High firefox UAF 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the JavaScript: GC component
ComponentSpiderMonkey
Bug ClassUAF
Tracker2053337
Fix commit014ec97fe248 (firefox) +8/-2
CISA KEVNot listed
CreditedAmy Burnett of OpenAI
Disclosed2026-08-18

Changed Functions

FunctionChangeNotes
for
js/src/gc/Marking.cpp
modified

Files Changed

  • js/src/gc/Marking.cpp
  • js/src/gc/WeakMap.cpp
diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp
index 6093d714b15..80c7c18c209 100644
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -774,6 +774,10 @@ void MarkingTracerT<opts>::markEphemeronEdges(EphemeronEdgeVector& edges,
   DebugOnly<size_t> initialLength = edges.length();
 
   for (auto& edge : edges) {
+    if (!edge.target()) {
+      continue;
+    }
+
     MarkColor targetColor = std::min(srcColor, MarkColor(edge.color()));
     MOZ_ASSERT(markColor() >= targetColor);
     if (targetColor == markColor()) {
diff --git a/js/src/gc/WeakMap.cpp b/js/src/gc/WeakMap.cpp
index 2b5aca79835..892a44faeaa 100644
--- a/js/src/gc/WeakMap.cpp
+++ b/js/src/gc/WeakMap.cpp
@@ -117,8 +117,10 @@ bool WeakMapBase::addEphemeronEdgesForEntry(MarkColor mapColor,
     }
   }
 
-  if (value && !addEphemeronEdge(mapColor, key, value)) {
-    return false;
+  if (value || key->zone()->isAtomsZone()) {
+    if (!addEphemeronEdge(mapColor, key, value)) {
+      return false;
+    }
   }
 
   return true;
Loading diff…