High firefox UAF 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionPrivilege escalation due to use-after-free in the Graphics: WebGPU component
ComponentGraphics
Bug ClassUAF
Tracker2060047
Fix commit24f381f39a42 (firefox) +4/-2
CISA KEVNot listed
CreditedYaqoub Aldurayhim
Disclosed2026-09-01

Changed Functions

FunctionChangeNotes
AllocPWebGPUParent
gfx/ipc/CanvasManagerParent.cpp
modified

Files Changed

  • gfx/ipc/CanvasManagerParent.cpp
diff --git a/gfx/ipc/CanvasManagerParent.cpp b/gfx/ipc/CanvasManagerParent.cpp
index 2543252c180..bb543b2fa7b 100644
--- a/gfx/ipc/CanvasManagerParent.cpp
+++ b/gfx/ipc/CanvasManagerParent.cpp
@@ -5,6 +5,7 @@
 #include "CanvasManagerParent.h"
 
 #include "gfxPlatform.h"
+#include "mozilla/StaticPrefs_dom.h"
 #include "mozilla/StaticPrefs_gfx.h"
 #include "mozilla/StaticPrefs_webgl.h"
 #include "mozilla/dom/WebGLParent.h"
@@ -131,7 +132,7 @@ void CanvasManagerParent::ActorDestroy(ActorDestroyReason aWhy) {
 }
 
 already_AddRefed<dom::PWebGLParent> CanvasManagerParent::AllocPWebGLParent() {
-  if (NS_WARN_IF(!gfxVars::AllowWebGL())) {
+  if (NS_WARN_IF(!gfxVars::AllowWebGL() || StaticPrefs::webgl_disabled())) {
     MOZ_ASSERT_UNREACHABLE("AllocPWebGLParent without WebGL");
     return nullptr;
   }
@@ -141,7 +142,8 @@ already_AddRefed<dom::PWebGLParent> CanvasManagerParent::AllocPWebGLParent() {
 
 already_AddRefed<webgpu::PWebGPUParent>
 CanvasManagerParent::AllocPWebGPUParent() {
-  if (NS_WARN_IF(!gfxVars::AllowWebGPU())) {
+  if (NS_WARN_IF(!gfxVars::AllowWebGPU() ||
+                 !StaticPrefs::dom_webgpu_enabled())) {
     MOZ_ASSERT_UNREACHABLE("AllocPWebGPUParent without WebGPU");
     return nullptr;
   }
Loading diff…