High firefox Sandbox Escape 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionSandbox escape due to incorrect boundary conditions in the Graphics: WebRender component
ComponentGraphics
Bug ClassSandbox Escape
Tracker2011062
Fix commitcf5ad2f2642e (firefox) +5/-0
CISA KEVNot listed
CreditedOskar L
Disclosed2026-02-24

Changed Functions

FunctionChangeNotes
if
gfx/ycbcr/yuv_convert.cpp
modified

Files Changed

  • gfx/ycbcr/yuv_convert.cpp
diff --git a/gfx/ycbcr/yuv_convert.cpp b/gfx/ycbcr/yuv_convert.cpp
index e225bd8ee40..e0befc10b94 100644
--- a/gfx/ycbcr/yuv_convert.cpp
+++ b/gfx/ycbcr/yuv_convert.cpp
@@ -96,6 +96,11 @@ ConvertYCbCrToRGB32(const uint8_t* y_buf,
                     YUVColorSpace yuv_color_space,
                     ColorRange color_range,
                     RGB32Type rgb32_type) {
+  if (pic_x < 0 || pic_y < 0 || y_pitch < 0 || uv_pitch < 0 || rgb_pitch < 0) {
+    NS_WARNING("Negative origin or pitch is unsupported");
+    return  NS_ERROR_NOT_IMPLEMENTED;
+  }
+
   // Deprecated function's conversion is accurate.
   // libyuv converion is a bit inaccurate to get performance. It dynamically
   // calculates RGB from YUV to use simd. In it, signed byte is used for
Loading diff…