Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionUse-after-free in the DOM: Animation component
ComponentDOM
Bug ClassLogic Error
Tracker2028727
Fix commita06b9ac67b35 (firefox) +4/-1
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-13

Files Changed

  • dom/base/nsDOMMutationObserver.h
diff --git a/dom/base/nsDOMMutationObserver.h b/dom/base/nsDOMMutationObserver.h
index 7fecb484aa9..eb6a917e8cf 100644
--- a/dom/base/nsDOMMutationObserver.h
+++ b/dom/base/nsDOMMutationObserver.h
@@ -722,7 +722,10 @@ class nsAutoAnimationMutationBatch {
   // List of nodes referred to by mEntryTable so we can sort them
   // For a specific pseudo element, we use its parent element as the
   // batch target, so they will be put in the same EntryArray.
-  nsTArray<nsINode*> mBatchTargets;
+  // Note: the batch object is used in lots of Animation APIs, and the script
+  // may be in the scope of the batch via ready/finished promises, so we use the
+  // strong refs here.
+  nsTArray<nsCOMPtr<nsINode>> mBatchTargets;
 };
 
 inline nsDOMMutationObserver* nsMutationReceiverBase::Observer() {
Loading diff…