Firefox · DOM
CVE-2026-2778
Sandbox Escape in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/base/StructuredCloneBlob.cpp
Patch
diff --git a/dom/base/StructuredCloneBlob.cpp b/dom/base/StructuredCloneBlob.cpp
index 8d862e08a02..5ba9b50b2da 100644
--- a/dom/base/StructuredCloneBlob.cpp
+++ b/dom/base/StructuredCloneBlob.cpp
@@ -17,6 +17,7 @@
#include "jsapi.h"
#include "mozilla/ErrorResult.h"
#include "mozilla/Maybe.h"
+#include "mozilla/Span.h"
#include "mozilla/UniquePtr.h"
#include "mozilla/dom/BindingDeclarations.h"
#include "mozilla/dom/BlobImpl.h"
@@ -173,7 +174,8 @@ bool StructuredCloneBlob::Holder::ReadStructuredCloneInternal(
return false;
}
#endif
- BlobImpls().AppendElements(&aHolder->BlobImpls()[blobOffset], blobCount);
+ BlobImpls().AppendElements(
+ Span(aHolder->BlobImpls()).Subspan(blobOffset, blobCount));
}
JSStructuredCloneData data(mStructuredCloneScope);
Loading diff…
References
On This Page