Firefox · Core
CVE-2026-16351
UAF in Core
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
docshell/base/BrowsingContext.cppdocshell/base/BrowsingContext.h
Patch
diff --git a/docshell/base/BrowsingContext.cpp b/docshell/base/BrowsingContext.cpp
index 4a8af95b0c1..0fcb739a037 100644
--- a/docshell/base/BrowsingContext.cpp
+++ b/docshell/base/BrowsingContext.cpp
@@ -4234,7 +4234,7 @@ bool BrowsingContext::CanSet(
return XRE_IsParentProcess() && !aSource && IsTop();
}
-bool BrowsingContext::CanSet(FieldIndex<IDX_BrowserId>, const uint32_t& aValue,
+bool BrowsingContext::CanSet(FieldIndex<IDX_BrowserId>, const uint64_t& aValue,
ContentParent* aSource) {
// We should only be able to set this for toplevel contexts which don't have
// an ID yet.
diff --git a/docshell/base/BrowsingContext.h b/docshell/base/BrowsingContext.h
index e30efc99abb..7c50af51999 100644
--- a/docshell/base/BrowsingContext.h
+++ b/docshell/base/BrowsingContext.h
@@ -1485,7 +1485,7 @@ class BrowsingContext : public nsILoadContext, public nsWrapperCache {
void DidSet(FieldIndex<IDX_HasSessionHistory>, bool aOldValue);
- bool CanSet(FieldIndex<IDX_BrowserId>, const uint32_t& aValue,
+ bool CanSet(FieldIndex<IDX_BrowserId>, const uint64_t& aValue,
ContentParent* aSource);
bool CanSet(FieldIndex<IDX_UseErrorPages>, const bool& aUseErrorPages,
Loading diff…
References
On This Page