High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionSandbox escape due to use-after-free in the Graphics component
ComponentGraphics
Bug ClassLogic Error
Tracker2071067
Fix commit2d6d12b38b9e (firefox) +8/-3
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-29

Changed Functions

FunctionChangeNotes
if
gfx/layers/composite/TextureHost.cpp
modified

Files Changed

  • gfx/layers/composite/TextureHost.cpp
diff --git a/gfx/layers/composite/TextureHost.cpp b/gfx/layers/composite/TextureHost.cpp
index 4ddba79f525..3fb7b8bee64 100644
--- a/gfx/layers/composite/TextureHost.cpp
+++ b/gfx/layers/composite/TextureHost.cpp
@@ -180,10 +180,15 @@ already_AddRefed<TextureHost> CreateDummyBufferTextureHost(
   aFlags |= TextureFlags::DUMMY_TEXTURE;
   UniquePtr<TextureData> textureData(BufferTextureData::Create(
       gfx::IntSize(1, 1), gfx::SurfaceFormat::B8G8R8A8, gfx::ColorSpace2::SRGB,
-      gfx::TransferFunction::SRGB, gfx::BackendType::SKIA, aBackend, aFlags,
-      TextureAllocationFlags::ALLOC_DEFAULT, nullptr));
+      gfx::TransferFunction::SRGB, gfx::BackendType::SKIA, aBackend,
+      TextureFlags::NO_FLAGS, TextureAllocationFlags::ALLOC_DEFAULT, nullptr));
+  if (!textureData) {
+    return nullptr;
+  }
   SurfaceDescriptor surfDesc;
-  textureData->Serialize(surfDesc);
+  if (!textureData->Serialize(surfDesc)) {
+    return nullptr;
+  }
   const SurfaceDescriptorBuffer& bufferDesc =
       surfDesc.get_SurfaceDescriptorBuffer();
   const MemoryOrShmem& data = bufferDesc.data();
Loading diff…