High firefox UAF 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionA use-after-free in FontFaceSet resulted in a potentially exploitable crash.
ComponentLayout
Bug ClassUAF
Tracker1966423
Fix commit094ddb8fc2c1 (firefox) +3/-5
CISA KEVNot listed
CreditedLJP and HexRabbit (DEVCORE Research Team)
Disclosed2025-06-24

Files Changed

  • layout/style/FontFaceSet.cpp
diff --git a/layout/style/FontFaceSet.cpp b/layout/style/FontFaceSet.cpp
index 984bf792211..0891519f866 100644
--- a/layout/style/FontFaceSet.cpp
+++ b/layout/style/FontFaceSet.cpp
@@ -148,7 +148,8 @@ already_AddRefed<Promise> FontFaceSet::Load(JSContext* aCx,
     if (aRv.Failed()) {
       return nullptr;
     }
-    if (!faces.AppendElements(weakFaces, fallible)) {
+    if (!faces.AppendElements(weakFaces, fallible) ||
+        !promises.SetCapacity(weakFaces.Length(), fallible)) {
       aRv.Throw(NS_ERROR_FAILURE);
       return nullptr;
     }
@@ -159,10 +160,7 @@ already_AddRefed<Promise> FontFaceSet::Load(JSContext* aCx,
     if (aRv.Failed()) {
       return nullptr;
     }
-    if (!promises.AppendElement(promise, fallible)) {
-      aRv.Throw(NS_ERROR_FAILURE);
-      return nullptr;
-    }
+    promises.AppendElement(promise);
   }
 
   return Promise::All(aCx, promises, aRv);
Loading diff…