High firefox UAF 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the Disability Access APIs component
ComponentLayout
Bug ClassUAF
Tracker2000597
Fix commit655ba8eacaaa (firefox) +12/-12
CISA KEVNot listed
CreditedIrvan Kurniawan
Disclosed2025-12-18

Changed Functions

FunctionChangeNotes
if
layout/base/PresShell.cpp
modified

Files Changed

  • layout/base/PresShell.cpp
diff --git a/layout/base/PresShell.cpp b/layout/base/PresShell.cpp
index 64677bd5246..8596e4eef25 100644
--- a/layout/base/PresShell.cpp
+++ b/layout/base/PresShell.cpp
@@ -1114,18 +1114,6 @@ void PresShell::Destroy() {
     mMVMContext = nullptr;
   }
 
-#ifdef ACCESSIBILITY
-  if (mDocAccessible) {
-#  ifdef DEBUG
-    if (a11y::logging::IsEnabled(a11y::logging::eDocDestroy))
-      a11y::logging::DocDestroy("presshell destroyed", mDocument);
-#  endif
-
-    mDocAccessible->Shutdown();
-    mDocAccessible = nullptr;
-  }
-#endif  // ACCESSIBILITY
-
   MaybeReleaseCapturingContent();
 
   EventHandler::OnPresShellDestroy(mDocument);
@@ -1184,6 +1172,18 @@ void PresShell::Destroy() {
 
   mIsDestroying = true;
 
+#ifdef ACCESSIBILITY
+  if (mDocAccessible) {
+#  ifdef DEBUG
+    if (a11y::logging::IsEnabled(a11y::logging::eDocDestroy))
+      a11y::logging::DocDestroy("presshell destroyed", mDocument);
+#  endif
+
+    mDocAccessible->Shutdown();
+    mDocAccessible = nullptr;
+  }
+#endif  // ACCESSIBILITY
+
   // We can't release all the event content in
   // mCurrentEventContentStack here since there might be code on the
   // stack that will release the event content too. Double release
Loading diff…