Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionPrivilege escalation due to use-after-free in the Graphics: WebRender component
ComponentWidget
Bug ClassLogic Error
Tracker2050542
Fix commit06bed2fc7256 (firefox) +3/-2
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-29

Changed Functions

FunctionChangeNotes
mBackbuffer
widget/windows/RemoteBackbuffer.cpp
modified
if
widget/windows/RemoteBackbuffer.cpp
modified

Files Changed

  • widget/windows/RemoteBackbuffer.cpp
diff --git a/widget/windows/RemoteBackbuffer.cpp b/widget/windows/RemoteBackbuffer.cpp
index 6800dd13a2a..0044327a96b 100644
--- a/widget/windows/RemoteBackbuffer.cpp
+++ b/widget/windows/RemoteBackbuffer.cpp
@@ -320,14 +320,15 @@ Provider::Provider()
       mBackbuffer() {}
 
 Provider::~Provider() {
-  mBackbuffer.reset();
-
+  // Stop and join the service thread before releasing any state.
   if (mServiceThread) {
     mStopServiceThread = true;
     MOZ_ALWAYS_TRUE(::SetEvent(mRequestReadyEvent));
     MOZ_ALWAYS_TRUE(PR_JoinThread(mServiceThread) == PR_SUCCESS);
   }
 
+  mBackbuffer.reset();
+
   if (mSharedDataPtr) {
     MOZ_ALWAYS_TRUE(::UnmapViewOfFile(mSharedDataPtr));
   }
Loading diff…