Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionSite isolation issue in the Panning and Zooming component
ComponentGraphics
Bug ClassLogic Error
Tracker2071784
Fix commit07c303d3d002 (firefox) +6/-0
CISA KEVNot listed
CreditedNguyen Thanh Nguyen
Disclosed2026-09-29

Changed Functions

FunctionChangeNotes
for
gfx/layers/ipc/APZCTreeManagerParent.cpp
modified

Files Changed

  • gfx/layers/ipc/APZCTreeManagerParent.cpp
diff --git a/gfx/layers/ipc/APZCTreeManagerParent.cpp b/gfx/layers/ipc/APZCTreeManagerParent.cpp
index 1a18ed20955..86ae1dd42c9 100644
--- a/gfx/layers/ipc/APZCTreeManagerParent.cpp
+++ b/gfx/layers/ipc/APZCTreeManagerParent.cpp
@@ -68,6 +68,12 @@ mozilla::ipc::IPCResult APZCTreeManagerParent::RecvContentReceivedInputBlock(
 
 mozilla::ipc::IPCResult APZCTreeManagerParent::RecvSetTargetAPZC(
     const uint64_t& aInputBlockId, nsTArray<ScrollableLayerGuid>&& aTargets) {
+  for (const auto& guid : aTargets) {
+    if (!IsGuidValid(guid)) {
+      return IPC_FAIL_NO_REASON(this);
+    }
+  }
+
   mUpdater->RunOnUpdaterThread(
       mLayersId,
       NewRunnableMethod<uint64_t,
Loading diff…