High firefox Sandbox Escape 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionSandbox escape due to incorrect boundary conditions in the Graphics component
ComponentGraphics
Bug ClassSandbox Escape
Tracker2004602
Fix commit04cf27582307 (firefox) +9/-3
CISA KEVNot listed
CreditedOskar L
Disclosed2026-01-13

Changed Functions

FunctionChangeNotes
switch
gfx/2d/HelpersCairo.h
modified

Files Changed

  • gfx/2d/HelpersCairo.h
diff --git a/gfx/2d/HelpersCairo.h b/gfx/2d/HelpersCairo.h
index e3c707944b0..a10e01bdd62 100644
--- a/gfx/2d/HelpersCairo.h
+++ b/gfx/2d/HelpersCairo.h
@@ -140,9 +140,15 @@ static inline cairo_extend_t GfxExtendToCairoExtend(ExtendMode extend) {
 
 static inline cairo_format_t GfxFormatToCairoFormat(SurfaceFormat format) {
   switch (format) {
-    case SurfaceFormat::A8R8G8B8_UINT32:
+    case SurfaceFormat::B8G8R8A8:
+    case SurfaceFormat::R8G8B8A8:
+    case SurfaceFormat::A8R8G8B8:
+      // case SurfaceFormat::A8R8G8B8_UINT32:
       return CAIRO_FORMAT_ARGB32;
-    case SurfaceFormat::X8R8G8B8_UINT32:
+    case SurfaceFormat::B8G8R8X8:
+    case SurfaceFormat::R8G8B8X8:
+    case SurfaceFormat::X8R8G8B8:
+      // case SurfaceFormat::X8R8G8B8_UINT32:
       return CAIRO_FORMAT_RGB24;
     case SurfaceFormat::A8:
       return CAIRO_FORMAT_A8;
@@ -150,7 +156,7 @@ static inline cairo_format_t GfxFormatToCairoFormat(SurfaceFormat format) {
       return CAIRO_FORMAT_RGB16_565;
     default:
       gfxCriticalError() << "Unknown image format " << (int)format;
-      return CAIRO_FORMAT_ARGB32;
+      return CAIRO_FORMAT_INVALID;
   }
 }
 
Loading diff…