# CVE-2020-16010: Chrome for Android ConvertToJavaBitmap Heap Buffer Overflow

ConvertToJavaBitmap fell back to 32-bpp ARGB_8888 for unsupported SkColorTypes like 64-bpp RGBA_F16, so memcpy of the larger SkBitmap overflowed the smaller Java bitmap heap buffer.

- Payout: Real-world hack
- Severity: high
- Program: Google Chrome for Android
- Credited: Mark Brand and Sergei Glazunov, Project Zero (Originally posted on [Project Zero blog](https://googleprojectzero.blogspot.com/p/rca.html) 2021-02-04)
- Disclosed: 2020-11-02
- CVE: CVE-2020-16010
- Write-up quality: 8/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2020/CVE-2020-16010.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2020-16010
- Tags: domain:browser domain:mobile impact:rce kind:incident platform:project-zero sev:high tech:android tech:chromium technique:chained technique:source-review vuln:memory-corruption

**Target:** ui/gfx/android/java_bitmap.cc ConvertToJavaBitmap / BitmapHelper.java
**Root cause:** SkColorTypeToBitmapFormat returns BITMAP_FORMAT_NO_CONFIG for unsupported SkColorTypes, and Java getBitmapConfigForFormat defaults that to ARGB_8888 (32-bpp); Skia supports 64-bpp formats like RGBA_F16, so the destination buffer is half the size of the source.
**Steps:**
1. Craft a serialized SkBitmap with an unsupported SkColorType such as RGBA_F16 (64-bpp) and attacker-controlled dimensions/pixels.
2. Deliver it over IPC to a path that calls ConvertToJavaBitmap.
3. SkColorTypeToBitmapFormat hits default -> BITMAP_FORMAT_NO_CONFIG; NOTREACHED is a no-op in release builds.
4. Java getBitmapConfigForFormat maps NO_CONFIG to ARGB_8888, allocating a 32-bpp backing store.
5. memcpy(dst_pixels, src_pixels, skbitmap->computeByteSize()) copies the larger 64-bpp source size into the smaller destination, overflowing the heap.
**How found:** Likely source-code auditing: an IPC fuzzer would need to produce valid serialized SkBitmaps, more work than auditing the conversion code. Variant analysis found the identical bug CVE-2020-16011 in Chrome for Windows.
**Exploitation:** Chained as the Android sandbox escape with CVE-2020-15999 (FreeType); delivered to Android devices running Chrome 81+, with a Chrome 1-day used against Chrome <=80. Detailed exploit flow still under analysis per the write-up.
**Escalation:** Chained with CVE-2020-15999 to escape the Chrome sandbox on Android.
**Insight:** Audit image-format conversion paths where a C++ enum-to-Java enum mapping has a default fallback: any Skia color type not in the switch (e.g. 64-bpp RGBA_F16) silently becomes 32-bpp ARGB_8888, and NOTREACHED is a no-op in release builds, so size mismatches reach memcpy.