Firefox · Core
CVE-2026-16367
Sandbox Escape in Core
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
accessible/ipc/DocAccessibleParent.cppaccessible/windows/uia/uiaRawElmProvider.cppaccessible/windows/uia/uiaRawElmProvider.h
Patch
diff --git a/accessible/ipc/DocAccessibleParent.cpp b/accessible/ipc/DocAccessibleParent.cpp
index 5190c2875cb..c0e4fd521d7 100644
--- a/accessible/ipc/DocAccessibleParent.cpp
+++ b/accessible/ipc/DocAccessibleParent.cpp
@@ -295,7 +295,9 @@ RemoteAccessible* DocAccessibleParent::CreateAcc(
return nullptr;
}
- if (aAccData.GenericTypes() & eDocument) {
+ if (aAccData.GenericTypes() & eDocument || aAccData.Type() == eRootType ||
+ aAccData.Type() == eApplicationType ||
+ (aAccData.Type() == eImageType && aAccData.GenericTypes() & eHyperText)) {
MOZ_ASSERT_UNREACHABLE("Invalid acc type");
return nullptr;
}
diff --git a/accessible/windows/uia/uiaRawElmProvider.cpp b/accessible/windows/uia/uiaRawElmProvider.cpp
index 02e59f556ae..f29cd9b3ff0 100644
--- a/accessible/windows/uia/uiaRawElmProvider.cpp
+++ b/accessible/windows/uia/uiaRawElmProvider.cpp
@@ -11,9 +11,6 @@
#include "AccessibleWrap.h"
#include "ApplicationAccessible.h"
#include "ARIAMap.h"
-#include "ia2AccessibleHypertext.h"
-#include "ia2AccessibleTable.h"
-#include "ia2AccessibleTableCell.h"
#include "LocalAccessible-inl.h"
#include "mozilla/a11y/Compatibility.h"
#include "mozilla/a11y/RemoteAccessible.h"
@@ -474,14 +471,13 @@ uiaRawElmProvider::GetPatternProvider(
return S_OK;
case UIA_GridPatternId:
if (acc->IsTable()) {
- auto grid = GetPatternFromDerived<ia2AccessibleTable, IGridProvider>();
+ auto grid = GetPatternFromDerived<IGridProvider>();
grid.forget(aPatternProvider);
}
return S_OK;
case UIA_GridItemPatternId:
if (acc->IsTableCell()) {
- auto item =
- GetPatternFromDerived<ia2AccessibleTableCell, IGridItemProvider>();
+ auto item = GetPatternFromDerived<IGridItemProvider>();
item.forget(aPatternProvider);
}
return S_OK;
@@ -538,15 +534,13 @@ uiaRawElmProvider::GetPatternProvider(
return S_OK;
case UIA_TablePatternId:
if (acc->IsTable()) {
- auto table =
- GetPatternFromDerived<ia2AccessibleTable, ITableProvider>();
+ auto table = GetPatternFromDerived<ITableProvider>();
table.forget(aPatternProvider);
}
return S_OK;
case UIA_TableItemPatternId:
if (acc->IsTableCell()) {
- auto item =
- GetPatternFromDerived<ia2AccessibleTableCell, ITableItemProvider>();
+ auto item = GetPatternFromDerived<ITableItemProvider>();
item.forget(aPatternProvider);
}
return S_OK;
@@ -1527,14 +1521,11 @@ bool uiaRawElmProvider::HasValuePattern() const {
return roleMapEntry && roleMapEntry->Is(nsGkAtoms::textbox);
}
-template <class Derived, class Interface>
+template <class Interface>
RefPtr<Interface> uiaRawElmProvider::GetPatternFromDerived() {
- // MsaaAccessible inherits from uiaRawElmProvider. Derived
- // inherits from MsaaAccessible and Interface. The compiler won't let us
- // directly static_cast to Interface, hence the intermediate casts.
- auto* msaa = static_cast<MsaaAccessible*>(this);
- auto* derived = static_cast<Derived*>(msaa);
- return derived;
+ RefPtr<Interface> provider;
+ QueryInterface(__uuidof(Interface), getter_AddRefs(provider));
+ return provider;
}
bool uiaRawElmProvider::HasSelectionItemPattern() {
diff --git a/accessible/windows/uia/uiaRawElmProvider.h b/accessible/windows/uia/uiaRawElmProvider.h
index 89fb4fd7626..2e69781bf73 100644
--- a/accessible/windows/uia/uiaRawElmProvider.h
+++ b/accessible/windows/uia/uiaRawElmProvider.h
@@ -202,7 +202,7 @@ class uiaRawElmProvider : public IAccessibleEx,
bool HasTogglePattern();
bool HasExpandCollapsePattern();
bool HasValuePattern() const;
- template <class Derived, class Interface>
+ template <class Interface>
RefPtr<Interface> GetPatternFromDerived();
bool HasSelectionItemPattern();
SAFEARRAY* AccRelationsToUiaArray(
Loading diff…
References
On This Page