High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the DOM: Events component
ComponentDOM
Bug ClassLogic Error
Tracker2081969
Fix commit1ee331505380 (firefox) +7/-3
CISA KEVNot listed
CreditedOpenAI Codex Security (kylebot)
Disclosed2026-10-27

Files Changed

  • dom/ipc/CoalescedInputData.h
  • dom/ipc/CoalescedMouseData.cpp
  • dom/ipc/CoalescedTouchData.cpp
diff --git a/dom/ipc/CoalescedInputData.h b/dom/ipc/CoalescedInputData.h
index a19da20d835..e3482269bac 100644
--- a/dom/ipc/CoalescedInputData.h
+++ b/dom/ipc/CoalescedInputData.h
@@ -88,6 +88,8 @@ class CoalescedInputFlusher : public nsARefreshObserver {
  protected:
   virtual ~CoalescedInputFlusher();
 
+  // BrowserChild owns us and unregisters us from the refresh driver in
+  // DestroyWindow() before it can go away.
   BrowserChild* mBrowserChild;
   // A refresh driver which this instance waits for the next refresh of.
   RefPtr<nsRefreshDriver> mRefreshDriver;
diff --git a/dom/ipc/CoalescedMouseData.cpp b/dom/ipc/CoalescedMouseData.cpp
index def5cdd6967..ac5a2b05026 100644
--- a/dom/ipc/CoalescedMouseData.cpp
+++ b/dom/ipc/CoalescedMouseData.cpp
@@ -112,8 +112,9 @@ CoalescedMouseMoveFlusher::CoalescedMouseMoveFlusher(
 
 void CoalescedMouseMoveFlusher::WillRefresh(mozilla::TimeStamp aTime) {
   MOZ_ASSERT(mRefreshDriver);
-  mBrowserChild->FlushAllCoalescedMouseData();
-  mBrowserChild->ProcessPendingCoalescedMouseDataAndDispatchEvents();
+  RefPtr<BrowserChild> browserChild(mBrowserChild);
+  browserChild->FlushAllCoalescedMouseData();
+  browserChild->ProcessPendingCoalescedMouseDataAndDispatchEvents();
 }
 
 CoalescedMouseMoveFlusher::~CoalescedMouseMoveFlusher() { RemoveObserver(); }
diff --git a/dom/ipc/CoalescedTouchData.cpp b/dom/ipc/CoalescedTouchData.cpp
index 70e38b01477..f130ccc1b21 100644
--- a/dom/ipc/CoalescedTouchData.cpp
+++ b/dom/ipc/CoalescedTouchData.cpp
@@ -134,7 +134,8 @@ Touch* CoalescedTouchData::GetTouch(int32_t aIdentifier) {
 
 void CoalescedTouchMoveFlusher::WillRefresh(mozilla::TimeStamp aTime) {
   MOZ_ASSERT(mRefreshDriver);
-  mBrowserChild->ProcessPendingCoalescedTouchData();
+  RefPtr<BrowserChild> browserChild(mBrowserChild);
+  browserChild->ProcessPendingCoalescedTouchData();
 }
 
 CoalescedTouchMoveFlusher::CoalescedTouchMoveFlusher(
Loading diff…