PatchGap
Firefox · DOM

CVE-2026-109727

Logic Error in DOM
High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the Audio/Video component
ComponentDOM
Bug ClassLogic Error
Tracker2074213
Fix commit2ac695e9e8a5 (firefox) +1/-0
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-13

Changed Functions

FunctionChangeNotes
if
dom/media/mediaelement/HTMLMediaElement.cpp
 modified

Files Changed

  • dom/media/mediaelement/HTMLMediaElement.cpp

Patch

view commit
diff --git a/dom/media/mediaelement/HTMLMediaElement.cpp b/dom/media/mediaelement/HTMLMediaElement.cpp
index e122030eb7d..e6a0145b0ba 100644
--- a/dom/media/mediaelement/HTMLMediaElement.cpp
+++ b/dom/media/mediaelement/HTMLMediaElement.cpp
@@ -6519,6 +6519,7 @@ void HTMLMediaElement::UpdatePlayedRangesBeforeSeek(double aRangeEndTime) {
 }
 
 void HTMLMediaElement::SeekCompleted() {
+  RefPtr<HTMLMediaElement> kungFuDeathGrip(this);
   mPlayingBeforeSeek = false;
   SetPlayedOrSeeked(true);
   if (mTextTrackManager) {
Loading diff…
On This Page