Closed Bug 1984824 Opened 8 months ago Closed 8 months ago

Sandbox escape from the content to the browser process

Categories

(Core :: Graphics: Canvas2D, defect)

Product:
Core
Component:
Graphics: Canvas2D
Type:
defect

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1984825

People

(Reporter: oskarlindberg348, Unassigned)

Details

(Keywords: reporter-external, Whiteboard: [client-bounty-form])

Using the Canvas2D subsystem one can cause a memory corruption in the browser process which allows a sandbox escape from a content process.

Writeup will follow.

Flags: sec-bounty?
Status: UNCONFIRMED → RESOLVED
Closed: 8 months ago
Duplicate of bug: CVE-2025-10527
Resolution: --- → DUPLICATE
Group: firefox-core-security → gfx-core-security
Component: Security → Graphics: Canvas2D
Product: Firefox → Core
Flags: sec-bounty? → sec-bounty-
Group: gfx-core-security
You need to log in before you can comment on or make changes to this bug.