PatchGap
Firefox · DOM

CVE-2026-2788

Logic Error in DOM
Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionIncorrect boundary conditions in the Audio/Video: GMP component
ComponentDOM
Bug ClassLogic Error
Tracker2014824
Fix commitf911fe150702 (firefox) +4/-2
CISA KEVNot listed
CreditedEvyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
Disclosed2026-02-24

Changed Functions

FunctionChangeNotes
if
dom/media/eme/clearkey/ClearKeyUtils.cpp
 modified

Files Changed

  • dom/media/eme/clearkey/ClearKeyUtils.cpp

Patch

view commit
diff --git a/dom/media/eme/clearkey/ClearKeyUtils.cpp b/dom/media/eme/clearkey/ClearKeyUtils.cpp
index fb39433586d..d895d3e3721 100644
--- a/dom/media/eme/clearkey/ClearKeyUtils.cpp
+++ b/dom/media/eme/clearkey/ClearKeyUtils.cpp
@@ -188,8 +188,10 @@ bool ClearKeyUtils::DecryptCbcs(const vector<uint8_t>& aKey,
 /* static */
 bool ClearKeyUtils::DecryptAES(const vector<uint8_t>& aKey,
                                vector<uint8_t>& aData, vector<uint8_t>& aIV) {
-  assert(aIV.size() == CENC_KEY_LEN);
-  assert(aKey.size() == CENC_KEY_LEN);
+  if (aKey.size() != CENC_KEY_LEN || aIV.size() != CENC_KEY_LEN) {
+    CK_LOGE("Key and IV size should be 16!");
+    return false;
+  }
 
   PK11SlotInfo* slot = PK11_GetInternalKeySlot();
   if (!slot) {
Loading diff…
On This Page