High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the DOM: Core & HTML component
ComponentDOM
Bug ClassLogic Error
Tracker2076267
Fix commit26da06ebb689 (firefox) +3/-1
CISA KEVNot listed
CreditedAmy Burnett of OpenAI
Disclosed2026-10-27

Files Changed

  • dom/base/NodeIterator.cpp
  • dom/base/NodeIterator.h
diff --git a/dom/base/NodeIterator.cpp b/dom/base/NodeIterator.cpp
index 2034517fbe7..7c5b5cccf5a 100644
--- a/dom/base/NodeIterator.cpp
+++ b/dom/base/NodeIterator.cpp
@@ -148,6 +148,8 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(NodeIterator)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(NodeIterator)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mRoot)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mPointer.mNode)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mWorkingPointer.mNode)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mFilter)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
diff --git a/dom/base/NodeIterator.h b/dom/base/NodeIterator.h
index 0e44f6d84ca..129d9aab1fd 100644
--- a/dom/base/NodeIterator.h
+++ b/dom/base/NodeIterator.h
@@ -64,7 +64,7 @@ class NodeIterator final : public nsStubMutationObserver, public nsTraversal {
 
     void Clear() { mNode = nullptr; }
 
-    nsINode* mNode;
+    nsCOMPtr<nsINode> mNode;
     bool mBeforeNode;
   };
 
Loading diff…