Firefox · Layout
CVE-2026-74944
UAF in Layout
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
iflayout/base/PresShell.cpp |
modified |
Files Changed
layout/base/PresShell.cpp
Patch
diff --git a/layout/base/PresShell.cpp b/layout/base/PresShell.cpp
index 71157fae90e..ec1e4881193 100644
--- a/layout/base/PresShell.cpp
+++ b/layout/base/PresShell.cpp
@@ -3210,6 +3210,11 @@ nsresult PresShell::GoToAnchor(const nsAString& aAnchorName,
return rv.StealNSResult();
}
+ if (MOZ_UNLIKELY(target->GetComposedDoc() != mDocument)) {
+ esm->SetContentState(nullptr, ElementState::URLTARGET);
+ return NS_OK;
+ }
+
if (aScroll) {
// https://wicg.github.io/scroll-to-text-fragment/#invoking-text-directives
// From "Monkeypatching HTML § 7.4.6.3 Scrolling to a fragment:"
Loading diff…
References
On This Page