High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the CSS Parsing and Computation component
ComponentDOM
Bug ClassLogic Error
Tracker2079687
Fix commite54211ea08ef (firefox) +17/-4
CISA KEVNot listed
CreditedOpenAI Codex Security (kylebot)
Disclosed2026-10-27

Changed Functions

FunctionChangeNotes
if
layout/style/Rule.h
modified
GetParentRuleForBindings
layout/style/nsICSSDeclaration.cpp
modified

Files Changed

  • dom/webidl/CSSRule.webidl
  • dom/webidl/CSSStyleDeclaration.webidl
  • layout/style/Rule.cpp
  • layout/style/Rule.h
  • layout/style/StyleSheet.cpp
  • layout/style/StyleSheet.h
  • layout/style/nsICSSDeclaration.cpp
  • layout/style/nsICSSDeclaration.h
diff --git a/dom/webidl/CSSRule.webidl b/dom/webidl/CSSRule.webidl
index 2a1370e6ce2..ae2ecfeadd1 100644
--- a/dom/webidl/CSSRule.webidl
+++ b/dom/webidl/CSSRule.webidl
@@ -26,7 +26,7 @@ interface CSSRule {
   const unsigned short NAMESPACE_RULE = 10;
   [BinaryName="typeForBindings"] readonly attribute unsigned short type;
   attribute UTF8String cssText;
-  readonly attribute CSSRule? parentRule;
+  [BinaryName="parentRuleForBindings"] readonly attribute CSSRule? parentRule;
   readonly attribute CSSStyleSheet? parentStyleSheet;
 };
 
diff --git a/dom/webidl/CSSStyleDeclaration.webidl b/dom/webidl/CSSStyleDeclaration.webidl
index ac4444e4de1..1b5e8bfeff6 100644
--- a/dom/webidl/CSSStyleDeclaration.webidl
+++ b/dom/webidl/CSSStyleDeclaration.webidl
@@ -32,5 +32,5 @@ interface CSSStyleDeclaration {
   [ChromeOnly]
   boolean hasLonghandProperty(UTF8String property);
 
-  readonly attribute CSSRule? parentRule;
+  [BinaryName="parentRuleForBindings"] readonly attribute CSSRule? parentRule;
 };
diff --git a/layout/style/Rule.cpp b/layout/style/Rule.cpp
index 802232124e8..d6f8acade1e 100644
--- a/layout/style/Rule.cpp
+++ b/layout/style/Rule.cpp
@@ -91,6 +91,10 @@ void Rule::SetCssText(const nsACString& aCssText) {
 
 Rule* Rule::GetParentRule() const { return mParentRule; }
 
+already_AddRefed<Rule> Rule::GetParentRuleForBindings() const {
+  return do_AddRef(mParentRule);
+}
+
 #ifdef DEBUG
 void Rule::AssertParentRuleType() {
   // Would be nice to check that this->Type() is StyleCssRuleType::Keyframe
diff --git a/layout/style/Rule.h b/layout/style/Rule.h
index 838d8b2d590..f61aeadc260 100644
--- a/layout/style/Rule.h
+++ b/layout/style/Rule.h
@@ -102,6 +102,7 @@ class Rule : public nsISupports, public nsWrapperCache, public SupportsWeakPtr {
   virtual void GetCssText(nsACString& aCssText) const = 0;
   void SetCssText(const nsACString& aCssText);
   Rule* GetParentRule() const;
+  already_AddRefed<Rule> GetParentRuleForBindings() const;
   StyleSheet* GetParentStyleSheet() const { return GetStyleSheet(); }
   nsINode* GetAssociatedDocumentOrShadowRoot() const {
     if (!mSheet) {
diff --git a/layout/style/StyleSheet.cpp b/layout/style/StyleSheet.cpp
index eac28c06f78..22d493369c7 100644
--- a/layout/style/StyleSheet.cpp
+++ b/layout/style/StyleSheet.cpp
@@ -548,7 +548,9 @@ void StyleSheet::GetSourceURL(nsACString& aSourceURL) {
   Servo_StyleSheet_GetSourceURL(mInner->mContents, &aSourceURL);
 }
 
-css::Rule* StyleSheet::GetDOMOwnerRule() const { return GetOwnerRule(); }
+already_AddRefed<css::Rule> StyleSheet::GetDOMOwnerRule() const {
+  return do_AddRef(GetOwnerRule());
+}
 
 // https://drafts.csswg.org/cssom/#dom-cssstylesheet-insertrule
 // https://wicg.github.io/construct-stylesheets/#dom-cssstylesheet-insertrule
diff --git a/layout/style/StyleSheet.h b/layout/style/StyleSheet.h
index 978e36112db..7480ff39743 100644
--- a/layout/style/StyleSheet.h
+++ b/layout/style/StyleSheet.h
@@ -339,7 +339,7 @@ class StyleSheet final : public nsICSSLoaderObserver, public nsWrapperCache {
   // Can't be inline because we can't include ImportRule here.  And can't be
   // called GetOwnerRule because that would be ambiguous with the ImportRule
   // version.
-  css::Rule* GetDOMOwnerRule() const;
+  already_AddRefed<css::Rule> GetDOMOwnerRule() const;
   dom::CSSRuleList* GetCssRules(nsIPrincipal& aSubjectPrincipal, ErrorResult&);
   uint32_t InsertRule(const nsACString& aRule, uint32_t aIndex,
                       nsIPrincipal& aSubjectPrincipal, ErrorResult& aRv);
diff --git a/layout/style/nsICSSDeclaration.cpp b/layout/style/nsICSSDeclaration.cpp
index f7a151ff90c..19ff52089c8 100644
--- a/layout/style/nsICSSDeclaration.cpp
+++ b/layout/style/nsICSSDeclaration.cpp
@@ -20,6 +20,11 @@ DocGroup* nsICSSDeclaration::GetDocGroup() {
   return parentNode->GetDocGroup();
 }
 
+already_AddRefed<mozilla::css::Rule>
+nsICSSDeclaration::GetParentRuleForBindings() {
+  return do_AddRef(GetParentRule());
+}
+
 bool nsICSSDeclaration::IsReadOnly() {
   mozilla::css::Rule* rule = GetParentRule();
   return rule && rule->IsReadOnly();
diff --git a/layout/style/nsICSSDeclaration.h b/layout/style/nsICSSDeclaration.h
index 5c98842b4c1..9b0853f09b3 100644
--- a/layout/style/nsICSSDeclaration.h
+++ b/layout/style/nsICSSDeclaration.h
@@ -98,6 +98,7 @@ class nsICSSDeclaration : public nsISupports, public nsWrapperCache {
   virtual void GetPropertyPriority(const nsACString& aPropName,
                                    nsACString& aPriority) = 0;
   virtual mozilla::css::Rule* GetParentRule() = 0;
+  already_AddRefed<mozilla::css::Rule> GetParentRuleForBindings();
 
   // [Chrome only]
   virtual bool HasLonghandProperty(const nsACString& aPropName) {
Loading diff…