High firefox UAF 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionSandbox escape due to use-after-free in the Graphics: Canvas2D component
ComponentGraphics
Bug ClassUAF
Tracker1984825
Fix commitbeb9bc70d5f9 (firefox) +5/-1
CISA KEVNot listed
CreditedOskar L
Disclosed2025-09-16

Changed Functions

FunctionChangeNotes
if
gfx/2d/InlineTranslator.h
modified

Files Changed

  • gfx/2d/InlineTranslator.h
diff --git a/gfx/2d/InlineTranslator.h b/gfx/2d/InlineTranslator.h
index 334edb8404a..ff3af329293 100644
--- a/gfx/2d/InlineTranslator.h
+++ b/gfx/2d/InlineTranslator.h
@@ -92,7 +92,11 @@ class InlineTranslator : public Translator {
   already_AddRefed<SourceSurface> LookupExternalSurface(uint64_t aKey) override;
 
   void AddDrawTarget(ReferencePtr aRefPtr, DrawTarget* aDT) final {
-    mDrawTargets.InsertOrUpdate(aRefPtr, RefPtr{aDT});
+    RefPtr<DrawTarget>& value = mDrawTargets.LookupOrInsert(aRefPtr);
+    if (mCurrentDT && mCurrentDT == value) {
+      mCurrentDT = nullptr;
+    }
+    value = aDT;
   }
 
   void AddPath(ReferencePtr aRefPtr, Path* aPath) final {
Loading diff…