High firefox UAF 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the DOM: Bindings (WebIDL) component
ComponentDOM
Bug ClassUAF
Tracker2038439
Fix commit12e1a557224f (firefox) +5/-3
CISA KEVNot listed
CreditedSatoki Tsuji
Disclosed2026-05-19

Changed Functions

FunctionChangeNotes
for
dom/base/DocumentOrShadowRoot.cpp
modified

Files Changed

  • dom/base/Document.cpp
  • dom/base/DocumentOrShadowRoot.cpp
  • dom/base/ShadowRoot.cpp
diff --git a/dom/base/Document.cpp b/dom/base/Document.cpp
index 8c2980c6f7f..e9e0f16a8bc 100644
--- a/dom/base/Document.cpp
+++ b/dom/base/Document.cpp
@@ -2415,6 +2415,8 @@ Document::~Document() {
     mDocGroup->GetBrowsingContextGroup()->RemoveDocument(this, mDocGroup);
   }
 
+  DocumentOrShadowRoot::Unlink(this);
+
   UnlinkOriginalDocumentIfStatic();
 
   UnregisterFromMemoryReportingForDataDocument();
diff --git a/dom/base/DocumentOrShadowRoot.cpp b/dom/base/DocumentOrShadowRoot.cpp
index 865007ce49f..a4c5cd10314 100644
--- a/dom/base/DocumentOrShadowRoot.cpp
+++ b/dom/base/DocumentOrShadowRoot.cpp
@@ -62,9 +62,7 @@ void DocumentOrShadowRoot::AddSizeOfExcludingThis(nsWindowSizes& aSizes) const {
 }
 
 DocumentOrShadowRoot::~DocumentOrShadowRoot() {
-  for (StyleSheet* sheet : mStyleSheets) {
-    sheet->ClearAssociatedDocumentOrShadowRoot();
-  }
+  MOZ_ASSERT(mStyleSheets.IsEmpty());
 }
 
 StyleSheetList* DocumentOrShadowRoot::StyleSheets() {
diff --git a/dom/base/ShadowRoot.cpp b/dom/base/ShadowRoot.cpp
index f44f8c56217..076277292c2 100644
--- a/dom/base/ShadowRoot.cpp
+++ b/dom/base/ShadowRoot.cpp
@@ -119,6 +119,8 @@ ShadowRoot::~ShadowRoot() {
       GetCustomElementRegistryState() == CustomElementRegistryState::Scoped) {
     CustomElementRegistry::RemoveScopedRegistry(*this);
   }
+
+  DocumentOrShadowRoot::Unlink(this);
 }
 
 MOZ_DEFINE_MALLOC_SIZE_OF(ShadowRootAuthorStylesMallocSizeOf)
Loading diff…