Medium firefox UAF 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionUse-after-free in the Audio/Video: GMP component
ComponentDOM
Bug ClassUAF
Tracker1840666
Fix commit90bbcf290109 (firefox) +7/-6
CISA KEVNot listed
CreditedAndrew McCreight
Disclosed2025-12-09

Changed Functions

FunctionChangeNotes
if
dom/media/eme/MediaKeys.cpp
modified

Files Changed

  • dom/media/eme/MediaKeys.cpp
diff --git a/dom/media/eme/MediaKeys.cpp b/dom/media/eme/MediaKeys.cpp
index 4ae9fb73914..45a44ae2a38 100644
--- a/dom/media/eme/MediaKeys.cpp
+++ b/dom/media/eme/MediaKeys.cpp
@@ -189,9 +189,15 @@ void MediaKeys::Terminated() {
 }
 
 void MediaKeys::Shutdown() {
+  // Hold a self reference to keep us alive after we clear the self reference
+  // for each promise. This ensures we stay alive until we're done shutting
+  // down.
+  RefPtr<MediaKeys> selfReference = this;
+
   EME_LOG("MediaKeys[%p]::Shutdown()", this);
   if (mProxy) {
-    mProxy->Shutdown();
+    RefPtr<CDMProxy> proxy = mProxy;
+    proxy->Shutdown();
     mProxy = nullptr;
   }
 
@@ -201,11 +207,6 @@ void MediaKeys::Shutdown() {
     observerService->RemoveObserver(this, kMediaKeysResponseTopic);
   }
 
-  // Hold a self reference to keep us alive after we clear the self reference
-  // for each promise. This ensures we stay alive until we're done shutting
-  // down.
-  RefPtr<MediaKeys> selfReference = this;
-
   for (const RefPtr<dom::DetailedPromise>& promise : mPromises.Values()) {
     promise->MaybeRejectWithInvalidStateError(
         "Promise still outstanding at MediaKeys shutdown");
Loading diff…