High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionSandbox escape due to use-after-free in the DOM: Content Processes component
ComponentDOM
Bug ClassLogic Error
Tracker2059404
Fix commit82d27294cc23 (firefox) +7/-2
CISA KEVNot listed
CreditedYaqoub Aldurayhim
Disclosed2026-09-29

Files Changed

  • dom/base/nsFrameLoader.cpp
  • dom/ipc/BrowserParent.cpp
diff --git a/dom/base/nsFrameLoader.cpp b/dom/base/nsFrameLoader.cpp
index 0028ab68b37..c0879c36d75 100644
--- a/dom/base/nsFrameLoader.cpp
+++ b/dom/base/nsFrameLoader.cpp
@@ -2724,12 +2724,14 @@ bool nsFrameLoader::TryRemoteBrowserInternal() {
   // Grab the reference to the actor
   RefPtr<BrowserParent> browserParent = GetBrowserParent();
 
-  MOZ_ASSERT(browserParent->CanSend(), "BrowserParent cannot send?");
-
   // We no longer need the remoteType attribute on the frame element.
   // The remoteType can be queried by asking the message manager instead.
   ownerElement->UnsetAttr(kNameSpaceID_None, nsGkAtoms::RemoteType, false);
 
+  if (NS_WARN_IF(!browserParent->CanSend())) {
+    return false;
+  }
+
   // Now that browserParent is set, we can initialize graphics
   browserParent->InitRendering();
 
diff --git a/dom/ipc/BrowserParent.cpp b/dom/ipc/BrowserParent.cpp
index 046015ee068..1a75fd6f3ee 100644
--- a/dom/ipc/BrowserParent.cpp
+++ b/dom/ipc/BrowserParent.cpp
@@ -997,6 +997,9 @@ void BrowserParent::ResumeLoad(uint64_t aPendingSwitchID) {
 }
 
 void BrowserParent::InitRendering() {
+  if (!CanSend()) {
+    return;
+  }
   if (mRemoteLayerTreeOwner.IsInitialized()) {
     return;
   }
Loading diff…