Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionSandbox escape due to use-after-free in the Disability Access APIs component
ComponentCore
Bug ClassLogic Error
Tracker2078941
Fix commitbee9cfa4bdb9 (firefox) +3/-0
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-27

Files Changed

  • accessible/pdf/PdfStructTreeBuilder.cpp
diff --git a/accessible/pdf/PdfStructTreeBuilder.cpp b/accessible/pdf/PdfStructTreeBuilder.cpp
index 590f18e8456..db06d672126 100644
--- a/accessible/pdf/PdfStructTreeBuilder.cpp
+++ b/accessible/pdf/PdfStructTreeBuilder.cpp
@@ -90,6 +90,9 @@ void PdfStructTreeBuilder::Done(uint64_t aInnerWindowId) {
 
 /* static */
 int PdfStructTreeBuilder::GetPdfId(uint64_t aInnerWindowId, uint64_t aAccId) {
+  if (NS_WARN_IF(!NS_IsMainThread())) {
+    return SkPDF::NodeID::Nothing;
+  }
   if (!sBuilders || sBuilders->IsEmpty()) {
     return SkPDF::NodeID::Nothing;
   }
Loading diff…