Use-After-Free in Chrome Dawn WebGPU

Repository contains a browser-based Android Chromium full-chain proof-of-concept that combines CVE-2026-11057 (Skia uninitialized glyph image memory leak) with CVE-2026-5281 (Dawn wire server DeviceInfo use-after-free). The repo is not a framework module; it is a standalone exploit research repository with 10 files: three primary C++ patch files, one main HTML/JavaScript exploit page, and several development artifacts under other/. Core structure and purpose: - SkStrike.cpp.patch modifies Skia's SkStrike::FlattenGlyphsByType to serialize glyph data in a way that causes the GPU process to create glyphs with valid metrics but null image pointers, enabling disclosure of uninitialized image buffer contents. - Device.cpp.patch adds SprayChunkedCommandsFromLabel(), invoked from Device::APICreateBuffer, which parses a specially formatted WebGPU buffer label ("CCM:<m_hex>:<n>") and injects many incomplete ChunkedCommands. These commands remain resident in the Dawn wire server and act as a heap spray containing fake Server / serializer / vtable structures tailored for Android ARM64. - ApiProcs.cpp.patch alters the QueueWriteBuffer path so that when bufferOffset equals 0x414141, it unregisters the Device object to free DeviceInfo, immediately serializes a small occupy ChunkedCommand to reclaim that freed slot, copies an attacker-controlled fake server pointer from the writeBuffer data, and then continues with an invalid offset to provoke the dangling callback path. - exploit.html is the main orchestrator. It uses canvas text rendering and pixel readback to recover leaked heap pointers, validates candidate pointers by looking for arithmetic runs at expected object strides, derives the PartitionAlloc pool base, computes the fake server target address M, creates a hidden iframe child that initializes WebGPU, triggers the CCM label-based spray, and then launches the 5281 trigger stage. Exploit capabilities: 1. Browser-accessible info leak from GPU-process memory via canvas glyph rendering. 2. Heap layout inference by deriving PartitionAlloc pool base from leaked pointers. 3. WebGPU-assisted heap spray into the GPU process using persistent incomplete ChunkedCommands. 4. Triggering a Dawn wire DeviceInfo use-after-free and reclaiming the freed slot with attacker-controlled data. 5. Redirecting a dangling callback to attacker-controlled fake server/vtable structures, reaching a controlled indirect call / vtable hijack crash. The repository explicitly states that disclosure stops at the vtable-hijack stage and does not include a post-control-flow RCE payload. Development files in other/ are auxiliary experiments: Android and Windows leak-only pages, a leak+spray page, and a debug logging patch. Overall, this is a real exploit PoC chain rather than a detector, with operational exploit logic but without a final weaponized payload.

This repository is a proof-of-concept for CVE-2026-5281 targeting Chromium/Chrome's WebGPU stack, specifically the Dawn wire client/server object lifecycle. The repo is small and mostly documentation-heavy: README.md explains the target build and usage, writeup.md contains a detailed root-cause analysis of the upstream Dawn fix, asan.log captures the resulting heap-use-after-free, and poc.html is the browser trigger. The only code-like modification besides the HTML PoC is ApiProcs.cpp.patch, which alters Dawn's generated client code so that when QueueWriteBuffer is called with bufferOffset == 0x414141, the client forcibly unregisters the Device object and rewrites the offset to UINT64_MAX. This creates an invalid object/callback state that later leads to a UAF when asynchronous error/device callbacks fire. The exploit capability is limited to triggering memory corruption/crash in a vulnerable, specially prepared browser build; there is no post-exploitation payload, shell, or command execution logic. The PoC uses WebGPU APIs in JavaScript: requestAdapter(), requestDevice(), createBuffer(), queue.writeBuffer(), and queue.submit(). The crafted writeBuffer call is the core trigger, and submit() forces command flushing so the vulnerable callback path executes. The ASAN traces show the crash in Dawn server-side handling around DoAdapterRequestDevice / DoQueueWriteBuffer and callback forwarding, consistent with a use-after-free involving Device callback metadata. Repository structure: 5 files total, with poc.html as the practical entry point and ApiProcs.cpp.patch as the exploit-enabling source modification. README.md and writeup.md explain that the real bug is in server-side device destruction/callback cleanup, while the patch in this repo is used to reliably force the vulnerable state for demonstration. Overall, this is a browser/WebGPU local PoC for vulnerability research and crash reproduction, not a weaponized exploit.

