Search for: All records

WebGL is a set of standardized JavaScript APIs for GPU-accelerated graphics. Security of the WebGL interface is paramount because it exposes remote and unsandboxed access to the underlying graphics stack (including the native GL libraries and GPU drivers) in the host OS. Unfortunately, applying state-of-the-art fuzzing techniques to the WebGL interface for vulnerability discovery is challenging because of (1) its huge input state space, and (2) the infeasibility of collecting code coverage across concurrent processes, closed-source libraries, and device drivers in the kernel. Our fuzzing technique, GLeeFuzz, guides input mutation by error messages instead of code coverage. Our key observation is that browsers emit meaningful error messages to aid developers in debugging their WebGL programs. Error messages indicate which part of the input fails (e.g., incomplete arguments, invalid arguments, or unsatisfied dependencies between API calls). Leveraging error messages as feedback, the fuzzer effectively expands coverage by focusing mutation on erroneous parts of the input. We analyze Chrome’s WebGL implementation to identify the dependencies between error-emitting statements and rejected parts of the input, and use this information to guide input mutation. We evaluate our GLeeFuzz prototype on Chrome, Firefox, and Safari on diverse desktop and mobile OSes. We discovered 7 vulnerabilities, 4 in Chrome, 2 in Safari, and 1 in Firefox. The Chrome vulnerabilities allow a remote attacker to freeze the GPU and possibly execute remote code at the browser privilege. 

Abstract The dynamic behavior of a macroscopic adhered hydrogel stabilized through controllable dynamic covalent interactions is reported. These interactions, involving the cross‐linked formation of a hydrogel through reaction of a diacylhydrazine precursor with a tetraformyl partner, increase as a function of time. By using a contact time of 24 h and different compounds with recognized aggregation‐induced emission features (AIEgens), it proves possible to create six laminated acylhydrazone hydrogels displaying different fluorescent colors. Blocks of these hydrogels are then adhered into a structure resembling a Rubik's Cube, a trademark of Rubik's Brand Limited, (RC) and allowed to anneal for 1 h. This produces a 3 × 3 × 3 block (RC) wherein the individual fluorescent gel blocks are loosely adhered to one another. As a consequence, the 1 × 3 × 3 layers making up the RC can be rotated either horizontally or vertically to produce new patterns. Ex situ modification of the RC or application of a chemical stimulus can be used to produce new color arrangements. The present RC structure highlights how the temporal features, strong versus weak adhesion, may be exploited to create smart macroscopic structures.