Firefox · DOM
CVE-2026-100762
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/base/nsFrameLoader.cppdom/ipc/BrowserParent.cpp
Patch
diff --git a/dom/base/nsFrameLoader.cpp b/dom/base/nsFrameLoader.cpp
index 0028ab68b37..c0879c36d75 100644
--- a/dom/base/nsFrameLoader.cpp
+++ b/dom/base/nsFrameLoader.cpp
@@ -2724,12 +2724,14 @@ bool nsFrameLoader::TryRemoteBrowserInternal() {
// Grab the reference to the actor
RefPtr<BrowserParent> browserParent = GetBrowserParent();
- MOZ_ASSERT(browserParent->CanSend(), "BrowserParent cannot send?");
-
// We no longer need the remoteType attribute on the frame element.
// The remoteType can be queried by asking the message manager instead.
ownerElement->UnsetAttr(kNameSpaceID_None, nsGkAtoms::RemoteType, false);
+ if (NS_WARN_IF(!browserParent->CanSend())) {
+ return false;
+ }
+
// Now that browserParent is set, we can initialize graphics
browserParent->InitRendering();
diff --git a/dom/ipc/BrowserParent.cpp b/dom/ipc/BrowserParent.cpp
index 046015ee068..1a75fd6f3ee 100644
--- a/dom/ipc/BrowserParent.cpp
+++ b/dom/ipc/BrowserParent.cpp
@@ -997,6 +997,9 @@ void BrowserParent::ResumeLoad(uint64_t aPendingSwitchID) {
}
void BrowserParent::InitRendering() {
+ if (!CanSend()) {
+ return;
+ }
if (mRemoteLayerTreeOwner.IsInitialized()) {
return;
}
Loading diff…
References
On This Page