PatchGap
Firefox · DOM

CVE-2026-4695

Logic Error in DOM
High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionIncorrect boundary conditions in the Audio/Video: Web Codecs component
ComponentDOM
Bug ClassLogic Error
Tracker2020030
Fix commit1b8d8d6f61fe (firefox) +30/-0
CISA KEVNot listed
CreditedAtte Kettunen
Disclosed2026-03-24

Changed Functions

FunctionChangeNotes
for
dom/media/webcodecs/crashtests/2020030.html
 modified

Files Changed

  • dom/media/webcodecs/crashtests/2020030.html
  • dom/media/webcodecs/crashtests/crashtests.list

Patch

view commit
diff --git a/dom/media/webcodecs/crashtests/2020030.html b/dom/media/webcodecs/crashtests/2020030.html
new file mode 100644
index 00000000000..d3a66ff381d
--- /dev/null
+++ b/dom/media/webcodecs/crashtests/2020030.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<title>Bug 2020030</title>
+</head>
+<body>
+<script>
+async function boom() {
+  const canvas = document.createElement("canvas");
+
+  try {
+    const encoder = new VideoEncoder({ output: () => {}, error: () => {} });
+    encoder.configure({ codec: "av01.0.08M.10", width: 64, height: 55572 });
+
+    for (let f = 0; f < 5; f++) {
+      const frame = new VideoFrame(canvas, { timestamp: f * 33333 });
+      encoder.encode(frame);
+      frame.close();
+    }
+    await encoder.flush().catch(() => {});
+  } catch (e) {}
+
+  document.documentElement.removeAttribute("class");
+}
+
+boom();
+</script>
+</body>
+</html>
diff --git a/dom/media/webcodecs/crashtests/crashtests.list b/dom/media/webcodecs/crashtests/crashtests.list
index 1965e2f8b02..cc8630e206a 100644
--- a/dom/media/webcodecs/crashtests/crashtests.list
+++ b/dom/media/webcodecs/crashtests/crashtests.list
@@ -22,6 +22,7 @@ skip-if(Android) load 2014836.html
 skip-if(Android) load 2014892.html
 skip-if(Android) load 2017470.html
 skip-if(Android) load 2017491.html
+skip-if(Android) pref(media.ffmpeg.encoder.enabled,true) load 2020030.html
 skip-if(Android) load 2021420.html
 skip-if(Android) load 2021184.html
 skip-if(Android) load 2045057.html
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/dom/media/webcodecs/crashtests/2020030.html b/dom/media/webcodecs/crashtests/2020030.html
new file mode 100644
index 00000000000..d3a66ff381d
--- /dev/null
+++ b/dom/media/webcodecs/crashtests/2020030.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<title>Bug 2020030</title>
+</head>
+<body>
+<script>
+async function boom() {
+  const canvas = document.createElement("canvas");
+
+  try {
+    const encoder = new VideoEncoder({ output: () => {}, error: () => {} });
+    encoder.configure({ codec: "av01.0.08M.10", width: 64, height: 55572 });
+
+    for (let f = 0; f < 5; f++) {
+      const frame = new VideoFrame(canvas, { timestamp: f * 33333 });
+      encoder.encode(frame);
+      frame.close();
+    }
+    await encoder.flush().catch(() => {});
+  } catch (e) {}
+
+  document.documentElement.removeAttribute("class");
+}
+
+boom();
+</script>
+</body>
+</html>
diff --git a/dom/media/webcodecs/crashtests/crashtests.list b/dom/media/webcodecs/crashtests/crashtests.list
index 1965e2f8b02..cc8630e206a 100644
--- a/dom/media/webcodecs/crashtests/crashtests.list
+++ b/dom/media/webcodecs/crashtests/crashtests.list
@@ -22,6 +22,7 @@ skip-if(Android) load 2014836.html
 skip-if(Android) load 2014892.html
 skip-if(Android) load 2017470.html
 skip-if(Android) load 2017491.html
+skip-if(Android) pref(media.ffmpeg.encoder.enabled,true) load 2020030.html
 skip-if(Android) load 2021420.html
 skip-if(Android) load 2021184.html
 skip-if(Android) load 2045057.html
Loading diff…
On This Page