High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the DOM: Streams component
ComponentDOM
Bug ClassLogic Error
Tracker2075998
Fix commit281b985a9096 (firefox) +4/-1
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-13

Files Changed

  • dom/streams/QueueWithSizes.h
diff --git a/dom/streams/QueueWithSizes.h b/dom/streams/QueueWithSizes.h
index 1a4a1adfc94..2269f71170c 100644
--- a/dom/streams/QueueWithSizes.h
+++ b/dom/streams/QueueWithSizes.h
@@ -23,6 +23,8 @@ struct ValueWithSize : LinkedListElement<ValueWithSize> {
 
   JS::Heap<JS::Value> mValue;
   double mSize = 0.0f;
+
+  void trace(JSTracer* aTrc) { TraceEdge(aTrc, &mValue, "value-with-size"); }
 };
 
 // This type is a little tricky lifetime wise: Despite the fact that we're
@@ -90,7 +92,8 @@ inline void DequeueValue(JSContext* aCx, QueueContainingClass aContainer,
 
   // Step 3+4
   // UniquePtr to ensure memory is freed.
-  UniquePtr<ValueWithSize> valueWithSize(aContainer->Queue().popFirst());
+  JS::Rooted<UniquePtr<ValueWithSize>> valueWithSize(
+      aCx, aContainer->Queue().popFirst());
 
   // Step 5.
   aContainer->SetQueueTotalSize(aContainer->QueueTotalSize() -
Loading diff…