It looks like a possible use after free in pixel vendor graphic caught by mte
Pixel 10 pro fold
Logs below
type: logcat
osVersion: google/rango/rango:/user/release-keys
userType: full.secondary
package: com.minerva_medical.minerva:409, targetSdk 35
buffers: crash
level: verbose
--------- beginning of crash
03-04 09:02:51.484 7321 7433 F libc : Fatal signal 11 (SIGSEGV), code 9 (SEGV_MTESERR), fault addr 0x700bf6c5dcf0064 in tid 7433 (Chrome_InProcGp), pid 7321 (medical.minerva)
03-04 09:02:51.996 7698 7698 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
03-04 09:02:51.996 7698 7698 F DEBUG : Build fingerprint: 'google/rango/rango:16/Release-keys'
03-04 09:02:51.996 7698 7698 F DEBUG : Kernel Release: '6.6.126-android15-8-g8fd157b971ca-4k'
03-04 09:02:51.996 7698 7698 F DEBUG : Revision: 'MP1.0'
03-04 09:02:51.996 7698 7698 F DEBUG : ABI: 'arm64'
03-04 09:02:51.996 7698 7698 F DEBUG : Timestamp: 2026-03-04 06:02:51.735504363-0300
03-04 09:02:51.996 7698 7698 F DEBUG : Process uptime: 82s
03-04 09:02:51.996 7698 7698 F DEBUG : Executable: /system/bin/app_process64
03-04 09:02:51.996 7698 7698 F DEBUG : Cmdline: com.minerva_medical.minerva
03-04 09:02:51.996 7698 7698 F DEBUG : pid: 7321, tid: 7433, name: Chrome_InProcGp >>> com.minerva_medical.minerva <<<
03-04 09:02:51.996 7698 7698 F DEBUG : uid: 1210209
03-04 09:02:51.996 7698 7698 F DEBUG : tagged_addr_ctrl: 000000000007fff7 (PR_TAGGED_ADDR_ENABLE, PR_MTE_TCF_SYNC, PR_MTE_TCF_ASYNC, mask 0xfffe)
03-04 09:02:51.996 7698 7698 F DEBUG : pac_enabled_keys: 000000000000000f (PR_PAC_APIAKEY, PR_PAC_APIBKEY, PR_PAC_APDAKEY, PR_PAC_APDBKEY)
03-04 09:02:51.996 7698 7698 F DEBUG : esr: 0000000092000011 (Data Abort Exception 0x24)
03-04 09:02:51.996 7698 7698 F DEBUG : signal 11 (SIGSEGV), code 9 (SEGV_MTESERR), fault addr 0x0700bf6c5dcf0064 (read)
03-04 09:02:51.996 7698 7698 F DEBUG : x0 0000000000000000 x1 0f00c046cf0c1bb8 x2 0f00c046cf0c1bd0 x3 0000000000000001
03-04 09:02:51.996 7698 7698 F DEBUG : x4 0000000000000000 x5 0000000000000000 x6 0000000000000004 x7 000000001789fe2c
03-04 09:02:51.996 7698 7698 F DEBUG : x8 0f00c046cf0bec1c x9 0700bf6c5dcf0060 x10 0f00c046cf0c1bd0 x11 0000000000002c1c
03-04 09:02:51.996 7698 7698 F DEBUG : x12 0000000000000001 x13 00000000ffffffff x14 0000000000000000 x15 000000000007d580
03-04 09:02:51.996 7698 7698 F DEBUG : x16 0000c231310a6558 x17 0000c2524dd572c0 x18 0000c230b56c8000 x19 0f00c046cf0c6fc0
03-04 09:02:51.996 7698 7698 F DEBUG : x20 0f00c046cf0ca8b8 x21 0000000000000001 x22 0f00c046cf0c1bd0 x23 0f00c046cf0c1bb8
03-04 09:02:51.996 7698 7698 F DEBUG : x24 0f00c046cf0bc000 x25 0000000000000001 x26 0500bfd65a2c3000 x27 0000c230b6cd8040
03-04 09:02:51.996 7698 7698 F DEBUG : x28 0100bf6c5dc49800 x29 0000c230b6a6c470
03-04 09:02:51.996 7698 7698 F DEBUG : lr 006bc2312c2b244c sp 0000c230b6a6c440 pc 0000c2312c2b24b4 pst 0000000060001000
03-04 09:02:51.996 7698 7698 F DEBUG : esr 0000000092000011
03-04 09:02:51.996 7698 7698 F DEBUG : 19 total frames
03-04 09:02:51.996 7698 7698 F DEBUG : backtrace:
03-04 09:02:51.996 7698 7698 F DEBUG : #00 pc 000000000008e4b4 /vendor/lib64/egl/libGLESv2_powervr.so (BindFramebuffer(GLES3Context_TAG*, GLES3FrameBufferRec**, GLES3FrameBufferRec*, bool) (.__uniq.237312041013645830485009770479023593730)+964) (BuildId: 5c09bdbf5bedc8055689e500629872cc)
03-04 09:02:51.996 7698 7698 F DEBUG : #01 pc 0000000000157ce0 /vendor/lib64/egl/libGLESv2_powervr.so (glDeleteFramebuffers+272) (BuildId: 5c09bdbf5bedc8055689e500629872cc)
