Firefox · DOM
CVE-2026-117950
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/base/Element.cpp |
modified |
Files Changed
dom/base/Element.cpp
Patch
diff --git a/dom/base/Element.cpp b/dom/base/Element.cpp
index 6719502160e..d9b155f90de 100644
--- a/dom/base/Element.cpp
+++ b/dom/base/Element.cpp
@@ -1344,7 +1344,9 @@ void Element::AddToIdTable(nsAtom* aId) {
NS_ASSERTION(HasID(), "Node doesn't have an ID?");
if (IsInShadowTree()) {
ShadowRoot* containingShadow = GetContainingShadow();
- containingShadow->AddToIdTable(this, aId);
+ if (nsContentUtils::IsInSameAnonymousTree(this, containingShadow)) {
+ containingShadow->AddToIdTable(this, aId);
+ }
} else {
Document* doc = GetUncomposedDoc();
if (doc && !IsInNativeAnonymousSubtree()) {
@@ -1361,9 +1363,12 @@ void Element::RemoveFromIdTable() {
nsAtom* id = DoGetID();
if (IsInShadowTree()) {
ShadowRoot* containingShadow = GetContainingShadow();
- // Check for containingShadow because it may have
- // been deleted during unlinking.
- if (containingShadow) {
+ // Check for containingShadow because it may have been deleted during
+ // unlinking. We can't use the stricter IsInSameAnonymousTree because our
+ // ancestors may have already been unbound.
+ if (containingShadow &&
+ IsInNativeAnonymousSubtree() ==
+ containingShadow->IsInNativeAnonymousSubtree()) {
containingShadow->RemoveFromIdTable(this, id);
}
} else {
Loading diff…
References
On This Page