Heap Feng Shader: Exploiting Swift Shader in Chrome
Summary: Project Zero's Mark Brand detailed two Chrome SwiftShader vulnerabilities, a precision-related information leak that returns 0x10000 bytes past a 0xb620000-byte texture allocation, and a use-after-free of an egl::ImageImplementation object caused by a reference count overflow. He chained them into GPU process code execution by replacing the freed object with a shader uniform allocation, then faking a vtable so the process loads an attacker-supplied ELF payload as shellcode.
What you should know: Chrome falls back to SwiftShader after the GPU process crashes more than 4 times, and Brand notes that on typical Linux desktops the GPU process sandbox is very weak because of X11 access limitations - so a renderer compromise is not required to reach a process with a larger kernel attack surface.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026