Medium firefox UAF 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionUse-after-free in the WebRTC: Audio/Video component
ComponentDOM
Bug ClassUAF
Tracker1995686
Fix commit48f8a74041be (firefox) +3/-1
CISA KEVNot listed
CreditedAndreas Pehrson
Disclosed2025-11-11

Files Changed

  • dom/media/systemservices/CamerasParent.cpp
diff --git a/dom/media/systemservices/CamerasParent.cpp b/dom/media/systemservices/CamerasParent.cpp
index 27c8c62d844..84b3332ec5e 100644
--- a/dom/media/systemservices/CamerasParent.cpp
+++ b/dom/media/systemservices/CamerasParent.cpp
@@ -383,7 +383,9 @@ void CallbackHelper::OnCaptureEnded() {
   nsIEventTarget* target = mParent->GetBackgroundEventTarget();
 
   MOZ_ALWAYS_SUCCEEDS(target->Dispatch(NS_NewRunnableFunction(
-      __func__, [&] { (void)mParent->SendCaptureEnded(mStreamId); })));
+      __func__, [parent = RefPtr(mParent), id = mStreamId] {
+        (void)parent->SendCaptureEnded(id);
+      })));
 }
 
 void CallbackHelper::OnFrame(const webrtc::VideoFrame& aVideoFrame) {
Loading diff…