In CanvasManagerChild::DestroyInternal() (gfx/ipc/CanvasManagerChild.cpp) the old code aged and reset mActiveResourceTracker first, before calling mCanvasChild->Destroy() and CanvasShutdownManager::Get()->OnRemoteCanvasLost(). The resource tracker, however, is still needed by the work those later calls perform: destroying the canvas child and notifying the shutdown manager can age/expire or otherwise touch resources that are registered with mActiveResourceTracker. Because mActiveResourceTracker.reset() destroys the tracker, the subsequent mCanvasChild->Destroy() / OnRemoteCanvasLost() path operated against an already-freed ActiveResourceTracker, i.e. a use-after-free of the tracker (and of the resources whose teardown it coordinates).

The patch keeps all three operations but reorders them: mCanvasChild->Destroy() and OnRemoteCanvasLost() now run first, and the mActiveResourceTracker->AgeAllGenerations(); mActiveResourceTracker.reset(); block is moved to the very end of DestroyInternal(). This guarantees the tracker outlives every teardown step that depends on it, so it is destroyed only once nothing else will reference it.

The affected code runs in the content/compositor side of the canvas IPC (the *Child actors), i.e. the renderer (or GPU) process; no elevated privilege is needed beyond running script that uses canvas. The flaw yields a use-after-free of the ActiveResourceTracker during actor teardown. Exploitability depends on winning the race/timing of teardown and grooming the freed allocation; the advisory rates it moderate. By itself it is a memory-safety bug within the process; the diff does not demonstrate cross-process escalation, so any sandbox-escape value is inferred.