PatchGap
Firefox · DOM

CVE-2026-109725

Logic Error in DOM
High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the DOM: Core & HTML component
ComponentDOM
Bug ClassLogic Error
Tracker2074208
Fix commit14dcbdd4a7e8 (firefox) +4/-3
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-13

Changed Functions

FunctionChangeNotes
for
dom/base/nsImageLoadingContent.cpp
 modified

Files Changed

  • dom/base/nsImageLoadingContent.cpp

Patch

view commit
diff --git a/dom/base/nsImageLoadingContent.cpp b/dom/base/nsImageLoadingContent.cpp
index 05a97b82378..93aa88b5a3a 100644
--- a/dom/base/nsImageLoadingContent.cpp
+++ b/dom/base/nsImageLoadingContent.cpp
@@ -1947,9 +1947,10 @@ Element* nsImageLoadingContent::FindImageMap() {
 
   nsAutoString mapName(Substring(start, end));
 
-  uint32_t i, n = imageMapList->Length(true);
-  for (i = 0; i < n; ++i) {
-    nsIContent* map = imageMapList->Item(i);
+  const bool kFlush = false;
+  const uint32_t n = imageMapList->Length(kFlush);
+  for (uint32_t i = 0; i < n; ++i) {
+    nsIContent* map = imageMapList->Item(i, kFlush);
     if (map->AsElement()->AttrValueIs(kNameSpaceID_None, nsGkAtoms::id, mapName,
                                       eCaseMatters) ||
         map->AsElement()->AttrValueIs(kNameSpaceID_None, nsGkAtoms::name,
Loading diff…
On This Page