High firefox Sandbox Escape 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionSandbox escape due to incorrect boundary conditions in the Telemetry component in External Software
ComponentToolkit
Bug ClassSandbox Escape
Tracker2015266
Fix commit8ec0a8f5bc5b (firefox) +6/-0
CISA KEVNot listed
CreditedSajeeb Lohani
Disclosed2026-02-24

Changed Functions

FunctionChangeNotes
if
toolkit/components/telemetry/other/CombinedStacks.cpp
modified
for
toolkit/components/telemetry/other/CombinedStacks.cpp
modified

Files Changed

  • toolkit/components/telemetry/other/CombinedStacks.cpp
diff --git a/toolkit/components/telemetry/other/CombinedStacks.cpp b/toolkit/components/telemetry/other/CombinedStacks.cpp
index 61248f9b405..9819e51bb6f 100644
--- a/toolkit/components/telemetry/other/CombinedStacks.cpp
+++ b/toolkit/components/telemetry/other/CombinedStacks.cpp
@@ -74,11 +74,17 @@ size_t CombinedStacks::AddStack(const Telemetry::ProcessedStack& aStack) {
 }
 
 void CombinedStacks::AddStacks(const CombinedStacks& aStacks) {
+  if (mMaxStacksCount == 0) {
+    return;
+  }
   mStacks.resize(
       std::min(mStacks.size() + aStacks.GetStackCount(), mMaxStacksCount));
 
   for (const auto& stack : aStacks.mStacks) {
     size_t index = mNextIndex;
+    if (index >= mStacks.size()) {
+      break;
+    }
     // Advance the indices of the circular queue holding the stacks.
     mNextIndex = (mNextIndex + 1) % mMaxStacksCount;
 
Loading diff…