High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionPrivilege escalation in the Graphics: CanvasWebGL component
ComponentDOM
Bug ClassLogic Error
Tracker2055056
Fix commitfa9df688142f (firefox) +1/-0
CISA KEVNot listed
CreditedJacolon Walker
Disclosed2026-08-18

Files Changed

  • dom/canvas/WebGLTransformFeedback.cpp
diff --git a/dom/canvas/WebGLTransformFeedback.cpp b/dom/canvas/WebGLTransformFeedback.cpp
index 88bf4274278..2f98988d605 100644
--- a/dom/canvas/WebGLTransformFeedback.cpp
+++ b/dom/canvas/WebGLTransformFeedback.cpp
@@ -76,6 +76,7 @@ bool WebGLTransformFeedback::PrepareTransformFeedback() {
   }
 
   mActive_VertCapacity = minVertCapacity;
+  mActive_VertPosition = std::min(mActive_VertPosition, mActive_VertCapacity);
 
   return true;
 }
Loading diff…