High firefox Sandbox Escape 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionSandbox escape due to incorrect boundary conditions in the Telemetry component
ComponentToolkit
Bug ClassSandbox Escape
Tracker2016368
Fix commit31d588fc9818 (firefox) +9/-0
CISA KEVNot listed
CreditedSajeeb Lohani
Disclosed2026-03-24

Changed Functions

FunctionChangeNotes
for
toolkit/components/telemetry/other/CombinedStacks.h
modified

Files Changed

  • toolkit/components/telemetry/other/CombinedStacks.h
diff --git a/toolkit/components/telemetry/other/CombinedStacks.h b/toolkit/components/telemetry/other/CombinedStacks.h
index 5848eb8d603..be8f9e8f24b 100644
--- a/toolkit/components/telemetry/other/CombinedStacks.h
+++ b/toolkit/components/telemetry/other/CombinedStacks.h
@@ -99,6 +99,15 @@ struct ParamTraits<mozilla::Telemetry::CombinedStacks> {
       return false;
     }
 
+    for (const auto& stack : aResult->mStacks) {
+      for (const auto& frame : stack) {
+        if (frame.mModIndex != std::numeric_limits<uint16_t>::max() &&
+            frame.mModIndex >= aResult->mModules.size()) {
+          return false;
+        }
+      }
+    }
+
     return true;
   }
 };
Loading diff…