High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the DOM: Core & HTML component
ComponentDOM
Bug ClassLogic Error
Tracker2082061
Fix commitb3d830a931b8 (firefox) +5/-4
CISA KEVNot listed
CreditedOpenAI Codex Security (kylebot)
Disclosed2026-10-27

Changed Functions

FunctionChangeNotes
OnStartRequest
dom/html/ImageDocument.cpp
modified
if
dom/html/ImageDocument.cpp
modified
OnStartRequest
dom/html/MediaDocument.cpp
modified
if
dom/html/MediaDocument.cpp
modified

Files Changed

  • dom/html/ImageDocument.cpp
  • dom/html/MediaDocument.cpp
diff --git a/dom/html/ImageDocument.cpp b/dom/html/ImageDocument.cpp
index bfebbc75f40..46adb9af10b 100644
--- a/dom/html/ImageDocument.cpp
+++ b/dom/html/ImageDocument.cpp
@@ -66,9 +66,9 @@ ImageListener::~ImageListener() = default;
 
 NS_IMETHODIMP
 ImageListener::OnStartRequest(nsIRequest* request) {
-  NS_ENSURE_TRUE(mDocument, NS_ERROR_FAILURE);
+  RefPtr<ImageDocument> imgDoc = static_cast<ImageDocument*>(mDocument.get());
+  NS_ENSURE_TRUE(imgDoc, NS_ERROR_FAILURE);
 
-  ImageDocument* imgDoc = static_cast<ImageDocument*>(mDocument.get());
   nsCOMPtr<nsIChannel> channel = do_QueryInterface(request);
   if (!channel) {
     return NS_ERROR_FAILURE;
diff --git a/dom/html/MediaDocument.cpp b/dom/html/MediaDocument.cpp
index 990e7de4895..5e29d6863e6 100644
--- a/dom/html/MediaDocument.cpp
+++ b/dom/html/MediaDocument.cpp
@@ -41,9 +41,10 @@ NS_IMPL_ISUPPORTS(MediaDocumentStreamListener, nsIRequestObserver,
 
 NS_IMETHODIMP
 MediaDocumentStreamListener::OnStartRequest(nsIRequest* request) {
-  NS_ENSURE_TRUE(mDocument, NS_ERROR_FAILURE);
+  RefPtr<MediaDocument> document = mDocument;
+  NS_ENSURE_TRUE(document, NS_ERROR_FAILURE);
 
-  mDocument->StartLayout();
+  document->StartLayout();
 
   if (nsCOMPtr<nsIStreamListener> nextStream = mNextStream) {
     return nextStream->OnStartRequest(request);
Loading diff…