Firefox · DOM
CVE-2025-13023
Sandbox Escape in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/webgpu/ExternalTexture.cpp
Patch
diff --git a/dom/webgpu/ExternalTexture.cpp b/dom/webgpu/ExternalTexture.cpp
index f8c036b6603..21f9598f2d6 100644
--- a/dom/webgpu/ExternalTexture.cpp
+++ b/dom/webgpu/ExternalTexture.cpp
@@ -430,12 +430,11 @@ ExternalTextureSourceHost::ExternalTextureSourceHost(
case layers::SurfaceDescriptor::TSurfaceDescriptorBuffer: {
const layers::SurfaceDescriptorBuffer& bufferDesc =
sd.get_SurfaceDescriptorBuffer();
+ ipc::Shmem& bufferShmem = bufferDesc.data().get_Shmem();
auto source =
CreateFromBufferDesc(aParent, aDeviceId, aQueueId, aDesc,
- bufferDesc.desc(), GetAddressFromDescriptor(sd));
- if (bufferDesc.data().type() == layers::MemoryOrShmem::TShmem) {
- aParent->DeallocShmem(bufferDesc.data().get_Shmem());
- }
+ bufferDesc.desc(), bufferShmem.get<uint8_t>());
+ aParent->DeallocShmem(bufferShmem);
return source;
} break;
Loading diff…
References
On This Page