Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionSite isolation issue in the Graphics component
ComponentGraphics
Bug ClassLogic Error
Tracker2056558
Fix commit076f33aea8c3 (firefox) +23/-0
CISA KEVNot listed
CreditedAbdulaziz Alasaiqah
Disclosed2026-08-18

Files Changed

  • gfx/layers/ipc/CompositorBridgeParent.cpp
  • gfx/layers/ipc/CompositorBridgeParent.h
  • gfx/layers/wr/WebRenderBridgeParent.cpp
diff --git a/gfx/layers/ipc/CompositorBridgeParent.cpp b/gfx/layers/ipc/CompositorBridgeParent.cpp
index 3c3b7234506..89b0220589c 100644
--- a/gfx/layers/ipc/CompositorBridgeParent.cpp
+++ b/gfx/layers/ipc/CompositorBridgeParent.cpp
@@ -157,6 +157,11 @@ bool CompositorBridgeParentBase::OwnsExternalImageId(
   return mNamespace == static_cast<uint32_t>(wr::AsUint64(aId) >> 32);
 }
 
+bool CompositorBridgeParentBase::OwnsPipelineId(
+    const wr::PipelineId& aPipelineId) const {
+  return mNamespace == aPipelineId.mNamespace;
+}
+
 CompositorBridgeParent::LayerTreeState::LayerTreeState()
     : mApzcTreeManagerParent(nullptr),
       mApzInputBridgeParent(nullptr),
diff --git a/gfx/layers/ipc/CompositorBridgeParent.h b/gfx/layers/ipc/CompositorBridgeParent.h
index 52f1f2e98c2..e4b5f7be74c 100644
--- a/gfx/layers/ipc/CompositorBridgeParent.h
+++ b/gfx/layers/ipc/CompositorBridgeParent.h
@@ -155,6 +155,8 @@ class CompositorBridgeParentBase : public PCompositorBridgeParent,
 
   bool OwnsExternalImageId(const wr::ExternalImageId& aId) const;
 
+  bool OwnsPipelineId(const wr::PipelineId& aPipelineId) const;
+
   CompositorManagerParent* GetCompositorManager() const {
     return mCompositorManager;
   }
diff --git a/gfx/layers/wr/WebRenderBridgeParent.cpp b/gfx/layers/wr/WebRenderBridgeParent.cpp
index 8f0090febd3..2ec21fb9c3c 100644
--- a/gfx/layers/wr/WebRenderBridgeParent.cpp
+++ b/gfx/layers/wr/WebRenderBridgeParent.cpp
@@ -1678,6 +1678,10 @@ bool WebRenderBridgeParent::ProcessWebRenderParentCommands(
       case WebRenderParentCommand::TOpAddPipelineIdForCompositable: {
         const OpAddPipelineIdForCompositable& op =
             cmd.get_OpAddPipelineIdForCompositable();
+        if (!GetCompositorBridge()->OwnsPipelineId(op.pipelineId())) {
+          MOZ_ASSERT_UNREACHABLE("Invalid PipelineId!");
+          break;
+        }
 
         AddPipelineIdForCompositable(op.pipelineId(), op.handle(), op.owner(),
                                      aTxn, txnForImageBridge);
@@ -1686,6 +1690,10 @@ bool WebRenderBridgeParent::ProcessWebRenderParentCommands(
       case WebRenderParentCommand::TOpRemovePipelineIdForCompositable: {
         const OpRemovePipelineIdForCompositable& op =
             cmd.get_OpRemovePipelineIdForCompositable();
+        if (!GetCompositorBridge()->OwnsPipelineId(op.pipelineId())) {
+          MOZ_ASSERT_UNREACHABLE("Invalid PipelineId!");
+          break;
+        }
 
         auto* pendingOps =
             mLateInit->mApi->GetPendingAsyncImagePipelineOps(aTxn);
@@ -1701,6 +1709,10 @@ bool WebRenderBridgeParent::ProcessWebRenderParentCommands(
       case WebRenderParentCommand::TOpUpdateAsyncImagePipeline: {
         const OpUpdateAsyncImagePipeline& op =
             cmd.get_OpUpdateAsyncImagePipeline();
+        if (!GetCompositorBridge()->OwnsPipelineId(op.pipelineId())) {
+          MOZ_ASSERT_UNREACHABLE("Invalid PipelineId!");
+          break;
+        }
 
         auto* pendingOps =
             mLateInit->mApi->GetPendingAsyncImagePipelineOps(aTxn);
@@ -1719,6 +1731,10 @@ bool WebRenderBridgeParent::ProcessWebRenderParentCommands(
       case WebRenderParentCommand::TOpUpdatedAsyncImagePipeline: {
         const OpUpdatedAsyncImagePipeline& op =
             cmd.get_OpUpdatedAsyncImagePipeline();
+        if (!GetCompositorBridge()->OwnsPipelineId(op.pipelineId())) {
+          MOZ_ASSERT_UNREACHABLE("Invalid PipelineId!");
+          break;
+        }
 
         aTxn.InvalidateRenderedFrame(wr::RenderReasons::ASYNC_IMAGE);
 
Loading diff…