fix: remove unsafe exec() in nsRemoteDebuggingPipe.cpp

[orbisai0security]

Summary

Fix critical severity security issue in browser_patches/firefox/juggler/pipe/nsRemoteDebuggingPipe.cpp.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	browser_patches/firefox/juggler/pipe/nsRemoteDebuggingPipe.cpp:186

Description: The memmove call at line 186 in nsRemoteDebuggingPipe.cpp computes its length as 'line.size() - start' without first verifying that 'start' is strictly less than 'line.size()'. If 'start' is derived from externally-supplied data in a malformed debugging protocol message and equals or exceeds 'line.size()', the subtraction underflows as an unsigned integer, producing an extremely large copy length. This causes an out-of-bounds write that corrupts heap memory, potentially enabling arbitrary code execution or a crash of the Firefox browser process used by Playwright.

Changes

• browser_patches/firefox/juggler/pipe/nsRemoteDebuggingPipe.cpp

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security