High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the Networking: WebSockets component
ComponentNetworking
Bug ClassLogic Error
Tracker2079692
Fix commitb5e0496b1405 (firefox) +5/-1
CISA KEVNot listed
CreditedOpenAI Codex Security (kylebot)
Disclosed2026-10-27

Changed Functions

FunctionChangeNotes
OnUpgradeFailed
netwerk/protocol/websocket/WebSocketChannel.cpp
modified

Files Changed

  • netwerk/protocol/websocket/WebSocketChannel.cpp
diff --git a/netwerk/protocol/websocket/WebSocketChannel.cpp b/netwerk/protocol/websocket/WebSocketChannel.cpp
index ee23cf94b15..5555c0e1eca 100644
--- a/netwerk/protocol/websocket/WebSocketChannel.cpp
+++ b/netwerk/protocol/websocket/WebSocketChannel.cpp
@@ -3916,7 +3916,11 @@ nsresult WebSocketChannel::OnTransportAvailableInternal() {
 
 NS_IMETHODIMP
 WebSocketChannel::OnUpgradeFailed(nsresult aErrorCode) {
-  // When socket process is enabled, this could be called on background thread.
+  if (!NS_IsMainThread()) {
+    return NS_DispatchToMainThread(NewRunnableMethod<nsresult>(
+        "net::WebSocketChannel::OnUpgradeFailed", this,
+        &WebSocketChannel::OnUpgradeFailed, aErrorCode));
+  }
 
   LOG(("WebSocketChannel::OnUpgradeFailed() %p [aErrorCode %" PRIx32 "]", this,
        static_cast<uint32_t>(aErrorCode)));
Loading diff…