This repository is a small proof-of-concept for CVE-2026-5281 targeting Chromium's WebGPU implementation, specifically the Dawn wire client/server object lifetime and callback handling. The repo contains 5 files: a patch file (ApiProcs.cpp.patch), a browser PoC (poc.html), an ASAN crash log (asan.log), and two documentation files (README.md and writeup.md). The exploit capability is limited to vulnerability triggering and crash reproduction. The HTML PoC uses WebGPU from JavaScript: it requests an adapter and device, installs device.onuncapturederror, creates a buffer, then calls device.queue.writeBuffer with a crafted offset value of 0x414141. The supplied patch modifies the Dawn wire client template so that when QueueWriteBuffer sees this sentinel offset, it forcibly unregisters the device object on the client and rewrites the offset to UINT64_MAX before continuing. This creates an invalid object lifetime/state transition that leads to a server-side callback referencing freed memory. A subsequent queue.submit flushes commands and helps deliver the error/callback path, producing the demonstrated heap-use-after-free. The ASAN logs and writeup indicate the bug manifests in the Dawn wire server / GPU process path, with the crash occurring in Server::DoAdapterRequestDevice callback handling after device-related object data has been freed. The writeup explains the root cause: older cleanup logic only cleared logging callbacks, while uncaptured error and device lost callbacks could still fire after ObjectData deallocation, causing UAF. The referenced upstream fix replaces callback clearing with explicit device destruction (deviceDestroy) to ensure callbacks are flushed safely before object teardown. There are no hardcoded remote C2, IPs, or exploit delivery servers. The only actionable/fingerprintable artifacts are local file paths, upstream review URLs, and the browser-exposed WebGPU API calls. Overall, this is a browser/web attack vector PoC for local reproduction of a Chromium WebGPU memory safety issue, not a weaponized exploit and not a detection-only script.

Repository is a standalone Python-and-HTML proof-of-concept toolkit for CVE-2026-5281, a Chrome Dawn/WebGPU use-after-free. It is not tied to a common exploit framework. The structure is simple: a top-level README with vulnerability background and lab notes, a '01 Vulnerable Binaries' folder documenting official Chrome-for-Testing builds for vulnerable and patched versions, and a '02 PoC' folder containing five Python generators/servers plus prebuilt HTML artifacts. Each Python script writes a self-contained HTML/JavaScript page into the Artifacts directory and serves it via Python's built-in HTTP server on port 8080 bound to 0.0.0.0. The browser-side logic is where the actual capability resides: - 01 Version Detector reads the full Chrome version via navigator.userAgentData.getHighEntropyValues() and compares it to the patched threshold 146.0.7680.178. - 02 Vulnerability Checker probes the full WebGPU attack chain: navigator.gpu availability, adapter/device acquisition, storage buffer allocation, shader compilation, compute pipeline creation, command encoding, queue submission, and buffer destruction after submit. - 03 Local Scanner combines versioning, chain probing, system/GPU context collection, risk scoring, and remediation guidance for a single machine. - 04 Fleet Scanner is a client-side CSV auditor for bulk version triage; it does not exploit targets directly, but helps identify potentially vulnerable hosts from supplied inventory data. - 05 UAF Trigger is the closest thing to an exploit: it repeatedly creates GPU resources and compute workloads, submits them, then destroys buffers after queue.submit() to try to hit the vulnerable race window. It tracks attempts, errors, and possible GPU stall/TDR indicators, and treats crash-like behavior as confirmation. Overall, this repository mixes detection and active triggering. Most files are assessment tools, but the UAF trigger is an operational browser-based PoC for denial-of-service/lab validation rather than full code execution. No reverse shell or post-exploitation payload is present. The exploit path is browser/web-based and depends on a user opening the served page in a vulnerable Chrome build with hardware WebGPU support.

Repository contains a standalone Python-based exploit kit for alleged CVE-2026-5281 in Chrome/Dawn WebGPU, plus automation and scanning utilities. The main file, cve_2026_5281_exploit.py, is the core artifact: it embeds an HTML/JavaScript WebGPU payload intended to trigger a use-after-free by stressing GPU buffer lifecycle handling, generates payload/support files, and can host them via a local Python HTTP server. The exploit flow is browser-delivered: operator serves exploit.html locally, opens it in a Chromium-based browser, and the JavaScript attempts repeated WebGPU buffer allocation/submission/destruction patterns to induce GPU device loss or crash. The demonstrated capability is primarily denial of service / crash triggering rather than reliable code execution. Supporting files broaden the repository beyond a pure exploit: cve_2026_5281_automated_test.py uses Pyppeteer to launch a Chromium-based browser headlessly with unsafe WebGPU and reduced sandboxing flags, navigate to the exploit URL, and classify console output for fatal crash markers. cve_2026_5281_scanner.py is a defensive/audit utility that checks Windows registry keys and common Chrome binary paths for vulnerable versions, supports CSV fleet audits, and triages logs for exploit signatures. The markdown report documents the claimed vulnerability, affected versions, test setup, and observed crash behavior. Two sample logs illustrate vulnerable versus patched outcomes. Overall, this is a mixed exploit-and-validation repository: operational enough to generate and serve a browser payload and observe crash behavior, but not part of a known exploit framework and not obviously weaponized with a customizable post-exploitation payload. The most fingerprintable runtime targets are localhost HTTP serving on port 8080, Windows Chrome registry keys, common Chrome executable paths, and the default Edge executable path used for automation.