High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the DOM: Core & HTML component
ComponentDOM
Bug ClassLogic Error
Tracker2068362
Fix commit244b5a637f79 (firefox) +14/-1
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-27

Changed Functions

FunctionChangeNotes
if
dom/events/EventListenerManager.cpp
modified

Files Changed

  • dom/events/EventListenerManager.cpp
diff --git a/dom/events/EventListenerManager.cpp b/dom/events/EventListenerManager.cpp
index 00ac8c34c08..50bc794e297 100644
--- a/dom/events/EventListenerManager.cpp
+++ b/dom/events/EventListenerManager.cpp
@@ -1081,7 +1081,20 @@ nsresult EventListenerManager::SetEventHandler(nsAtom* aName,
                                                aPermitUntrustedEvents);
 
   if (!aDeferCompilation) {
-    return CompileEventHandlerInternal(listener, aName, &aBody, aElement);
+    if (nsContentUtils::IsSafeToRunScript()) [[likely]] {
+      return CompileEventHandlerInternal(listener, aName, &aBody, aElement);
+    }
+    // Scripts are blocked (e.g. inside CloneAndAdopt or AfterSetAttr).
+    nsContentUtils::AddScriptRunner(NS_NewRunnableFunction(
+        "EventListenerManager::DeferredCompileEventHandler",
+        [self = RefPtr{this}, typeAtom = RefPtr{aName}, body = nsString(aBody),
+         element = RefPtr{aElement}]() {
+          Listener* listener = self->FindEventHandler(typeAtom);
+          if (listener && listener->mHandlerIsString) {
+            self->CompileEventHandlerInternal(listener, typeAtom, &body,
+                                              element);
+          }
+        }));
   }
 
   return NS_OK;
Loading diff…