03-04 09:02:51.996 7698 7698 F DEBUG : #02 pc 00000000099f6484 /product/app/TrichromeLibrary/TrichromeLibrary.apk!libmonochrome_64.so (offset 0x918000) (BuildId: 7568309fcda70122d75bbddbf0417973c2d54d95)
03-04 09:02:51.996 7698 7698 F DEBUG : #03 pc 00000000099fab9c /product/app/TrichromeLibrary/TrichromeLibrary.apk!libmonochrome_64.so (offset 0x918000) (BuildId: 7568309fcda70122d75bbddbf0417973c2d54d95)
03-04 09:02:51.996 7698 7698 F DEBUG : #04 pc 00000000099fac80 /product/app/TrichromeLibrary/TrichromeLibrary.apk!libmonochrome_64.so (offset 0x918000) (BuildId: 7568309fcda70122d75bbddbf0417973c2d54d95)
03-04 09:02:51.996 7698 7698 F DEBUG : #05 pc 0000000009a33ab0 /product/app/TrichromeLibrary/TrichromeLibrary.apk!libmonochrome_64.so (offset 0x918000) (BuildId: 7568309fcda70122d75bbddbf0417973c2d54d95)
03-04 09:02:51.996 7698 7698 F DEBUG : #06 pc 000000000892e1d4 /product/app/TrichromeLibrary/TrichromeLibrary.apk!libmonochrome_64.so (offset 0x918000) (BuildId: 7568309fcda70122d75bbddbf0417973c2d54d95)
03-04 09:02:51.997 7698 7698 F DEBUG : #07 pc 0000000009b013fc /product/app/TrichromeLibrary/TrichromeLibrary.apk!libmonochrome_64.so (offset 0x918000) (BuildId: 7568309fcda70122d75bbddbf0417973c2d54d95)
03-04 09:02:51.997 7698 7698 F DEBUG : #08 pc 000000000886cc74 /product/app/TrichromeLibrary/TrichromeLibrary.apk!libmonochrome_64.so (offset 0x918000) (BuildId: 7568309fcda70122d75bbddbf0417973c2d54d95)
03-04 09:02:51.997 7698 7698 F DEBUG : #09 pc 0000000008824dec /product/app/TrichromeLibrary/TrichromeLibrary.apk!libmonochrome_64.so (offset 0x918000) (BuildId: 7568309fcda70122d75bbddbf0417973c2d54d95)
03-04 09:02:51.997 7698 7698 F DEBUG : #10 pc 0000000006bb5d34 /product/app/TrichromeLibrary/TrichromeLibrary.apk!libmonochrome_64.so (offset 0x918000) (BuildId: 7568309fcda70122d75bbddbf0417973c2d54d95)
03-04 09:02:51.997 7698 7698 F DEBUG : #11 pc 00000000055af42c /product/app/TrichromeLibrary/TrichromeLibrary.apk!libmonochrome_64.so (offset 0x918000) (BuildId: 7568309fcda70122d75bbddbf0417973c2d54d95)
03-04 09:02:51.997 7698 7698 F DEBUG : #12 pc 0000000007c769a0 /product/app/TrichromeLibrary/TrichromeLibrary.apk!libmonochrome_64.so (offset 0x918000) (BuildId: 7568309fcda70122d75bbddbf0417973c2d54d95)
03-04 09:02:51.997 7698 7698 F DEBUG : #13 pc 00000000076a9330 /product/app/TrichromeLibrary/TrichromeLibrary.apk!libmonochrome_64.so (offset 0x918000) (BuildId: 7568309fcda70122d75bbddbf0417973c2d54d95)
03-04 09:02:51.997 7698 7698 F DEBUG : #14 pc 00000000076a9254 /product/app/TrichromeLibrary/TrichromeLibrary.apk!libmonochrome_64.so (offset 0x918000) (BuildId: 7568309fcda70122d75bbddbf0417973c2d54d95)
03-04 09:02:51.997 7698 7698 F DEBUG : #15 pc 00000000055fea40 /product/app/TrichromeLibrary/TrichromeLibrary.apk!libmonochrome_64.so (offset 0x918000) (BuildId: 7568309fcda70122d75bbddbf0417973c2d54d95)
03-04 09:02:51.997 7698 7698 F DEBUG : #16 pc 00000000056096c4 /product/app/TrichromeLibrary/TrichromeLibrary.apk!libmonochrome_64.so (offset 0x918000) (BuildId: 7568309fcda70122d75bbddbf0417973c2d54d95)
03-04 09:02:51.997 7698 7698 F DEBUG : #17 pc 0000000000091584 /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*) (.__uniq.67847048707805468364044055584648682506)+180) (BuildId: 8a370b0bf94749d5fe50368f2a729ddb)
03-04 09:02:51.997 7698 7698 F DEBUG : #18 pc 00000000000813d4 /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+68) (BuildId: 8a370b0bf94749d5fe50368f2a729ddb)
03-04 09:02:51.997 7698 7698 F DEBUG : Learn more about MTE reports: https://source.android.com/docs/security/test/memory-safety/mte-reports