High firefox Sandbox Escape 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionSandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component
ComponentGraphics
Bug ClassSandbox Escape
Tracker2003989
Fix commit1ba9d806f109 (firefox) +4/-0
CISA KEVNot listed
CreditedOskar L
Disclosed2026-01-13

Changed Functions

FunctionChangeNotes
while
gfx/layers/SourceSurfaceSharedData.cpp
modified

Files Changed

  • gfx/layers/SourceSurfaceSharedData.cpp
diff --git a/gfx/layers/SourceSurfaceSharedData.cpp b/gfx/layers/SourceSurfaceSharedData.cpp
index a6d0d02d7de..57948291382 100644
--- a/gfx/layers/SourceSurfaceSharedData.cpp
+++ b/gfx/layers/SourceSurfaceSharedData.cpp
@@ -79,6 +79,10 @@ void SourceSurfaceSharedDataWrapper::Init(SourceSurfaceSharedData* aSurface) {
 bool SourceSurfaceSharedDataWrapper::EnsureMapped(size_t aLength) {
   MOZ_ASSERT(!GetData());
 
+  if (mBufHandle.Size() < aLength) {
+    return false;
+  }
+
   auto mapping = mBufHandle.Map();
   while (!mapping) {
     nsTArray<RefPtr<SourceSurfaceSharedDataWrapper>> expired;
Loading diff…