PatchGap
Firefox · Graphics

CVE-2025-14861

Memory Corruption in Graphics
High firefox Memory Corruption 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionMemory safety bugs present in Firefox 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
ComponentGraphics
Bug ClassMemory Corruption
Tracker1996570
Fix commite0bc0218be87 (firefox) +6/-1
CISA KEVNot listed
CreditedAndrew McCreight and the Mozilla Fuzzing Team
Disclosed2025-12-18

Changed Functions

FunctionChangeNotes
if
gfx/layers/apz/src/AsyncPanZoomController.cpp
 modified

Files Changed

  • gfx/layers/apz/src/AsyncPanZoomController.cpp

Patch

view commit
diff --git a/gfx/layers/apz/src/AsyncPanZoomController.cpp b/gfx/layers/apz/src/AsyncPanZoomController.cpp
index dd8617eb6f0..40fd54b82bf 100644
--- a/gfx/layers/apz/src/AsyncPanZoomController.cpp
+++ b/gfx/layers/apz/src/AsyncPanZoomController.cpp
@@ -929,7 +929,12 @@ void AsyncPanZoomController::Destroy() {
     MonitorAutoLock lock(mRefPtrMonitor);
     mGeckoContentController = nullptr;
     if (mGestureEventListener) {
-      mGestureEventListener->Destroy();
+      APZThreadUtils::RunOnControllerThread(NS_NewRunnableFunction(
+          "AsyncPanZoomController: destroying mGestureEventListener",
+          [listener = std::move(mGestureEventListener)]() {
+            listener->Destroy();
+          }));
+
       mGestureEventListener = nullptr;
     }
   }
Loading diff…
On This Page