The vulnerable path was in WebGLContext::EnableVertexAttribArray and WebGLContext::DisableVertexAttribArray, which immediately issued the raw driver calls gl->fEnableVertexAttribArray(index) and gl->fDisableVertexAttribArray(index) and only then updated the WebGLVertexArray bookkeeping via SetAttribIsArray. On Apple silicon M-series hardware, driving the underlying GPU driver directly in this way — including the special-cased skip of index 0 in the compatibility-profile branch — could leave the driver’s notion of which attributes are array-backed inconsistent with the buffer/stride state that Firefox tracked, so a subsequent draw could read or write vertex attribute memory out of bounds due to a flaw in Apple’s GPU driver. The invariant violated is that the driver’s enabled-attribute state must always be reapplied together with, and derived from, the WebGL-tracked attribute state rather than being set eagerly and independently.

The fix removes the direct fEnableVertexAttribArray/fDisableVertexAttribArray calls (and the fragile compatibility-profile conditional) and instead updates SetAttribIsArray and then calls mBoundVertexArray->DoVertexAttrib(index), which reapplies the full, validated attribute state in one consistent step. This routes all attribute enabling/disabling through a single code path that cannot desynchronize the tracked state from what is programmed into the driver.

An attacker who can run WebGL from web content on Apple M-series hardware gains an out-of-bounds write and resulting memory corruption in the process handling WebGL, a high-severity primitive that can be leveraged toward further compromise. Exploitation requires the victim to run the malicious page in Firefox on affected Apple silicon; other platforms and non-M-series hardware are unaffected. No special privileges beyond normal web content execution are needed.