Firefox · SpiderMonkey
CVE-2026-74938
Logic Error in SpiderMonkey
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
forjs/src/jsapi.cpp |
modified |
Files Changed
js/src/jsapi.cpp
Patch
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index f7fd53a47e2..9daab1a54ba 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -803,9 +803,16 @@ JS_PUBLIC_API void js::RemapRemoteWindowProxies(
target.set(targetCompartmentProxy);
}
+ gc::GCRuntime* gc = &cx->runtime()->gc;
RootedField<JSObject*, 2> deadWrapper(roots);
for (JSObject*& obj : otherProxies) {
deadWrapper = obj;
+
+ if (!gc->relocateFinalizationObserverTarget(ObjectValue(*deadWrapper),
+ ObjectValue(*target))) {
+ oomUnsafe.crash("js::RemapRemoteWindowProxies");
+ }
+
js::RemapDeadWrapper(cx, deadWrapper, target);
}
}
Loading diff…
References
On This Page