High firefox UAF 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the JavaScript Engine component
ComponentSpiderMonkey
Bug ClassUAF
Tracker2013562
Fix commit670eb2adbc70 (firefox) +1/-0
CISA KEVNot listed
CreditedEvyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
Disclosed2026-02-24

Files Changed

  • js/src/builtin/AtomicsObject.cpp
diff --git a/js/src/builtin/AtomicsObject.cpp b/js/src/builtin/AtomicsObject.cpp
index 2af47ca92bf..8c71ffe49cf 100644
--- a/js/src/builtin/AtomicsObject.cpp
+++ b/js/src/builtin/AtomicsObject.cpp
@@ -1521,6 +1521,7 @@ bool js::atomics_notify_impl(JSContext* cx, SharedArrayRawBuffer* sarb,
   // avoid mutex ordering problems.
   RootedValue resultMsg(cx, StringValue(cx->names().ok));
   for (uint32_t i = 0; i < promisesToResolve.length(); i++) {
+    AutoRealm ar(cx, promisesToResolve[i]);
     if (!PromiseObject::resolve(cx, promisesToResolve[i], resultMsg)) {
       MOZ_ASSERT(cx->isThrowingOutOfMemory() || cx->isThrowingOverRecursed());
       return false;
Loading diff…