PatchGap
Firefox · DOM

CVE-2025-8035

Memory Corruption in DOM
High firefox Memory Corruption 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionMemory safety bugs present in Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
ComponentDOM
Bug ClassMemory Corruption
Tracker1975961
Fix commitb1434f56b487 (firefox) +11/-10
CISA KEVNot listed
Creditedthe Mozilla Fuzzing Team
Disclosed2025-07-22

Changed Functions

FunctionChangeNotes
if
dom/base/nsFocusManager.cpp
 modified

Files Changed

  • dom/base/nsFocusManager.cpp

Patch

view commit
diff --git a/dom/base/nsFocusManager.cpp b/dom/base/nsFocusManager.cpp
index 2a7d4504ea9..d4f4148f660 100644
--- a/dom/base/nsFocusManager.cpp
+++ b/dom/base/nsFocusManager.cpp
@@ -4366,16 +4366,17 @@ nsresult nsFocusManager::GetNextTabbableContent(
             rootElement = doc->GetRootElement();
           }
           if (aForward) {
-            nsIFrame* frame = invokerContent->GetPrimaryFrame();
-            int32_t tabIndex = frame->IsFocusable().mTabIndex;
-            if (tabIndex >= 0 &&
-                (aIgnoreTabIndex || aCurrentTabIndex == tabIndex)) {
-              nsresult rv = GetNextTabbableContent(
-                  aPresShell, rootElement, nullptr, invokerContent, true,
-                  tabIndex, false, false, aNavigateByKey, true,
-                  aReachedToEndForDocumentNavigation, aResultContent);
-              if (NS_SUCCEEDED(rv) && *aResultContent) {
-                return rv;
+            if (nsIFrame* frame = invokerContent->GetPrimaryFrame()) {
+              int32_t tabIndex = frame->IsFocusable().mTabIndex;
+              if (tabIndex >= 0 &&
+                  (aIgnoreTabIndex || aCurrentTabIndex == tabIndex)) {
+                nsresult rv = GetNextTabbableContent(
+                    aPresShell, rootElement, nullptr, invokerContent, true,
+                    tabIndex, false, false, aNavigateByKey, true,
+                    aReachedToEndForDocumentNavigation, aResultContent);
+                if (NS_SUCCEEDED(rv) && *aResultContent) {
+                  return rv;
+                }
               }
             }
           } else if (invokerContent) {
Loading diff…
On This Page