Sandbox escape via GMP frame-size integer overflow

Heap-buffer overflow in Mozilla Firefox before 149 and Thunderbird before 149 allows attackers to escape a compromised GMP process via frame metadata. GMP CheckFrameData multiplies untrusted plane strides and heights as raw 32-bit integers, letting overflowed sizes pass validation before Decoded allocates a too-small buffer and copies frame data past its end. Exploitation requires prior control of a GMP child processing encrypted media; Firefox ESR before 115.34 and 140.x before 140.9 and Thunderbird 140.x before 140.9 are also affected, and the escape reaches only a communicating content process.