High firefox Sandbox Escape 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionSandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component
ComponentDOM
Bug ClassSandbox Escape
Tracker1992032
Fix commit9b1a02828ca2 (firefox) +3/-4
CISA KEVNot listed
CreditedOskar L
Disclosed2025-11-11

Files Changed

  • dom/webgpu/ExternalTexture.cpp
diff --git a/dom/webgpu/ExternalTexture.cpp b/dom/webgpu/ExternalTexture.cpp
index f8c036b6603..21f9598f2d6 100644
--- a/dom/webgpu/ExternalTexture.cpp
+++ b/dom/webgpu/ExternalTexture.cpp
@@ -430,12 +430,11 @@ ExternalTextureSourceHost::ExternalTextureSourceHost(
     case layers::SurfaceDescriptor::TSurfaceDescriptorBuffer: {
       const layers::SurfaceDescriptorBuffer& bufferDesc =
           sd.get_SurfaceDescriptorBuffer();
+      ipc::Shmem& bufferShmem = bufferDesc.data().get_Shmem();
       auto source =
           CreateFromBufferDesc(aParent, aDeviceId, aQueueId, aDesc,
-                               bufferDesc.desc(), GetAddressFromDescriptor(sd));
-      if (bufferDesc.data().type() == layers::MemoryOrShmem::TShmem) {
-        aParent->DeallocShmem(bufferDesc.data().get_Shmem());
-      }
+                               bufferDesc.desc(), bufferShmem.get<uint8_t>());
+      aParent->DeallocShmem(bufferShmem);
       return source;
     } break;
 
Loading diff…