Firefox · DOM
CVE-2026-100777
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/canvas/CanvasRenderingContextHelper.cppdom/canvas/CanvasRenderingContextHelper.hdom/canvas/OffscreenCanvas.hdom/html/HTMLCanvasElement.h
Patch
diff --git a/dom/canvas/CanvasRenderingContextHelper.cpp b/dom/canvas/CanvasRenderingContextHelper.cpp
index 96a34931605..576c3cc8fde 100644
--- a/dom/canvas/CanvasRenderingContextHelper.cpp
+++ b/dom/canvas/CanvasRenderingContextHelper.cpp
@@ -229,6 +229,10 @@ already_AddRefed<nsISupports> CanvasRenderingContextHelper::GetOrCreateContext(
} else if (aContextType == CanvasContextType::WebGPU) {
// Telemetry::Accumulate(Telemetry::CANVAS_WEBGPU_SUCCESS, 1);
}
+ } else if (!CanCreateContext()) {
+ // Ensure the canvas has not been detached via a transfer.
+ aRv.ThrowInvalidStateError("Cannot create context for detached canvas.");
+ return nullptr;
} else {
// We already have a context of some type.
if (aContextType != mCurrentContextType) return nullptr;
diff --git a/dom/canvas/CanvasRenderingContextHelper.h b/dom/canvas/CanvasRenderingContextHelper.h
index d1ec68f29a5..4832f87cceb 100644
--- a/dom/canvas/CanvasRenderingContextHelper.h
+++ b/dom/canvas/CanvasRenderingContextHelper.h
@@ -93,6 +93,9 @@ class CanvasRenderingContextHelper {
virtual CSSIntSize GetWidthHeight() = 0;
+ // Whether a new context may be installed on this canvas.
+ virtual bool CanCreateContext() const = 0;
+
CanvasContextType mCurrentContextType;
nsCOMPtr<nsICanvasRenderingContextInternal> mCurrentContext;
};
diff --git a/dom/canvas/OffscreenCanvas.h b/dom/canvas/OffscreenCanvas.h
index 46f4376216b..7e72f30fcb4 100644
--- a/dom/canvas/OffscreenCanvas.h
+++ b/dom/canvas/OffscreenCanvas.h
@@ -139,6 +139,8 @@ class OffscreenCanvas final : public DOMEventTargetHelper,
CSSIntSize GetWidthHeight() override { return CSSIntSize(mWidth, mHeight); }
+ bool CanCreateContext() const override { return !mNeutered; }
+
virtual already_AddRefed<nsICanvasRenderingContextInternal> CreateContext(
CanvasContextType aContextType) override;
diff --git a/dom/html/HTMLCanvasElement.h b/dom/html/HTMLCanvasElement.h
index aa6f21d7d5d..c8f335c3182 100644
--- a/dom/html/HTMLCanvasElement.h
+++ b/dom/html/HTMLCanvasElement.h
@@ -320,6 +320,8 @@ class HTMLCanvasElement final : public nsGenericHTMLElement,
CSSIntSize GetWidthHeight() override;
+ bool CanCreateContext() const override { return !mOffscreenCanvas; }
+
virtual already_AddRefed<nsICanvasRenderingContextInternal> CreateContext(
CanvasContextType aContextType) override;
Loading diff…
References
On This Page