summary: CVE-2026-4439: Out of bounds memory access in llvm::UFWriterVolcanic::GenerateKernels via WebGL (Mali GPU) → CVE-2026-4439: Out of bounds memory access in llvm::UFWriterVolcanic::GenerateKernels via WebGL (on Pixel 10)

Okay thanks for checking, I'll work on figuring out how to turn my patches into something landable.

Whiteboard: [keep hidden while Chrome bug is hidden] → [keep hidden while Chrome bug is hidden][pp3]

ni myself to remind myself to finish this off and get a landable angle cherry pick.

Flags: needinfo?(tnikkel)

(In reply to Timothy Nikkel (:tnikkel) from comment #19)

ni myself to remind myself to finish this off and get a landable angle cherry pick.

Next week is the last full week of beta for Fx151.
:tnikkel, any updates since Comment 19? Is this likely to make Fx151?

Attached file GitHub Pull Request —
Assignee: nobody → emilio
Status: NEW → ASSIGNED
Flags: needinfo?(tnikkel)
Flags: needinfo?(ahale)
Attached file (secure) —
Attached file (secure) —

Comment on attachment 9592081 [details]
(secure)

Security Approval Request

  • How easily could an exploit be constructed based on the patch?: not very easily
  • Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
  • Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?: all
  • If not all supported branches, which bug introduced the flaw?: none
  • Do you have backports for the affected branches?: Yes
  • If not, how different, hard to create, and risky will they be?: should apply cleanly
  • How likely is this patch to cause regressions; how much testing does it need?: has been upstream for a while
  • Is the patch ready to land after security approval is given?: Yes
  • Is Android affected?: Yes
Attachment #9592081 - Flags: sec-approval?
Attachment #9592081 - Flags: sec-approval? → sec-approval+
Pushed by ealvarez@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/4cd6b626dcf4 https://hg.mozilla.org/integration/autoland/rev/0fa628a6af70 Cherry-pick ANGLE commit 05459080c9a323e89a52209efb799d6dc5b68a86. r=gfx-reviewers,bradwerth https://github.com/mozilla-firefox/firefox/commit/9c071e3bcf3b https://hg.mozilla.org/integration/autoland/rev/3dd3a25d6c4c Use ANGLEs uniform block count validator. r=gfx-reviewers,bradwerth

https://hg-edge.mozilla.org/mozilla-central/rev/0fa628a6af70
https://hg-edge.mozilla.org/mozilla-central/rev/3dd3a25d6c4c

Please request Beta and ESR140 uplift on these when you get a chance, though I'm not entirely sure how that works for ANGLE cherry-picks.

Group: gfx-core-security → core-security-release
Status: ASSIGNED → RESOLVED
Closed: 5 months ago
status-firefox153: affected → fixed
Flags: needinfo?(jayjayjazz)
Resolution: --- → FIXED
Target Milestone: --- → 153 Branch
Attachment #9593407 - Flags: approval-mozilla-beta?
Attachment #9593408 - Flags: approval-mozilla-beta?
Attachment #9593443 - Flags: approval-mozilla-esr140?
Attachment #9593444 - Flags: approval-mozilla-esr140?
Attachment #9593446 - Flags: approval-mozilla-esr115?
Attachment #9593447 - Flags: approval-mozilla-esr115?
Attachment #9593407 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
Attachment #9593408 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
Attachment #9593443 - Flags: approval-mozilla-esr140? → approval-mozilla-esr140+
Attachment #9593444 - Flags: approval-mozilla-esr140? → approval-mozilla-esr140+
Attachment #9593446 - Flags: approval-mozilla-esr115? → approval-mozilla-esr115+
Attachment #9593447 - Flags: approval-mozilla-esr115? → approval-mozilla-esr115+
QA Whiteboard: [sec] [uplift] [qa-triage-done-c153/b152]
Whiteboard: [keep hidden while Chrome bug is hidden][pp3] → [keep hidden while Chrome bug is hidden][pp3][adv-main152+]
Whiteboard: [keep hidden while Chrome bug is hidden][pp3][adv-main152+] → [keep hidden while Chrome bug is hidden][pp3][adv-main152+][adv-esr115.37+]
Whiteboard: [keep hidden while Chrome bug is hidden][pp3][adv-main152+][adv-esr115.37+] → [keep hidden while Chrome bug is hidden][pp3][adv-main152+][adv-esr115.37+][adv-esr140.12+]
Alias: CVE-2026-12290
Group: core-security-release
Keywords: keep-hidden
Whiteboard: [keep hidden while Chrome bug is hidden][pp3][adv-main152+][adv-esr115.37+][adv-esr140.12+] → [pp3][adv-main152+][adv-esr115.37+][adv-esr140.12+]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: