High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the Graphics: Canvas2D component
ComponentDOM
Bug ClassLogic Error
Tracker2068375
Fix commitdf6bb4f2c80e (firefox) +11/-0
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-29

Files Changed

  • dom/canvas/CanvasRenderingContextHelper.cpp
  • dom/canvas/CanvasRenderingContextHelper.h
  • dom/canvas/OffscreenCanvas.h
  • dom/html/HTMLCanvasElement.h
diff --git a/dom/canvas/CanvasRenderingContextHelper.cpp b/dom/canvas/CanvasRenderingContextHelper.cpp
index 96a34931605..576c3cc8fde 100644
--- a/dom/canvas/CanvasRenderingContextHelper.cpp
+++ b/dom/canvas/CanvasRenderingContextHelper.cpp
@@ -229,6 +229,10 @@ already_AddRefed<nsISupports> CanvasRenderingContextHelper::GetOrCreateContext(
     } else if (aContextType == CanvasContextType::WebGPU) {
       // Telemetry::Accumulate(Telemetry::CANVAS_WEBGPU_SUCCESS, 1);
     }
+  } else if (!CanCreateContext()) {
+    // Ensure the canvas has not been detached via a transfer.
+    aRv.ThrowInvalidStateError("Cannot create context for detached canvas.");
+    return nullptr;
   } else {
     // We already have a context of some type.
     if (aContextType != mCurrentContextType) return nullptr;
diff --git a/dom/canvas/CanvasRenderingContextHelper.h b/dom/canvas/CanvasRenderingContextHelper.h
index d1ec68f29a5..4832f87cceb 100644
--- a/dom/canvas/CanvasRenderingContextHelper.h
+++ b/dom/canvas/CanvasRenderingContextHelper.h
@@ -93,6 +93,9 @@ class CanvasRenderingContextHelper {
 
   virtual CSSIntSize GetWidthHeight() = 0;
 
+  // Whether a new context may be installed on this canvas.
+  virtual bool CanCreateContext() const = 0;
+
   CanvasContextType mCurrentContextType;
   nsCOMPtr<nsICanvasRenderingContextInternal> mCurrentContext;
 };
diff --git a/dom/canvas/OffscreenCanvas.h b/dom/canvas/OffscreenCanvas.h
index 46f4376216b..7e72f30fcb4 100644
--- a/dom/canvas/OffscreenCanvas.h
+++ b/dom/canvas/OffscreenCanvas.h
@@ -139,6 +139,8 @@ class OffscreenCanvas final : public DOMEventTargetHelper,
 
   CSSIntSize GetWidthHeight() override { return CSSIntSize(mWidth, mHeight); }
 
+  bool CanCreateContext() const override { return !mNeutered; }
+
   virtual already_AddRefed<nsICanvasRenderingContextInternal> CreateContext(
       CanvasContextType aContextType) override;
 
diff --git a/dom/html/HTMLCanvasElement.h b/dom/html/HTMLCanvasElement.h
index aa6f21d7d5d..c8f335c3182 100644
--- a/dom/html/HTMLCanvasElement.h
+++ b/dom/html/HTMLCanvasElement.h
@@ -320,6 +320,8 @@ class HTMLCanvasElement final : public nsGenericHTMLElement,
 
   CSSIntSize GetWidthHeight() override;
 
+  bool CanCreateContext() const override { return !mOffscreenCanvas; }
+
   virtual already_AddRefed<nsICanvasRenderingContextInternal> CreateContext(
       CanvasContextType aContextType) override;
 
Loading diff…