High firefox Sandbox Escape 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionSandbox escape due to incorrect boundary conditions in the Telemetry component
ComponentToolkit
Bug ClassSandbox Escape
Tracker2016368
Fix commit31d588fc9818 (firefox) +9/-0
CISA KEVNot listed
CreditedSajeeb Lohani
Disclosed2026-03-24

Changed Functions

FunctionChangeNotes
for
toolkit/components/telemetry/other/CombinedStacks.h
modified

Files Changed

  • toolkit/components/telemetry/other/CombinedStacks.h
diff --git a/toolkit/components/telemetry/other/CombinedStacks.h b/toolkit/components/telemetry/other/CombinedStacks.h
index 5848eb8d603..be8f9e8f24b 100644
--- a/toolkit/components/telemetry/other/CombinedStacks.h
+++ b/toolkit/components/telemetry/other/CombinedStacks.h
@@ -99,6 +99,15 @@ struct ParamTraits<mozilla::Telemetry::CombinedStacks> {
       return false;
     }
 
+    for (const auto& stack : aResult->mStacks) {
+      for (const auto& frame : stack) {
+        if (frame.mModIndex != std::numeric_limits<uint16_t>::max() &&
+            frame.mModIndex >= aResult->mModules.size()) {
+          return false;
+        }
+      }
+    }
+
     return true;
   }
 };
Loading diff…