High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the DOM: Core & HTML component
ComponentDOM
Bug ClassLogic Error
Tracker2078994
Fix commit272c1e4ec390 (firefox) +7/-1
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-27

Files Changed

  • dom/base/Document.cpp
diff --git a/dom/base/Document.cpp b/dom/base/Document.cpp
index 3a3c149ffae..df7d4263e4e 100644
--- a/dom/base/Document.cpp
+++ b/dom/base/Document.cpp
@@ -16352,7 +16352,13 @@ void Document::RestorePreviousFullscreenState(UniquePtr<FullscreenExit> aExit) {
   // that the loop order is reversed so that events are dispatched in
   // the tree order as indicated in the spec.
   for (Element* e : Reversed(exitElements)) {
-    DispatchFullscreenChange(*e->OwnerDoc(), e);
+    Document* exitDoc = e->OwnerDoc();
+    DispatchFullscreenChange(*exitDoc, e);
+    if (!exitDoc->Fullscreen()) {
+      // The document may have other fullscreen subdocuments which are not part
+      // of the current fullscreen document chain, reset them as well.
+      exitDoc->EnumerateSubDocuments(ResetFullscreen);
+    }
   }
   aExit->MayResolvePromise();
 
Loading diff…