PatchGap
Firefox · DOM

CVE-2026-117914

Logic Error in DOM
High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the SVG component
ComponentDOM
Bug ClassLogic Error
Tracker2079253
Fix commite66e99bbf29a (firefox) +2/-0
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-27

Files Changed

  • dom/smil/SMILAnimationController.cpp

Patch

view commit
diff --git a/dom/smil/SMILAnimationController.cpp b/dom/smil/SMILAnimationController.cpp
index 599a9e06d65..e488a2542b3 100644
--- a/dom/smil/SMILAnimationController.cpp
+++ b/dom/smil/SMILAnimationController.cpp
@@ -232,6 +232,8 @@ void SMILAnimationController::DoSample(bool aSkipUnchangedContainers) {
   AutoRestore<bool> autoRestoreRunningSample(mRunningSample);
   mRunningSample = true;
 
+  nsCOMPtr<dom::Document> kungFuDeathGrip(mDocument);
+
   // STEP 1: Bring model up to date
   // (i)  Rewind elements where necessary
   // (ii) Run milestone samples
Loading diff…
On This Page