High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionPrivilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
ComponentDOM
Bug ClassLogic Error
Tracker2058064
Fix commitd6756af20470 (firefox) +6/-0
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-15

Files Changed

  • dom/canvas/WebGLContextVertices.cpp
diff --git a/dom/canvas/WebGLContextVertices.cpp b/dom/canvas/WebGLContextVertices.cpp
index ad5bd7dddeb..64553deaba6 100644
--- a/dom/canvas/WebGLContextVertices.cpp
+++ b/dom/canvas/WebGLContextVertices.cpp
@@ -3,6 +3,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include <bit>
+#include <limits>
 
 #include "GLContext.h"
 #include "WebGLBuffer.h"
@@ -147,6 +148,11 @@ CheckVertexAttribPointer(const bool isWebgl2,
                                 "Channel count `size` must be within [1,4]."});
   }
 
+  if (desc.byteOffset > std::numeric_limits<int64_t>::max()) {
+    return Err(webgl::ErrorInfo{LOCAL_GL_INVALID_VALUE,
+                                "`byteOffset` must be non-negative."});
+  }
+
   ////
 
   webgl::VertAttribPointerCalculated calc;
Loading diff…