High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the XSLT component
ComponentDOM
Bug ClassLogic Error
Tracker2072432
Fix commit4a848b8fb3fe (firefox) +3/-5
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-29

Files Changed

  • dom/xslt/xslt/txMozillaXMLOutput.cpp
diff --git a/dom/xslt/xslt/txMozillaXMLOutput.cpp b/dom/xslt/xslt/txMozillaXMLOutput.cpp
index 9ac42ad69ec..0e9886f553c 100644
--- a/dom/xslt/xslt/txMozillaXMLOutput.cpp
+++ b/dom/xslt/xslt/txMozillaXMLOutput.cpp
@@ -501,7 +501,7 @@ nsresult txMozillaXMLOutput::closePrevious(bool aFlushText) {
     }
 
     ErrorResult error;
-    mCurrentNode->AppendChildTo(mOpenedElement, true, error);
+    mCurrentNode->AppendChild(*mOpenedElement, error);
     if (error.Failed()) {
       return error.StealNSResult();
     }
@@ -577,10 +577,8 @@ nsresult txMozillaXMLOutput::createTxWrapper() {
       ++j;
 #endif
     } else {
-      mDocument->RemoveChildNode(childContent, true);
-
       ErrorResult error;
-      wrapper->AppendChildTo(childContent, true, error);
+      wrapper->AppendChild(*childContent, error);
       if (error.Failed()) {
         return error.StealNSResult();
       }
@@ -594,7 +592,7 @@ nsresult txMozillaXMLOutput::createTxWrapper() {
   NS_ASSERTION(rootLocation == mDocument->GetChildCount(),
                "Incorrect root location");
   ErrorResult error;
-  mDocument->AppendChildTo(wrapper, true, error);
+  mDocument->AppendChild(*wrapper, error);
   return error.StealNSResult();
 }
 
Loading diff…