High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the Disability Access APIs component
ComponentCore
Bug ClassLogic Error
Tracker2061327
Fix commit053f0d31f95b (firefox) +4/-0
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-15

Files Changed

  • accessible/base/NotificationController.cpp
  • accessible/generic/DocAccessible.cpp
diff --git a/accessible/base/NotificationController.cpp b/accessible/base/NotificationController.cpp
index a583be8fdb9..497244733af 100644
--- a/accessible/base/NotificationController.cpp
+++ b/accessible/base/NotificationController.cpp
@@ -341,6 +341,7 @@ void NotificationController::DropMutationEvent(AccTreeMutationEvent* aEvent) {
     MOZ_ASSERT(hideEvent);
 
     if (hideEvent->NeedsShutdown()) {
+      mDocument->UncacheChildrenInSubtree(aEvent->GetAccessible());
       mDocument->ShutdownChildrenInSubtree(aEvent->GetAccessible());
     }
   } else {
diff --git a/accessible/generic/DocAccessible.cpp b/accessible/generic/DocAccessible.cpp
index e6fae058244..abf274597c9 100644
--- a/accessible/generic/DocAccessible.cpp
+++ b/accessible/generic/DocAccessible.cpp
@@ -1358,6 +1358,9 @@ void DocAccessible::UnbindFromDocument(LocalAccessible* aAccessible) {
   NS_ASSERTION(mAccessibleCache.GetWeak(aAccessible->UniqueID()),
                "Unbinding the unbound accessible!");
 
+  MOZ_ASSERT(!mARIAOwnsHash.Contains(aAccessible),
+             "Container still lingering in mARIAOwnsHash");
+
   // Fire focus event on accessible having DOM focus if last focus was removed
   // from the tree.
   if (FocusMgr()->WasLastFocused(aAccessible)) {
Loading diff…