High firefox Memory Corruption 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionMemory safety bugs present in Firefox 148.0.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
ComponentDOM
Bug ClassMemory Corruption
Tracker2017513
Fix commit66bf37cfc55a (firefox) +17/-12
CISA KEVNot listed
CreditedJon Coppeard and the Mozilla Fuzzing Team
Disclosed2026-03-10

Files Changed

  • dom/cache/BoundStorageKeyParent.cpp
  • dom/cache/BoundStorageKeyParent.h
diff --git a/dom/cache/BoundStorageKeyParent.cpp b/dom/cache/BoundStorageKeyParent.cpp
index 8ed76e83d60..4caafc9f514 100644
--- a/dom/cache/BoundStorageKeyParent.cpp
+++ b/dom/cache/BoundStorageKeyParent.cpp
@@ -9,17 +9,30 @@
 #include "mozilla/dom/cache/ActorUtils.h"
 #include "mozilla/dom/cache/PCacheStorageParent.h"
 #include "mozilla/dom/quota/PrincipalUtils.h"
+#include "mozilla/ipc/PBackgroundParent.h"
 
 namespace mozilla::dom::cache {
 
 using mozilla::ipc::PBackgroundParent;
 using mozilla::ipc::PrincipalInfo;
 
+BoundStorageKeyParent::BoundStorageKeyParent(
+    PBackgroundParent* aBackgroundParent)
+    : mBackgroundParent(aBackgroundParent) {
+  MOZ_COUNT_CTOR(BoundStorageKeyParent);
+}
+
+BoundStorageKeyParent::~BoundStorageKeyParent() {
+  MOZ_COUNT_DTOR(BoundStorageKeyParent);
+}
+
 // declared in ActorUtils.h
 already_AddRefed<dom::cache::PCacheStorageParent>
 BoundStorageKeyParent::AllocPCacheStorageParent(
     const Namespace& aNamespace, const PrincipalInfo& aPrincipalInfo) {
-  MOZ_ASSERT(mBackgroundParent);
+  if (!mBackgroundParent || !mBackgroundParent->CanSend()) {
+    return nullptr;
+  }
   return dom::cache::AllocPCacheStorageParent(mBackgroundParent, this,
                                               aNamespace, aPrincipalInfo);
 }
diff --git a/dom/cache/BoundStorageKeyParent.h b/dom/cache/BoundStorageKeyParent.h
index a0ed96fd628..98df75e19b6 100644
--- a/dom/cache/BoundStorageKeyParent.h
+++ b/dom/cache/BoundStorageKeyParent.h
@@ -25,25 +25,17 @@ class BoundStorageKeyParent final : public PBoundStorageKeyParent {
 
  public:
   explicit BoundStorageKeyParent(
-      mozilla::ipc::PBackgroundParent* aBackgroundParent)
-      : mBackgroundParent(aBackgroundParent) {
-    MOZ_COUNT_CTOR(BoundStorageKeyParent);
-  }
+      mozilla::ipc::PBackgroundParent* aBackgroundParent);
 
   NS_INLINE_DECL_REFCOUNTING(BoundStorageKeyParent, override)
 
  private:
-  virtual ~BoundStorageKeyParent() { MOZ_COUNT_DTOR(BoundStorageKeyParent); }
+  ~BoundStorageKeyParent() override;
 
   already_AddRefed<PCacheStorageParent> AllocPCacheStorageParent(
       const Namespace& aNamespace, const PrincipalInfo& aPrincipalInfo);
 
-  // Keeping a reference to PBackgroundParent actor as it is required to passed
-  // in when creating CacheStorageParent in AllocPCacheStorageParent. Raw ptr is
-  // fine here as PBackground is one of the few top-level that gets created very
-  // early on in the content and parent lifecycle and extends the lifetime of
-  // this class.
-  mozilla::ipc::PBackgroundParent* MOZ_NON_OWNING_REF mBackgroundParent;
+  RefPtr<mozilla::ipc::PBackgroundParent> mBackgroundParent;
 };
 
 }  // namespace dom::cache
Loading diff…