High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the Audio/Video: Playback component
ComponentDOM
Bug ClassLogic Error
Tracker2079171
Fix commit4c90edeaf366 (firefox) +1/-0
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-27

Files Changed

  • dom/media/mediaelement/HTMLMediaElement.cpp
diff --git a/dom/media/mediaelement/HTMLMediaElement.cpp b/dom/media/mediaelement/HTMLMediaElement.cpp
index e6a0145b0ba..4d8fca7a7ed 100644
--- a/dom/media/mediaelement/HTMLMediaElement.cpp
+++ b/dom/media/mediaelement/HTMLMediaElement.cpp
@@ -6452,6 +6452,7 @@ void HTMLMediaElement::Error(uint16_t aErrorCode,
 }
 
 void HTMLMediaElement::PlaybackEnded() {
+  RefPtr<HTMLMediaElement> kungFuDeathGrip(this);
   // We changed state which can affect AddRemoveSelfReference
   AddRemoveSelfReference();
 
Loading diff…