High firefox UAF 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the DOM: Core & HTML component
ComponentDOM
Bug ClassUAF
Tracker2014136
Fix commit32913825c6bb (firefox) +18/-19
CISA KEVNot listed
CreditedSajeeb Lohani
Disclosed2026-02-24

Changed Functions

FunctionChangeNotes
if
dom/base/Document.cpp
modified

Files Changed

  • dom/base/Document.cpp
diff --git a/dom/base/Document.cpp b/dom/base/Document.cpp
index ea8f76dc2f7..353cb3a20af 100644
--- a/dom/base/Document.cpp
+++ b/dom/base/Document.cpp
@@ -16225,17 +16225,16 @@ void Document::HidePopover(Element& aPopover, bool aFocusPreviousElement,
     }
   });
 
-  PopoverData* popoverData = popoverHTMLEl->GetPopoverData();
-
   // 7. If element's opened in popover mode is "auto" or "hint", then:
-  if (popoverData &&
+  if (PopoverData* popoverData = popoverHTMLEl->GetPopoverData();
+      popoverData &&
       popoverData->GetOpenedInMode() == PopoverAttributeState::Auto) {
-    // 7.1. Run hide all popovers until given element, focusPreviousElement, and
-    // fireEvents.
+    // 7.1. Run hide all popovers until given element, focusPreviousElement,
+    // and fireEvents.
     HideAllPopoversUntil(*popoverHTMLEl, aFocusPreviousElement, fireEvents);
 
-    // 7.2. If the result of running check popover validity given element, true,
-    // and throwExceptions is false, then run cleanupSteps and return.
+    // 7.2. If the result of running check popover validity given element,
+    // true, and throwExceptions is false, then run cleanupSteps and return.
     if (!popoverHTMLEl->CheckPopoverValidity(PopoverVisibilityState::Showing,
                                              nullptr, aRv)) {
       return;
@@ -16259,9 +16258,6 @@ void Document::HidePopover(Element& aPopover, bool aFocusPreviousElement,
     }
   }
 
-  auto* data = popoverHTMLEl->GetPopoverData();
-  MOZ_ASSERT(data, "Should have popover data");
-
   // 9. If fireEvents is true:
   // Fire beforetoggle event and re-check popover validity.
   if (fireEvents) {
@@ -16292,7 +16288,9 @@ void Document::HidePopover(Element& aPopover, bool aFocusPreviousElement,
     // 9.4. XXX: See below
 
     // 9.5. Set element's implicit anchor element to null.
-    data->SetInvoker(nullptr);
+    PopoverData* popoverData = popoverHTMLEl->GetPopoverData();
+    MOZ_ASSERT(popoverData, "Should have popover data");
+    popoverData->SetInvoker(nullptr);
   }
 
   // 9.4. Request an element to be removed from the top layer given element.
@@ -16300,16 +16298,17 @@ void Document::HidePopover(Element& aPopover, bool aFocusPreviousElement,
   // element.
   RemovePopoverFromTopLayer(aPopover);
 
-  // 11. Set element's popover invoker to null.
-  data->SetInvoker(nullptr);
+  if (PopoverData* popoverData = popoverHTMLEl->GetPopoverData()) {
+    // 11. Set element's popover invoker to null.
+    popoverData->SetInvoker(nullptr);
 
-  // 12. Set element's opened in popover mode to null.
-  popoverHTMLEl->GetPopoverData()->SetOpenedInMode(PopoverAttributeState::None);
+    // 12. Set element's opened in popover mode to null.
+    popoverData->SetOpenedInMode(PopoverAttributeState::None);
 
-  // 13. Set element's popover visibility state to hidden.
-  popoverHTMLEl->PopoverPseudoStateUpdate(false, true);
-  popoverHTMLEl->GetPopoverData()->SetPopoverVisibilityState(
-      PopoverVisibilityState::Hidden);
+    // 13. Set element's popover visibility state to hidden.
+    popoverHTMLEl->PopoverPseudoStateUpdate(false, true);
+    popoverData->SetPopoverVisibilityState(PopoverVisibilityState::Hidden);
+  }
 
   // 14. If fireEvents is true, then queue a popover toggle event task given
   // element, "open", and "closed". Queue popover toggle event task.
Loading diff…