Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionUse-after-free in the Internationalization component
ComponentCore
Bug ClassLogic Error
Tracker2027336
Fix commitf601d09ece29 (firefox) +3/-3
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-15

Files Changed

  • intl/components/src/RelativeTimeFormat.cpp
diff --git a/intl/components/src/RelativeTimeFormat.cpp b/intl/components/src/RelativeTimeFormat.cpp
index da67f7587d5..35034e03aa1 100644
--- a/intl/components/src/RelativeTimeFormat.cpp
+++ b/intl/components/src/RelativeTimeFormat.cpp
@@ -57,13 +57,13 @@ RelativeTimeFormat::TryCreate(const char* aLocale,
       ureldatefmt_open(IcuLocale(aLocale), nf, relDateTimeStyle,
                        UDISPCTX_CAPITALIZATION_FOR_STANDALONE, &status);
 
+  // Ownership was transferred to mFormatter.
+  closeNumberFormatter.forget();
+
   if (U_FAILURE(status)) {
     return Err(ToICUError(status));
   }
 
-  // Ownership was transferred to mFormatter.
-  closeNumberFormatter.forget();
-
   UniquePtr<RelativeTimeFormat> rtf = MakeUnique<RelativeTimeFormat>(
       aOptions.numeric, formatter, formattedRelativeDateTime);
 
Loading diff…