High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionPrivilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
ComponentDOM
Bug ClassLogic Error
Tracker2059997
Fix commit17e5d50fcd1f (firefox) +1/-1
CISA KEVNot listed
Creditedlocust1b
Disclosed2026-08-18

Changed Functions

FunctionChangeNotes
for
dom/canvas/WebGLBuffer.cpp
modified

Files Changed

  • dom/canvas/WebGLBuffer.cpp
diff --git a/dom/canvas/WebGLBuffer.cpp b/dom/canvas/WebGLBuffer.cpp
index 4ac02bd414d..357b9873269 100644
--- a/dom/canvas/WebGLBuffer.cpp
+++ b/dom/canvas/WebGLBuffer.cpp
@@ -264,7 +264,7 @@ void WebGLBuffer::InvalidateCacheRange(uint64_t byteOffset,
   for (const auto& cur : mIndexRanges) {
     const auto& range = cur.first;
     const auto& indexByteSize = IndexByteSizeByType(range.type);
-    const auto rangeBegin = range.byteOffset * indexByteSize;
+    const auto rangeBegin = range.byteOffset;
     const auto rangeEnd =
         rangeBegin + uint64_t(range.indexCount) * indexByteSize;
     if (rangeBegin >= updateEnd || rangeEnd <= updateBegin) continue;
Loading diff…