2035880 - CVE-2026-7353: Heap buffer overflow in Skia

Status: RESOLVED FIXED

(Core :: Graphics, defect, P1)

Description

[Andrew McCreight [:mccr8]]

From Chromium's patch notes yesterday:

[N/A][498809718] High CVE-2026-7353: Heap buffer overflow in Skia. Reported by Google on 2026-04-01

I'm not sure what the patch is, because nothing shows up in the chromium-review search

Comment 2

[Andrew McCreight [:mccr8]]

Looking at the Skia repository, I found a patch that mentioned this bug number:
https://github.com/google/skia/commit/63dbf37c3700b34b5050d418d7cc9a3cb1708d5b

There is also what looks like a testing-only followup:
https://github.com/google/skia/commit/be1d174136aaa78d57fcdbef92041a08ea379d71

Comment 3

[Daniel Veditz [:dveditz]]

Don't know if this affects us, but we have the file being patched. Chrome called it "high".

Comment 4

[Sotaro Ikeda [:sotaro]]

:lsalzman, can you look into the bug?

Comment 5

[Lee Salzman [:lsalzman]]

(In reply to Andrew McCreight [:mccr8] from comment #2)

Looking at the Skia repository, I found a patch that mentioned this bug number:
https://github.com/google/skia/commit/63dbf37c3700b34b5050d418d7cc9a3cb1708d5b

There is also what looks like a testing-only followup:
https://github.com/google/skia/commit/be1d174136aaa78d57fcdbef92041a08ea379d71

The patch seems to imply this might be related to serialization which we don't rely on, but I can't rule out that there is a way to cause it without, so it's probably safer if we cherry-pick this.

Comment 6

[Lee Salzman [:lsalzman]]

Attachment: (secure)

Comment 7

[Lee Salzman [:lsalzman]]

Comment on attachment 9575335 [details]
(secure)

Security Approval Request

• How easily could an exploit be constructed based on the patch?: Upstream report details not entirely public yet, so unknown
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: Unknown
• Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?: all
• If not all supported branches, which bug introduced the flaw?: None
• Do you have backports for the affected branches?: Yes
• If not, how different, hard to create, and risky will they be?:
• How likely is this patch to cause regressions; how much testing does it need?: Already landed and tested upstream, unlikely
• Is the patch ready to land after security approval is given?: Yes
• Is Android affected?: Yes

Comment 8

[Daniel Veditz [:dveditz]]

Comment on attachment 9575335 [details]
(secure)

sec-approval+ to land now and request uplifts

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/565d9a6519f0
https://hg.mozilla.org/integration/autoland/rev/7f430e160d92
r=gfx-reviewers,aosmond

Comment 10

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/7f430e160d92

Comment 11

[BugBot [:suhaib / :marco]]

The patch landed in nightly and beta is affected.
:lsalzman, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox151 to wontfix.

For more information, please visit BugBot documentation.

Comment 12

[Donal Meehan [:dmeehan]]

To add to the beta uplift mentioned in comment 11, please also add uplift requests for release, ESR115, and ESR140

Comment 13

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined/Reason for urgency: Potential sec-high in Skia already reported upstream that could potentially be caused remotely.
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: Upstream fix already released/tested publicly.
• String changes made/needed?: None
• Is Android affected?: yes

Comment 14

[Lee Salzman [:lsalzman]]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D297553

Comment 15

[Phabricator Automation]

firefox-esr115 Uplift Approval Request

• User impact if declined/Reason for urgency: Potential sec-high in Skia already reported upstream that could potentially be caused remotely.
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: Upstream fix already released/tested publicly.
• String changes made/needed?: None
• Is Android affected?: yes

Comment 16

[Lee Salzman [:lsalzman]]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D297553

Comment 17

[Phabricator Automation]

firefox-esr140 Uplift Approval Request

• User impact if declined/Reason for urgency: Potential sec-high in Skia already reported upstream that could potentially be caused remotely.
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: Upstream fix already released/tested publicly.
• String changes made/needed?: None
• Is Android affected?: yes

Comment 18

[Lee Salzman [:lsalzman]]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D297553

Comment 19

[Phabricator Automation]

firefox-release Uplift Approval Request

• User impact if declined/Reason for urgency: Potential sec-high in Skia already reported upstream that could potentially be caused remotely.
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: Upstream fix already released/tested publicly.
• String changes made/needed?: None
• Is Android affected?: yes

Comment 20

[Lee Salzman [:lsalzman]]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D297553

Comment 21

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/9ee83cc29182
https://hg.mozilla.org/releases/mozilla-beta/rev/7883390958d5

Comment 22

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/0c330d0ea542

Comment 23

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/d805ee5e2e8e

Comment 24

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/238226db19b8
https://hg.mozilla.org/releases/mozilla-release/rev/285b10e12a56

Comment 25

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/b32dc63047ea

Comment 26

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/d73696c2bfc9