High firefox Sandbox Escape 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionSandbox escape due to incorrect boundary conditions in the Telemetry component in External Software
ComponentToolkit
Bug ClassSandbox Escape
Tracker2015266
Fix commit8ec0a8f5bc5b (firefox) +6/-0
CISA KEVNot listed
CreditedSajeeb Lohani
Disclosed2026-02-24

Changed Functions

FunctionChangeNotes
if
toolkit/components/telemetry/other/CombinedStacks.cpp
modified
for
toolkit/components/telemetry/other/CombinedStacks.cpp
modified

Files Changed

  • toolkit/components/telemetry/other/CombinedStacks.cpp
diff --git a/toolkit/components/telemetry/other/CombinedStacks.cpp b/toolkit/components/telemetry/other/CombinedStacks.cpp
index 61248f9b405..9819e51bb6f 100644
--- a/toolkit/components/telemetry/other/CombinedStacks.cpp
+++ b/toolkit/components/telemetry/other/CombinedStacks.cpp
@@ -74,11 +74,17 @@ size_t CombinedStacks::AddStack(const Telemetry::ProcessedStack& aStack) {
 }
 
 void CombinedStacks::AddStacks(const CombinedStacks& aStacks) {
+  if (mMaxStacksCount == 0) {
+    return;
+  }
   mStacks.resize(
       std::min(mStacks.size() + aStacks.GetStackCount(), mMaxStacksCount));
 
   for (const auto& stack : aStacks.mStacks) {
     size_t index = mNextIndex;
+    if (index >= mStacks.size()) {
+      break;
+    }
     // Advance the indices of the circular queue holding the stacks.
     mNextIndex = (mNextIndex + 1) % mMaxStacksCount;
 
Loading diff…