High firefox UAF 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionAn attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash.
ComponentDOM
Bug ClassUAF
Tracker1936613
Fix commitb6875c1d0c25 (firefox) +4/-0
CISA KEVNot listed
CreditedIvan Fratric of Google Project Zero
Disclosed2025-02-04

Files Changed

  • dom/xslt/xslt/txMozillaXSLTProcessor.cpp
diff --git a/dom/xslt/xslt/txMozillaXSLTProcessor.cpp b/dom/xslt/xslt/txMozillaXSLTProcessor.cpp
index 5fe01a2a9f1..fc6b3a8e2d2 100644
--- a/dom/xslt/xslt/txMozillaXSLTProcessor.cpp
+++ b/dom/xslt/xslt/txMozillaXSLTProcessor.cpp
@@ -501,6 +501,10 @@ void txMozillaXSLTProcessor::ImportStylesheet(nsINode& aStyle,
     return;
   }
 
+  MOZ_ASSERT(!mEmbeddedStylesheetRoot);
+
+  mCompileResult = NS_OK;
+
   if (!nsContentUtils::SubjectPrincipalOrSystemIfNativeCaller()->Subsumes(
           aStyle.NodePrincipal())) {
     aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
Loading diff…