Firefox · DOM
CVE-2026-117869
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/events/EventListenerManager.cpp |
modified |
Files Changed
dom/events/EventListenerManager.cpp
Patch
diff --git a/dom/events/EventListenerManager.cpp b/dom/events/EventListenerManager.cpp
index 00ac8c34c08..50bc794e297 100644
--- a/dom/events/EventListenerManager.cpp
+++ b/dom/events/EventListenerManager.cpp
@@ -1081,7 +1081,20 @@ nsresult EventListenerManager::SetEventHandler(nsAtom* aName,
aPermitUntrustedEvents);
if (!aDeferCompilation) {
- return CompileEventHandlerInternal(listener, aName, &aBody, aElement);
+ if (nsContentUtils::IsSafeToRunScript()) [[likely]] {
+ return CompileEventHandlerInternal(listener, aName, &aBody, aElement);
+ }
+ // Scripts are blocked (e.g. inside CloneAndAdopt or AfterSetAttr).
+ nsContentUtils::AddScriptRunner(NS_NewRunnableFunction(
+ "EventListenerManager::DeferredCompileEventHandler",
+ [self = RefPtr{this}, typeAtom = RefPtr{aName}, body = nsString(aBody),
+ element = RefPtr{aElement}]() {
+ Listener* listener = self->FindEventHandler(typeAtom);
+ if (listener && listener->mHandlerIsString) {
+ self->CompileEventHandlerInternal(listener, typeAtom, &body,
+ element);
+ }
+ }));
}
return NS_OK;
Loading diff…
References
On This Page