
PoC for a Chrome SKSL bypass + integer overflow -> OOB write vulnerability I reported to Google in Skia.
Fixed in Chrome M128: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html
Steps to reproduce:
Apply the chromium.diff patch to chromium.
Run genskpic.py to generate drawable_picture.skp.hh, then move the generated file to src/gpu/command_buffer/client.
Build and start the browser.
Open any page to trigger PoC.
GPU process will crash.