PatchGap
Firefox · DOM

CVE-2026-117887

Logic Error in DOM
High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the DOM: Core & HTML component
ComponentDOM
Bug ClassLogic Error
Tracker2077385
Fix commitf4ffe6b44b73 (firefox) +1/-1
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-27

Changed Functions

FunctionChangeNotes
if
dom/html/HTMLTableCellElement.cpp
 modified

Files Changed

  • dom/html/HTMLTableCellElement.cpp

Patch

view commit
diff --git a/dom/html/HTMLTableCellElement.cpp b/dom/html/HTMLTableCellElement.cpp
index 39f31af0fbd..98afbf9db90 100644
--- a/dom/html/HTMLTableCellElement.cpp
+++ b/dom/html/HTMLTableCellElement.cpp
@@ -62,7 +62,7 @@ HTMLTableElement* HTMLTableCellElement::GetTable() const {
 }
 
 int32_t HTMLTableCellElement::CellIndex() const {
-  HTMLTableRowElement* row = GetRow();
+  RefPtr<HTMLTableRowElement> row = GetRow();
   if (!row) {
     return -1;
   }
Loading diff…
On This Page