flawopen.com/Инциденты/Универсальный Zero-Day в библиотеке ANGLE

Универсальный Zero-Day в библиотеке ANGLE

Ключевые термины на этой странице

ANGLE (Almost Native Graphics Layer Engine)

An open-source library created by Google that translates standard WebGL and OpenGL ES commands into hardware-native APIs: Metal on Apple devices, Direct3D on Windows, and Vulkan on Android and Linux.

shared monoculture vulnerability

A critical security flaw in a shared open-source foundation library that bypasses vendor platform boundaries, exposing competing operating systems to the identical exploit.

Metal backend depth texture conversion

The specific subsystem in ANGLE on Apple platforms that converts raw WebGL depth pixel buffers into Metal-compatible GPU texture slices.

WebGL memory corruption

Exploiting browser memory safety bugs through standard, unprivileged JavaScript Canvas 3D API calls without requiring browser plugins or special permissions.

Краткое изложение инцидента

In December 2025, Google and Apple issued rare, synchronized emergency security advisories for a high-severity zero-day vulnerability tracked as CVE-2025-14174. The vulnerability was discovered by Google's Threat Analysis Group (TAG) and Apple's Security Engineering and Architecture (SEAR) team being actively exploited in targeted in-the-wild cyber espionage campaigns.

Unlike conventional browser zero-days that target V8 (Chrome) or JavaScriptCore (Safari), CVE-2025-14174 originated in ANGLE (Almost Native Graphics Layer Engine). Because Google maintains ANGLE for Chromium and Apple integrates ANGLE into WebKit for WebGL translation on iOS and iPadOS, this single memory corruption bug compromised both browser ecosystems simultaneously.

An attacker hosting a malicious web page could trigger an out-of-bounds memory write simply by rendering a WebGL canvas with specially crafted depth texture parameters, gaining arbitrary code execution within the browser's sandboxed renderer process on both Android/Chrome and iOS/Safari.

Технические первопричины

Уязвимая и защищенная архитектура

// Conceptual flaw in ANGLE's Metal backend (TextureMtl.mm)
angle::Result TextureMtl::uploadDepthData(const gl::Context *context,
                                         const gl::Extents &size,
                                         const uint8_t *clientData) {
  // Bug: Row pitch multiplication lacks overflow checks
  size_t rowPitch = size.width * getBytesPerPixel(mFormat);
  size_t allocationSize = rowPitch * size.height; // Can overflow!

  // Under-allocated heap buffer
  uint8_t *stagingBuffer = new uint8_t[allocationSize];

  // HEAP OUT-OF-BOUNDS WRITE:
  // Metal copy helper copies bytes calculated from internal format stride!
  CopyDepthSlices(clientData, stagingBuffer, size.width, size.height, size.depth);
  return angle::Result::Continue;
}

// Fixed ANGLE implementation using base::CheckedNumeric
angle::Result TextureMtl::uploadDepthData(const gl::Context *context,
                                         const gl::Extents &size,
                                         const uint8_t *clientData) {
  // Fix 1: Safe integer multiplication preventing integer overflow
  base::CheckedNumeric<size_t> safeSize = size.width;
  safeSize *= getBytesPerPixel(mFormat);
  safeSize *= size.height;
  safeSize *= size.depth;

  if (!safeSize.IsValid()) {
    return angle::Result::Stop; // Reject invalid buffer geometry
  }

  size_t allocationSize = safeSize.ValueOrDie();
  std::vector<uint8_t> stagingBuffer(allocationSize);

  // Fix 2: Bounded copy strictly constrained to allocated buffer capacity
  SafeCopyDepthSlices(clientData, stagingBuffer.data(), stagingBuffer.size(), size);
  return angle::Result::Continue;
}

Обнаружение и средства контроля безопасности

Уроки безопасности цепочки поставок и чек-лист

• ✓Audit Open-Source Abstraction Layers: Map your organization's hidden supply-chain dependencies where shared parsing libraries (ANGLE, FreeType, libxml2) cross operating system silos.
• ✓Enforce Strict Integer Overflow Checks: Use checked arithmetic primitives (such as base::CheckedNumeric in Chromium or safe math in Rust) for all graphics buffer and texture pitch calculations.
• ✓Lockdown Mode for High-Value Targets: Enable iOS Lockdown Mode, which disables WebGL and JIT compilation to neutralize browser memory corruption zero-days.
• ✓Separate GPU Process Sandboxing: Ensure GPU rendering is isolated in a dedicated, low-privilege GPU sandbox process with no access to local files or credentials.

Источники и ссылки на бюллетени

• MITRE CVE-2025-14174: ANGLE Out-of-Bounds Memory Access
• Google Chrome Releases — Stable Channel Update (December 10, 2025)
• Apple Security Updates — About the security content of iOS 18.2 and macOS Sequoia (December 12, 2025)
• CISA Known Exploited Vulnerabilities Catalog — CVE-2025-14174
• Chromium ANGLE Project Source Repository