Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionPrivilege escalation due to invalid pointer in the Graphics component
ComponentGraphics
Bug ClassLogic Error
Tracker2060008
Fix commitf8193142ac81 (firefox) +2/-1
CISA KEVNot listed
Creditednavapon
Disclosed2026-09-01

Files Changed

  • gfx/2d/DrawTargetCairo.cpp
diff --git a/gfx/2d/DrawTargetCairo.cpp b/gfx/2d/DrawTargetCairo.cpp
index 7fe0c0f4abd..f56d622d06d 100644
--- a/gfx/2d/DrawTargetCairo.cpp
+++ b/gfx/2d/DrawTargetCairo.cpp
@@ -949,7 +949,8 @@ void DrawTargetCairo::DrawSurface(SourceSurface* aSurface, const Rect& aDest,
 void DrawTargetCairo::DrawFilter(FilterNode* aNode, const Rect& aSourceRect,
                                  const Point& aDestPoint,
                                  const DrawOptions& aOptions) {
-  if (!IsValid() || !aNode) {
+  if (!IsValid() || !aNode ||
+      aNode->GetBackendType() != FILTER_BACKEND_SOFTWARE) {
     gfxCriticalNote << "DrawFilter with bad surface "
                     << cairo_surface_status(cairo_get_group_target(mContext));
     return;
Loading diff…