Medium firefox UAF 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionUse-after-free in the Graphics: Canvas2D component
ComponentGraphics
Bug ClassUAF
Tracker2060245
Fix commite98b25b5ee45 (firefox) +5/-4
CISA KEVNot listed
Creditedr00tdaddy
Disclosed2026-08-18

Files Changed

  • gfx/layers/ipc/CanvasChild.cpp
diff --git a/gfx/layers/ipc/CanvasChild.cpp b/gfx/layers/ipc/CanvasChild.cpp
index dab2f83b4aa..c752f8454db 100644
--- a/gfx/layers/ipc/CanvasChild.cpp
+++ b/gfx/layers/ipc/CanvasChild.cpp
@@ -828,10 +828,14 @@ already_AddRefed<gfx::SourceSurface> CanvasChild::SnapshotExternalCanvas(
   // running under the same thread, and that events can be paused or resumed
   // while synchronizing between WebGL and AC2D.
   if (!gfx::gfxVars::UseAcceleratedCanvas2D() ||
-      !StaticPrefs::gfx_canvas_remote_use_canvas_translator_event_AtStartup()) {
+      !StaticPrefs::gfx_canvas_remote_use_canvas_translator_event_AtStartup() ||
+      !aActor) {
     return nullptr;
   }
 
+  uint32_t managerId = static_cast<gfx::CanvasManagerChild*>(Manager())->Id();
+  ActorId canvasId = aActor->Id();
+
   gfx::SurfaceFormat format = aCanvas->GetIsOpaque()
                                   ? gfx::SurfaceFormat::B8G8R8X8
                                   : gfx::SurfaceFormat::B8G8R8A8;
@@ -857,9 +861,6 @@ already_AddRefed<gfx::SourceSurface> CanvasChild::SnapshotExternalCanvas(
                          RecordedResolveExternalSnapshot(
                              syncId, gfx::ReferencePtr(surface), size, format));
 
-  uint32_t managerId = static_cast<gfx::CanvasManagerChild*>(Manager())->Id();
-  ActorId canvasId = aActor->Id();
-
   // Actually send the request via IPDL to snapshot the external WebGL canvas.
   SendSnapshotExternalCanvas(syncId, managerId, canvasId);
 
Loading diff…