Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionPrivilege escalation due to invalid pointer in the Graphics component
ComponentGraphics
Bug ClassLogic Error
Tracker2060008
Fix commitf8193142ac81 (firefox) +2/-1
CISA KEVNot listed
Creditednavapon
Disclosed2026-09-01

Files Changed

  • gfx/2d/DrawTargetCairo.cpp
diff --git a/gfx/2d/DrawTargetCairo.cpp b/gfx/2d/DrawTargetCairo.cpp
index 7fe0c0f4abd..f56d622d06d 100644
--- a/gfx/2d/DrawTargetCairo.cpp
+++ b/gfx/2d/DrawTargetCairo.cpp
@@ -949,7 +949,8 @@ void DrawTargetCairo::DrawSurface(SourceSurface* aSurface, const Rect& aDest,
 void DrawTargetCairo::DrawFilter(FilterNode* aNode, const Rect& aSourceRect,
                                  const Point& aDestPoint,
                                  const DrawOptions& aOptions) {
-  if (!IsValid() || !aNode) {
+  if (!IsValid() || !aNode ||
+      aNode->GetBackendType() != FILTER_BACKEND_SOFTWARE) {
     gfxCriticalNote << "DrawFilter with bad surface "
                     << cairo_surface_status(cairo_get_group_target(mContext));
     return;
Loading diff…