flawopen.com/安全事件/ANGLE 通用底层 0-day：一次漏洞攻陷 Chrome、iOS 与 Android
想象两家激烈竞争的智能手机巨头（苹果与谷歌）。为了节省软件研发成本，两家公司不约而同地在手机内部安装了完全相同的第三方电源适配器（ANGLE 图形层），专门用来把国际通用电压（WebGL 标准）转换为各自手机电池接受的本地电压（iPhone 的 Metal 与 Android 的 Vulkan）。黑客通过网页发送了一种极其刁钻的特制电脉冲，导致这个共享适配器瞬间过热起火烧穿保险丝，黑客便能用完全相同的网页攻击代码，同时攻陷苹果 iPhone 与安卓手机。
In December 2025, Google and Apple issued rare, synchronized emergency security advisories for a high-severity zero-day vulnerability tracked as CVE-2025-14174. The vulnerability was discovered by Google's Threat Analysis Group (TAG) and Apple's Security Engineering and Architecture (SEAR) team being actively exploited in targeted in-the-wild cyber espionage campaigns.
Unlike conventional browser zero-days that target V8 (Chrome) or JavaScriptCore (Safari), CVE-2025-14174 originated in ANGLE (Almost Native Graphics Layer Engine). Because Google maintains ANGLE for Chromium and Apple integrates ANGLE into WebKit for WebGL translation on iOS and iPadOS, this single memory corruption bug compromised both browser ecosystems simultaneously.
An attacker hosting a malicious web page could trigger an out-of-bounds memory write simply by rendering a WebGL canvas with specially crafted depth texture parameters, gaining arbitrary code execution within the browser's sandboxed renderer process on both Android/Chrome and iOS/Safari.
When uploading 3D or 2D depth textures via WebGL (texImage2D / texSubImage2D), ANGLE's Metal backend calculated the required staging buffer size based on width, height, and depth. Due to improper bounds validation during pixel format conversion (from WebGL depth formats like DEPTH_COMPONENT32F to Metal's MTLPixelFormatDepth32Float), the row pitch calculation under-allocated memory while the copy routine processed the full input buffer, writing past the heap boundary.
Apple adopted Google's ANGLE to accelerate WebGL compliance without maintaining a separate translation layer from scratch. This created a shared software monoculture: an exploit payload weaponized against ANGLE on Chrome was instantly portable to Apple's WebKit WebContent process on iOS and iPadOS.
WebGL exposes direct GPU memory management primitives (buffers, textures, shaders) to arbitrary JavaScript execution. Because WebGL is enabled by default across all mobile browsers and requires zero user prompts, any visited web link can immediately interact with complex C++ graphics drivers.
// Conceptual flaw in ANGLE's Metal backend (TextureMtl.mm)
angle::Result TextureMtl::uploadDepthData(const gl::Context *context,
const gl::Extents &size,
const uint8_t *clientData) {
// Bug: Row pitch multiplication lacks overflow checks
size_t rowPitch = size.width * getBytesPerPixel(mFormat);
size_t allocationSize = rowPitch * size.height; // Can overflow!
// Under-allocated heap buffer
uint8_t *stagingBuffer = new uint8_t[allocationSize];
// HEAP OUT-OF-BOUNDS WRITE:
// Metal copy helper copies bytes calculated from internal format stride!
CopyDepthSlices(clientData, stagingBuffer, size.width, size.height, size.depth);
return angle::Result::Continue;
}
// Fixed ANGLE implementation using base::CheckedNumeric
angle::Result TextureMtl::uploadDepthData(const gl::Context *context,
const gl::Extents &size,
const uint8_t *clientData) {
// Fix 1: Safe integer multiplication preventing integer overflow
base::CheckedNumeric<size_t> safeSize = size.width;
safeSize *= getBytesPerPixel(mFormat);
safeSize *= size.height;
safeSize *= size.depth;
if (!safeSize.IsValid()) {
return angle::Result::Stop; // Reject invalid buffer geometry
}
size_t allocationSize = safeSize.ValueOrDie();
std::vector<uint8_t> stagingBuffer(allocationSize);
// Fix 2: Bounded copy strictly constrained to allocated buffer capacity
SafeCopyDepthSlices(clientData, stagingBuffer.data(), stagingBuffer.size(), size);
return angle::Result::Continue;
}
# Network IDS / Zeek: Flag suspicious WebGL depth texture exploit payloads
event http_reply(c: connection, msg: http_message) { if (msg$body matches /texImage2D.*DEPTH_COMPONENT/) ... }
# Safari / Chrome Enterprise Policy: Disable WebGL for high-security endpoints
defaults write com.apple.Safari WebKitPreferences.webGLEnabled -bool false
# Chrome Enterprise Policy: Enforce software fallback or block WebGL on untrusted origins
{"Disable3DAPIs": true, "WebGLBlockedForOrigins": ["*"]}
base::CheckedNumeric in Chromium or safe math in Rust) for all graphics buffer and texture pitch calculations.