High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionMitigation bypass in the JavaScript: GC component
ComponentSpiderMonkey
Bug ClassLogic Error
Tracker2053688
Fix commit8f6686c3c8c5 (firefox) +7/-0
CISA KEVNot listed
CreditedAmy Burnett of OpenAI
Disclosed2026-08-18

Changed Functions

FunctionChangeNotes
for
js/src/jsapi.cpp
modified

Files Changed

  • js/src/jsapi.cpp
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index f7fd53a47e2..9daab1a54ba 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -803,9 +803,16 @@ JS_PUBLIC_API void js::RemapRemoteWindowProxies(
     target.set(targetCompartmentProxy);
   }
 
+  gc::GCRuntime* gc = &cx->runtime()->gc;
   RootedField<JSObject*, 2> deadWrapper(roots);
   for (JSObject*& obj : otherProxies) {
     deadWrapper = obj;
+
+    if (!gc->relocateFinalizationObserverTarget(ObjectValue(*deadWrapper),
+                                                ObjectValue(*target))) {
+      oomUnsafe.crash("js::RemapRemoteWindowProxies");
+    }
+
     js::RemapDeadWrapper(cx, deadWrapper, target);
   }
 }
Loading diff…