High firefox Sandbox Escape 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionSandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component
ComponentDOM
Bug ClassSandbox Escape
Tracker2016358
Fix commit01237783a03f (firefox) +3/-1
CISA KEVNot listed
CreditedSajeeb Lohani
Disclosed2026-02-24

Files Changed

  • dom/base/StructuredCloneBlob.cpp
diff --git a/dom/base/StructuredCloneBlob.cpp b/dom/base/StructuredCloneBlob.cpp
index 8d862e08a02..5ba9b50b2da 100644
--- a/dom/base/StructuredCloneBlob.cpp
+++ b/dom/base/StructuredCloneBlob.cpp
@@ -17,6 +17,7 @@
 #include "jsapi.h"
 #include "mozilla/ErrorResult.h"
 #include "mozilla/Maybe.h"
+#include "mozilla/Span.h"
 #include "mozilla/UniquePtr.h"
 #include "mozilla/dom/BindingDeclarations.h"
 #include "mozilla/dom/BlobImpl.h"
@@ -173,7 +174,8 @@ bool StructuredCloneBlob::Holder::ReadStructuredCloneInternal(
       return false;
     }
 #endif
-    BlobImpls().AppendElements(&aHolder->BlobImpls()[blobOffset], blobCount);
+    BlobImpls().AppendElements(
+        Span(aHolder->BlobImpls()).Subspan(blobOffset, blobCount));
   }
 
   JSStructuredCloneData data(mStructuredCloneScope);
Loading diff…