Firefox · Widget
CVE-2026-4711
UAF in Widget
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifwidget/cocoa/nsMacSharingService.mm |
modified |
Files Changed
widget/cocoa/nsMacSharingService.mm
Patch
diff --git a/widget/cocoa/nsMacSharingService.mm b/widget/cocoa/nsMacSharingService.mm
index d07a79826f9..c2e432e2975 100644
--- a/widget/cocoa/nsMacSharingService.mm
+++ b/widget/cocoa/nsMacSharingService.mm
@@ -15,8 +15,10 @@
NS_IMPL_ISUPPORTS(nsMacSharingService, nsIMacSharingService)
-NSString* const remindersServiceName =
+NSString* const oldRemindersServiceName =
@"com.apple.reminders.RemindersShareExtension";
+NSString* const newRemindersServiceName =
+ @"com.apple.reminders.sharingextension";
// These are some undocumented constants also used by Safari
// to let us open the preferences window
@@ -67,12 +69,14 @@ static bool ShouldIgnoreProvider(NSString* aProviderName) {
- (void)sharingService:(NSSharingService*)sharingService
didShareItems:(NSArray*)items {
[self cleanup];
+ [self release];
}
- (void)sharingService:(NSSharingService*)service
didFailToShareItems:(NSArray*)items
error:(NSError*)error {
[self cleanup];
+ [self release];
}
- (void)dealloc {
@@ -177,34 +181,39 @@ nsMacSharingService::ShareUrl(const nsAString& aServiceName,
NS_OBJC_BEGIN_TRY_BLOCK_RETURN;
NSString* serviceName = nsCocoaUtils::ToNSString(aServiceName);
- NSURL* pageUrl = nsCocoaUtils::ToNSURL(aPageUrl);
- NSString* pageTitle = nsCocoaUtils::ToNSString(aPageTitle);
NSSharingService* service =
[NSSharingService sharingServiceNamed:serviceName];
+ if (!service) {
+ return NS_ERROR_FAILURE;
+ }
+
+ NSString* pageTitle = nsCocoaUtils::ToNSString(aPageTitle);
+ [service setSubject:pageTitle];
- // Reminders fetch its data from an activity, not the share data
- if ([[service name] isEqual:remindersServiceName]) {
- NSUserActivity* shareActivity = [[NSUserActivity alloc]
- initWithActivityType:NSUserActivityTypeBrowsingWeb];
+ NSURL* pageUrl = nsCocoaUtils::ToNSURL(aPageUrl);
+ if (!pageUrl) {
+ return NS_ERROR_FAILURE;
+ }
+
+ // Reminders fetch data from an activity, not the share data
+ if ([serviceName isEqual:oldRemindersServiceName] ||
+ [serviceName isEqual:newRemindersServiceName]) {
+ NSUserActivity* shareActivity = [[[NSUserActivity alloc]
+ initWithActivityType:NSUserActivityTypeBrowsingWeb] autorelease];
if ([pageUrl.scheme hasPrefix:@"http"]) {
[shareActivity setWebpageURL:pageUrl];
}
+
[shareActivity setEligibleForHandoff:NO];
[shareActivity setTitle:pageTitle];
[shareActivity becomeCurrent];
- // Pass ownership of shareActivity to shareDelegate, which will release the
- // activity once sharing has completed.
SharingServiceDelegate* shareDelegate =
[[SharingServiceDelegate alloc] initWithActivity:shareActivity];
- [shareActivity release];
-
- [service setDelegate:shareDelegate];
- [shareDelegate release];
+ [service setDelegate:shareDelegate]; // weak reference
}
- [service setSubject:pageTitle];
[service performWithItems:@[ pageUrl ]];
return NS_OK;
Loading diff…
References
On This Page