diff --git a/gfx/thebes/COLRFonts.cpp b/gfx/thebes/COLRFonts.cpp
index 4421ee44313..2e8797a5da6 100644
--- a/gfx/thebes/COLRFonts.cpp
+++ b/gfx/thebes/COLRFonts.cpp
@@ -158,8 +158,8 @@ struct PaintState {
   uint16_t mCoordCount;
   nsTArray<uint32_t>* mVisited;
 
-  const char* COLRv1BaseAddr() const {
-    return reinterpret_cast<const char*>(mHeader.v1);
+  const uint8_t* COLRv1BaseAddr() const {
+    return reinterpret_cast<const uint8_t*>(mHeader.v1);
   }
 
   DeviceColor GetColor(uint16_t aPaletteIndex, float aAlpha) const;
@@ -405,6 +405,10 @@ static int32_t ApplyVariation(const PaintState& aState, int32_t aValue,
   uint32_t deltaSetSize = (regionIndexCount + wordDeltaCount) << longWords;
   const uint8_t* deltaData =
       reinterpret_cast<const uint8_t*>(deltaSets) + deltaSetSize * innerIndex;
+  if (deltaData < reinterpret_cast<const uint8_t*>(deltaSets) ||
+      deltaData > aState.COLRv1BaseAddr() + aState.mCOLRLength - deltaSetSize) {
+    return aValue;
+  }
   uint16_t deltaSize = longWords ? 4 : 2;
   int32_t result = aValue;
   for (uint16_t i = 0; i < regionIndexCount; ++i, deltaData += deltaSize) {
@@ -643,7 +647,7 @@ struct ColorLineT {
       return;
     }
     const auto* stop = colorStops();
-    if (reinterpret_cast<const char*>(stop) + count * sizeof(T) >
+    if (reinterpret_cast<const uint8_t*>(stop) + count * sizeof(T) >
         aState.COLRv1BaseAddr() + aState.mCOLRLength) {
       return;
     }
@@ -1960,9 +1964,9 @@ static bool DispatchPaint(const PaintState& aState, uint32_t aDepth,
     return false;
   }
 
-  const char* paint = aState.COLRv1BaseAddr() + aOffset;
+  const uint8_t* paint = aState.COLRv1BaseAddr() + aOffset;
   // All paint table formats start with an 8-bit 'format' field.
-  uint8_t format = uint8_t(*paint);
+  uint8_t format = *paint;
 
 #define DO_CASE(T)                                                            \
   case T::kFormat:                                                            \
@@ -2007,9 +2011,9 @@ static UniquePtr<Pattern> DispatchMakePattern(const PaintState& aState,
     return nullptr;
   }
 
-  const char* paint = aState.COLRv1BaseAddr() + aOffset;
+  const uint8_t* paint = aState.COLRv1BaseAddr() + aOffset;
   // All paint table formats start with an 8-bit 'format' field.
-  uint8_t format = uint8_t(*paint);
+  uint8_t format = *paint;
 
 #define DO_CASE(T)                                                       \
   case T::kFormat:                                                       \
@@ -2037,9 +2041,9 @@ static Matrix DispatchGetMatrix(const PaintState& aState, uint32_t aOffset) {
     return Matrix();
   }
 
-  const char* paint = aState.COLRv1BaseAddr() + aOffset;
+  const uint8_t* paint = aState.COLRv1BaseAddr() + aOffset;
   // All paint table formats start with an 8-bit 'format' field.
-  uint8_t format = uint8_t(*paint);
+  uint8_t format = *paint;
 
 #define DO_CASE(T)                                                             \
   case T::kFormat:                                                             \
@@ -2077,9 +2081,9 @@ static Rect DispatchGetBounds(const PaintState& aState, uint32_t aDepth,
     return Rect();
   }
 
-  const char* paint = aState.COLRv1BaseAddr() + aOffset;
+  const uint8_t* paint = aState.COLRv1BaseAddr() + aOffset;
   // All paint table formats start with an 8-bit 'format' field.
-  uint8_t format = uint8_t(*paint);
+  uint8_t format = *paint;
 
 #define DO_CASE(T)                                                   \
   case T::kFormat:                                                   \