High firefox Sandbox Escape 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionSandbox escape due to invalid pointer in the Disability Access APIs component
ComponentCore
Bug ClassSandbox Escape
Tracker2050627
Fix commit05534deead58 (firefox) +12/-19
CISA KEVNot listed
CreditedOskar L
Disclosed2026-07-21

Files Changed

  • accessible/ipc/DocAccessibleParent.cpp
  • accessible/windows/uia/uiaRawElmProvider.cpp
  • accessible/windows/uia/uiaRawElmProvider.h
diff --git a/accessible/ipc/DocAccessibleParent.cpp b/accessible/ipc/DocAccessibleParent.cpp
index 5190c2875cb..c0e4fd521d7 100644
--- a/accessible/ipc/DocAccessibleParent.cpp
+++ b/accessible/ipc/DocAccessibleParent.cpp
@@ -295,7 +295,9 @@ RemoteAccessible* DocAccessibleParent::CreateAcc(
     return nullptr;
   }
 
-  if (aAccData.GenericTypes() & eDocument) {
+  if (aAccData.GenericTypes() & eDocument || aAccData.Type() == eRootType ||
+      aAccData.Type() == eApplicationType ||
+      (aAccData.Type() == eImageType && aAccData.GenericTypes() & eHyperText)) {
     MOZ_ASSERT_UNREACHABLE("Invalid acc type");
     return nullptr;
   }
diff --git a/accessible/windows/uia/uiaRawElmProvider.cpp b/accessible/windows/uia/uiaRawElmProvider.cpp
index 02e59f556ae..f29cd9b3ff0 100644
--- a/accessible/windows/uia/uiaRawElmProvider.cpp
+++ b/accessible/windows/uia/uiaRawElmProvider.cpp
@@ -11,9 +11,6 @@
 #include "AccessibleWrap.h"
 #include "ApplicationAccessible.h"
 #include "ARIAMap.h"
-#include "ia2AccessibleHypertext.h"
-#include "ia2AccessibleTable.h"
-#include "ia2AccessibleTableCell.h"
 #include "LocalAccessible-inl.h"
 #include "mozilla/a11y/Compatibility.h"
 #include "mozilla/a11y/RemoteAccessible.h"
@@ -474,14 +471,13 @@ uiaRawElmProvider::GetPatternProvider(
       return S_OK;
     case UIA_GridPatternId:
       if (acc->IsTable()) {
-        auto grid = GetPatternFromDerived<ia2AccessibleTable, IGridProvider>();
+        auto grid = GetPatternFromDerived<IGridProvider>();
         grid.forget(aPatternProvider);
       }
       return S_OK;
     case UIA_GridItemPatternId:
       if (acc->IsTableCell()) {
-        auto item =
-            GetPatternFromDerived<ia2AccessibleTableCell, IGridItemProvider>();
+        auto item = GetPatternFromDerived<IGridItemProvider>();
         item.forget(aPatternProvider);
       }
       return S_OK;
@@ -538,15 +534,13 @@ uiaRawElmProvider::GetPatternProvider(
       return S_OK;
     case UIA_TablePatternId:
       if (acc->IsTable()) {
-        auto table =
-            GetPatternFromDerived<ia2AccessibleTable, ITableProvider>();
+        auto table = GetPatternFromDerived<ITableProvider>();
         table.forget(aPatternProvider);
       }
       return S_OK;
     case UIA_TableItemPatternId:
       if (acc->IsTableCell()) {
-        auto item =
-            GetPatternFromDerived<ia2AccessibleTableCell, ITableItemProvider>();
+        auto item = GetPatternFromDerived<ITableItemProvider>();
         item.forget(aPatternProvider);
       }
       return S_OK;
@@ -1527,14 +1521,11 @@ bool uiaRawElmProvider::HasValuePattern() const {
   return roleMapEntry && roleMapEntry->Is(nsGkAtoms::textbox);
 }
 
-template <class Derived, class Interface>
+template <class Interface>
 RefPtr<Interface> uiaRawElmProvider::GetPatternFromDerived() {
-  // MsaaAccessible inherits from uiaRawElmProvider. Derived
-  // inherits from MsaaAccessible and Interface. The compiler won't let us
-  // directly static_cast to Interface, hence the intermediate casts.
-  auto* msaa = static_cast<MsaaAccessible*>(this);
-  auto* derived = static_cast<Derived*>(msaa);
-  return derived;
+  RefPtr<Interface> provider;
+  QueryInterface(__uuidof(Interface), getter_AddRefs(provider));
+  return provider;
 }
 
 bool uiaRawElmProvider::HasSelectionItemPattern() {
diff --git a/accessible/windows/uia/uiaRawElmProvider.h b/accessible/windows/uia/uiaRawElmProvider.h
index 89fb4fd7626..2e69781bf73 100644
--- a/accessible/windows/uia/uiaRawElmProvider.h
+++ b/accessible/windows/uia/uiaRawElmProvider.h
@@ -202,7 +202,7 @@ class uiaRawElmProvider : public IAccessibleEx,
   bool HasTogglePattern();
   bool HasExpandCollapsePattern();
   bool HasValuePattern() const;
-  template <class Derived, class Interface>
+  template <class Interface>
   RefPtr<Interface> GetPatternFromDerived();
   bool HasSelectionItemPattern();
   SAFEARRAY* AccRelationsToUiaArray(
Loading diff…