High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionSite isolation issue in the Graphics: CanvasWebGL component
ComponentDOM
Bug ClassLogic Error
Tracker2050584
Fix commite9eb24c96103 (firefox) +6/-0
CISA KEVNot listed
Creditedsatyamasd
Disclosed2026-08-18

Changed Functions

FunctionChangeNotes
switch
dom/canvas/WebGLFramebuffer.cpp
modified

Files Changed

  • dom/canvas/WebGLFramebuffer.cpp
diff --git a/dom/canvas/WebGLFramebuffer.cpp b/dom/canvas/WebGLFramebuffer.cpp
index b07bad434c8..7afe36ab0d3 100644
--- a/dom/canvas/WebGLFramebuffer.cpp
+++ b/dom/canvas/WebGLFramebuffer.cpp
@@ -890,6 +890,11 @@ void WebGLFramebuffer::ResolveAttachmentData() const {
             const uint32_t drawBuffer =
                 cur->mAttachmentPoint - LOCAL_GL_COLOR_ATTACHMENT0;
             MOZ_ASSERT(drawBuffer <= 100);
+            std::vector<GLenum> drawBuffersForClear(drawBuffer + 1,
+                                                    LOCAL_GL_ONE);
+            drawBuffersForClear[drawBuffer] = cur->mAttachmentPoint;
+            gl->fDrawBuffers(drawBuffersForClear.size(),
+                             drawBuffersForClear.data());
             switch (format->componentType) {
               case webgl::ComponentType::Int:
                 gl->fClearBufferiv(LOCAL_GL_COLOR, drawBuffer, iZeros);
@@ -921,6 +926,7 @@ void WebGLFramebuffer::ResolveAttachmentData() const {
       }
       imageInfo->mUninitializedSlices.reset();
     }
+    RefreshDrawBuffers();
     return;
   }
 
Loading diff…