PatchGap
Firefox · DOM

CVE-2026-117951

Logic Error in DOM
High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the DOM: Core & HTML component
ComponentDOM
Bug ClassLogic Error
Tracker2082130
Fix commit9befd8690b26 (firefox) +5/-0
CISA KEVNot listed
CreditedOpenAI Codex Security (kylebot)
Disclosed2026-10-27

Changed Functions

FunctionChangeNotes
if
dom/base/nsGlobalWindowOuter.h
 modified

Files Changed

  • dom/base/nsGlobalWindowOuter.h

Patch

view commit
diff --git a/dom/base/nsGlobalWindowOuter.h b/dom/base/nsGlobalWindowOuter.h
index 97d881ec503..477f1fc8809 100644
--- a/dom/base/nsGlobalWindowOuter.h
+++ b/dom/base/nsGlobalWindowOuter.h
@@ -1129,6 +1129,11 @@ inline void nsGlobalWindowOuter::MaybeClearInnerWindow(
     nsPIDOMWindowInner* aExpectedInner) {
   if (mInnerWindow == aExpectedInner) {
     mInnerWindow = nullptr;
+
+    if (mBrowsingContext && mBrowsingContext->GetUnbarrieredWindowProxy() ==
+                                GetWrapperMaybeDead()) {
+      mBrowsingContext->ClearWindowProxy();
+    }
   }
 }
Loading diff…
On This Page