Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionDenial-of-service in the Graphics component
ComponentGraphics
Bug ClassLogic Error
Tracker2068335
Fix commit998347794ad6 (firefox) +11/-0
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-29

Files Changed

  • gfx/layers/wr/WebRenderBridgeParent.cpp
diff --git a/gfx/layers/wr/WebRenderBridgeParent.cpp b/gfx/layers/wr/WebRenderBridgeParent.cpp
index 58842a96f2d..3418a82fafc 100644
--- a/gfx/layers/wr/WebRenderBridgeParent.cpp
+++ b/gfx/layers/wr/WebRenderBridgeParent.cpp
@@ -2351,6 +2351,9 @@ void WebRenderBridgeParent::ScheduleForcedGenerateFrame(
 }
 
 mozilla::ipc::IPCResult WebRenderBridgeParent::RecvCapture() {
+  if (!IsRootWebRenderBridgeParent()) {
+    return IPC_FAIL(this, "Capture is only allowed on the root bridge");
+  }
   if (EnsureInitialized()) {
     mLateInit->mApi->Capture();
   }
@@ -2359,6 +2362,10 @@ mozilla::ipc::IPCResult WebRenderBridgeParent::RecvCapture() {
 
 mozilla::ipc::IPCResult WebRenderBridgeParent::RecvStartCaptureSequence(
     const uint32_t& aFlags) {
+  if (!IsRootWebRenderBridgeParent()) {
+    return IPC_FAIL(this,
+                    "StartCaptureSequence is only allowed on the root bridge");
+  }
   if (EnsureInitialized()) {
     mLateInit->mApi->StartCaptureSequence(aFlags);
   }
@@ -2366,6 +2373,10 @@ mozilla::ipc::IPCResult WebRenderBridgeParent::RecvStartCaptureSequence(
 }
 
 mozilla::ipc::IPCResult WebRenderBridgeParent::RecvStopCaptureSequence() {
+  if (!IsRootWebRenderBridgeParent()) {
+    return IPC_FAIL(this,
+                    "StopCaptureSequence is only allowed on the root bridge");
+  }
   if (EnsureInitialized()) {
     mLateInit->mApi->StopCaptureSequence();
   }
Loading diff…