Firefox · DOM
CVE-2026-117895
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/base/Document.cpp
Patch
diff --git a/dom/base/Document.cpp b/dom/base/Document.cpp
index 3a3c149ffae..df7d4263e4e 100644
--- a/dom/base/Document.cpp
+++ b/dom/base/Document.cpp
@@ -16352,7 +16352,13 @@ void Document::RestorePreviousFullscreenState(UniquePtr<FullscreenExit> aExit) {
// that the loop order is reversed so that events are dispatched in
// the tree order as indicated in the spec.
for (Element* e : Reversed(exitElements)) {
- DispatchFullscreenChange(*e->OwnerDoc(), e);
+ Document* exitDoc = e->OwnerDoc();
+ DispatchFullscreenChange(*exitDoc, e);
+ if (!exitDoc->Fullscreen()) {
+ // The document may have other fullscreen subdocuments which are not part
+ // of the current fullscreen document chain, reset them as well.
+ exitDoc->EnumerateSubDocuments(ResetFullscreen);
+ }
}
aExit->MayResolvePromise();
Loading diff…
References
On This Page