
PoC for a Chrome integer overflow -> OOB write vulnerability I reported to Google in Skia.
Fixed in Chrome M128: https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_10.html
Steps to reproduce:
chromium.diff patch to chromium.genskpic.py to generate drawable_picture.skp.hh, then move the generated file to src/gpu/command_buffer/client.index.html to trigger PoC.