Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-85048-the-gpu-died — Reproducer and technical analysis for CVE-2026-85048, a Chrome viz surface use-after-free in the GPU process, with ASAN unit tests and browser trigger. | Kitploit
Tools/GitHubGitHub/sneakynachos/cve-2026-85048-the-gpu-died
Memory ForensicsVulnerability AnalysisExploitationDebuggersFuzzingPapers & ResearchBinary Exploitation
GitHubsneakynachos/cve-2026-85048-the-gpu-died

CVE-2026-85048-the-gpu-died

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Reproducer and technical analysis for CVE-2026-85048, a Chrome viz surface use-after-free in the GPU process, with ASAN unit tests and browser trigger.

View Repository
14h 38m agoNot yet reviewed

CVE-2026-85048 — viz surface UAF (GPU process)

Another one that triggers a very difficult to use UAF. The BackupRefPtr will swat it. Also this being in the stage 2, you have to patch to see it happen.

  • Re-entrancy in Surface::UpdateActivationDependencies() stores a stale allocation-group pointer.
  • Trigger is plain CompositorFrame metadata: deps [S1, S2-newer] + a view-transition directive.
  • Without the directive: GPU CHECK(pending_frame_data_) abort instead (easy DoS).
  • Group freed by GC ~20s later; next frame derefs it. ASAN UAF at unit level and in a real browser.
  • Vulnerable 152.0.7977.75, fixed .82 (1e944c7f193). Hand-ported fix runs clean.
  • Production: BackupRefPtr zaps it — registers full of efefefefefefefef.

Run

root@kitploit:~
git apply reproducer-test.patch && autoninja -C out/asan viz_unittests
out/asan/viz_unittests --gtest_filter='*ReentrantActivationStale*' --single-process-tests

git apply stage2-renderer.patch && autoninja -C out/asan content_shell
content_shell --enable-logging=stderr trigger.html                  # ASAN UAF
content_shell --enable-logging=stderr trigger.html?variant=check    # CHECK abort
Download Tool