High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the DOM: Core & HTML component
ComponentDOM
Bug ClassLogic Error
Tracker2079054
Fix commitdb80f141134c (firefox) +8/-2
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-27

Changed Functions

FunctionChangeNotes
if
dom/base/ScreenOrientation.cpp
modified

Files Changed

  • dom/base/ScreenOrientation.cpp
diff --git a/dom/base/ScreenOrientation.cpp b/dom/base/ScreenOrientation.cpp
index 54b50d941db..b3e8b28eb6a 100644
--- a/dom/base/ScreenOrientation.cpp
+++ b/dom/base/ScreenOrientation.cpp
@@ -830,12 +830,12 @@ Document* ScreenOrientation::GetResponsibleDocument() const {
 }
 
 void ScreenOrientation::MaybeChanged() {
-  Document* doc = GetResponsibleDocument();
+  RefPtr<Document> doc = GetResponsibleDocument();
   if (!doc || doc->ShouldResistFingerprinting(RFPTarget::ScreenOrientation)) {
     return;
   }
 
-  BrowsingContext* bc = doc->GetBrowsingContext();
+  RefPtr<BrowsingContext> bc = doc->GetBrowsingContext();
   if (!bc) {
     return;
   }
@@ -861,6 +861,12 @@ void ScreenOrientation::MaybeChanged() {
     // Use of mozorientationchange is deprecated.
     rv = mScreen->DispatchTrustedEvent(u"mozorientationchange"_ns);
     NS_WARNING_ASSERTION(NS_SUCCEEDED(rv), "DispatchTrustedEvent failed");
+
+    doc = GetResponsibleDocument();
+    bc = doc ? doc->GetBrowsingContext() : nullptr;
+    if (!bc) {
+      return;
+    }
   }
 
   if (doc->Hidden() && !mVisibleListener) {
Loading diff…