# CVE-2022-4135: Chrome heap buffer overflow in validating command decoder

Chrome GPU command decoder created shared-image textures with max_levels=1, letting a WebGL blendColor/DiscardFramebufferEXT sequence overflow level_infos and corrupt GPU-process heap.

- Payout: Real-world hack
- Severity: high
- Program: Google Chrome
- Credited: Sergei Glazunov, Google Project Zero
- Disclosed: 2022-11-24
- CVE: CVE-2022-4135
- Write-up quality: 8/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2022/CVE-2022-4135.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2022-4135
- Tags: domain:browser impact:data-leak impact:rce kind:incident platform:project-zero sev:high tech:chromium technique:chained technique:source-review vuln:dos vuln:memory-corruption

**Target:** Chrome GPU process / GLES2 validating command decoder (WebGL)
**Root cause:** CreateGLES2TextureWithLightRef sets max_levels=1 for shared-image textures, but ValidForTarget validates against MaxLevelsForTarget(target), so an out-of-range level passes validation and indexes past the level_infos vector.
**Steps:**
1. Create a WebGL2 canvas context.
2. Create a shared image via SharedImageInterface::CreateSharedImage (RGBA_4444, 32x32), flush, GenUnverifiedSyncToken, WaitSyncTokenCHROMIUM.
3. CreateAndTexStorage2DSharedImageCHROMIUM(mailbox.name) to get a texture with max_levels=1.
4. GenFramebuffers/BindFramebuffer(GL_READ_FRAMEBUFFER), FramebufferTexture2D with level=1 (passes ValidForTarget since MaxLevelsForTarget allows it).
5. Call DiscardFramebufferEXT(GL_READ_FRAMEBUFFER, 1, &attachment) to reach Texture::SetLevelCleared and write out of bounds on level_infos[1].
6. Trigger via context.blendColor(0,0,0,0) in repro.html.
**How found:** Likely code audit: the hardcoded max_levels=1 in the SetTarget call site in CreateGLES2TextureWithLightRef mismatches other call sites using MaxLevelsForTarget, which is also used for validation. Alternatively a custom GPU interface fuzzer.
**Exploitation:** Abuses command buffer and GLES2 APIs for memory manipulation; a corrupted memory bucket leaks GPU-process data to break ASLR, then a ROP chain hijacks control flow. Chained with CVE-2022-3723.
**Escalation:** Chained with CVE-2022-3723 as part of an in-the-wild exploit chain; non-linear overflow with controlled offset gives strong primitive.
**Insight:** When a validation function and an allocation function both derive bounds from the same helper (MaxLevelsForTarget), hunt for any construction path that hardcodes a smaller size than the validator assumes; shared-image/foreign-resource creation paths often bypass the normal manager.