High firefox Memory Corruption 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionMemory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
ComponentDOM
Bug ClassMemory Corruption
Tracker1938220
Fix commit12243ef838cc (firefox) +7/-1
CISA KEVNot listed
CreditedAndrew McCreight and the Mozilla Fuzzing Team
Disclosed2025-09-16

Files Changed

  • dom/base/GlobalTeardownObserver.cpp
diff --git a/dom/base/GlobalTeardownObserver.cpp b/dom/base/GlobalTeardownObserver.cpp
index 15c4333e05e..d5e6029e079 100644
--- a/dom/base/GlobalTeardownObserver.cpp
+++ b/dom/base/GlobalTeardownObserver.cpp
@@ -65,7 +65,13 @@ nsresult GlobalTeardownObserver::CheckCurrentGlobalCorrectness() const {
     }
   }
 
-  if (mParentObject->IsDying() && !NS_IsMainThread()) {
+  if (NS_IsMainThread()) {
+    return NS_OK;
+  }
+
+  // Not on main thread, might check if is on the global's owning thread before
+  // calling IsDying().
+  if (mParentObject->IsDying()) {
     return NS_ERROR_FAILURE;
   }
 
Loading diff…