Firefox · Graphics
CVE-2026-74949
UAF in Graphics
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
gfx/layers/ipc/CanvasChild.cpp
Patch
diff --git a/gfx/layers/ipc/CanvasChild.cpp b/gfx/layers/ipc/CanvasChild.cpp
index dab2f83b4aa..c752f8454db 100644
--- a/gfx/layers/ipc/CanvasChild.cpp
+++ b/gfx/layers/ipc/CanvasChild.cpp
@@ -828,10 +828,14 @@ already_AddRefed<gfx::SourceSurface> CanvasChild::SnapshotExternalCanvas(
// running under the same thread, and that events can be paused or resumed
// while synchronizing between WebGL and AC2D.
if (!gfx::gfxVars::UseAcceleratedCanvas2D() ||
- !StaticPrefs::gfx_canvas_remote_use_canvas_translator_event_AtStartup()) {
+ !StaticPrefs::gfx_canvas_remote_use_canvas_translator_event_AtStartup() ||
+ !aActor) {
return nullptr;
}
+ uint32_t managerId = static_cast<gfx::CanvasManagerChild*>(Manager())->Id();
+ ActorId canvasId = aActor->Id();
+
gfx::SurfaceFormat format = aCanvas->GetIsOpaque()
? gfx::SurfaceFormat::B8G8R8X8
: gfx::SurfaceFormat::B8G8R8A8;
@@ -857,9 +861,6 @@ already_AddRefed<gfx::SourceSurface> CanvasChild::SnapshotExternalCanvas(
RecordedResolveExternalSnapshot(
syncId, gfx::ReferencePtr(surface), size, format));
- uint32_t managerId = static_cast<gfx::CanvasManagerChild*>(Manager())->Id();
- ActorId canvasId = aActor->Id();
-
// Actually send the request via IPDL to snapshot the external WebGL canvas.
SendSnapshotExternalCanvas(syncId, managerId, canvasId);
Loading diff…
References
On This Page