Trespasser

CVE-2026-74970 · Fission site isolation bypass in Firefox WebRender

Severity sec moderate. CWE 862 and CWE 284. Fixed in Firefox 154 and ESR 153.1. Bugzilla 2056558.

Summary

Under Fission each content process owns a PipelineId namespace. This is the high 32 bits of wr::PipelineId. WebRenderBridgeParent::AddPipelineIdForCompositable runs in the GPU process. It checked the root pipeline guard and membership in its own set. It never checked that the PipelineId namespace belongs to the sending process. The image and font and blob key paths in the same file already enforce that check. A compromised content process can register a PipelineId in another process namespace and overwrite that origin async image pipeline in the shared manager.

Root cause

The MatchesNamespace check that the resource key paths enforce is missing on the PipelineId path and on RemovePipelineIdForCompositable. AddAsyncImagePipeline guards uniqueness only with MOZ_ASSERT. That is a no op in release builds. So the shared AsyncImagePipelineManager silently overwrites the victim pipeline instead of rejecting the duplicate.

The attack

Reproduce

The threat model is a compromised content process. The PoC is a content side patch guarded by XRE_IsContentProcess. It forges the PipelineId namespace. It ships with a test page that has a WebGL canvas and a cross origin out of process iframe.

apply poc.patch to mozilla-central and build
MOZ_POC_FORGE_WR_NAMESPACE=999999 ./mach run --temp-profile poc.html

Observed on a release build.

[POC-2056558] ACCEPTED cross-namespace PipelineId: sender-namespace=4 pipeline-namespace=999999 (should have been rejected)

Impact

Cross origin rendering confusion and cross tab denial of service. This is a Fission site isolation authorization bypass. It is not memory corruption. Downstream consumers are null guarded and reference counted so it does not yield execution.

Fix

Enforce the same namespace ownership check the resource key paths use.

if (!MatchesNamespace(aPipelineId)) {
  return IPC_FAIL(this, "PipelineId namespace does not belong to the sending process");
}

Credit

Abdulaziz Alasaiqah · https://azoz.my/writeups.html