High firefox Sandbox Escape 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionSandbox escape due to incorrect boundary conditions in the Graphics component
ComponentGraphics
Bug ClassSandbox Escape
Tracker2004602
Fix commit04cf27582307 (firefox) +9/-3
CISA KEVNot listed
CreditedOskar L
Disclosed2026-01-13

Changed Functions

FunctionChangeNotes
switch
gfx/2d/HelpersCairo.h
modified

Files Changed

  • gfx/2d/HelpersCairo.h
diff --git a/gfx/2d/HelpersCairo.h b/gfx/2d/HelpersCairo.h
index e3c707944b0..a10e01bdd62 100644
--- a/gfx/2d/HelpersCairo.h
+++ b/gfx/2d/HelpersCairo.h
@@ -140,9 +140,15 @@ static inline cairo_extend_t GfxExtendToCairoExtend(ExtendMode extend) {
 
 static inline cairo_format_t GfxFormatToCairoFormat(SurfaceFormat format) {
   switch (format) {
-    case SurfaceFormat::A8R8G8B8_UINT32:
+    case SurfaceFormat::B8G8R8A8:
+    case SurfaceFormat::R8G8B8A8:
+    case SurfaceFormat::A8R8G8B8:
+      // case SurfaceFormat::A8R8G8B8_UINT32:
       return CAIRO_FORMAT_ARGB32;
-    case SurfaceFormat::X8R8G8B8_UINT32:
+    case SurfaceFormat::B8G8R8X8:
+    case SurfaceFormat::R8G8B8X8:
+    case SurfaceFormat::X8R8G8B8:
+      // case SurfaceFormat::X8R8G8B8_UINT32:
       return CAIRO_FORMAT_RGB24;
     case SurfaceFormat::A8:
       return CAIRO_FORMAT_A8;
@@ -150,7 +156,7 @@ static inline cairo_format_t GfxFormatToCairoFormat(SurfaceFormat format) {
       return CAIRO_FORMAT_RGB16_565;
     default:
       gfxCriticalError() << "Unknown image format " << (int)format;
-      return CAIRO_FORMAT_ARGB32;
+      return CAIRO_FORMAT_INVALID;
   }
 }
 
Loading diff…