The one-line fix changes Document* doc = GetComposedDoc(); to RefPtr<Document> doc = GetComposedDoc(); in HTMLFormElement::SubmitSubmission. Pre-fix, the composed document was captured as a raw Document* and then used to obtain the docshell: RefPtr<nsDocShell> container = doc ? nsDocShell::Cast(doc->GetDocShell()) : nullptr;. Between capturing the raw doc and dereferencing it, form-submission machinery can run script or otherwise re-enter in a way that releases the last strong reference to the document, freeing it. The subsequent doc->GetDocShell() would then dereference freed memory — a use-after-free of the Document. By holding the document in a RefPtr<Document>, the patch guarantees the document outlives its use within the method, closing the window where it could be freed out from under the raw pointer. The change is a textbook Gecko lifetime fix: the invariant “a DOM object used across potentially re-entrant/script-running work must be held by a strong reference” was violated by using a bare Document*. The advisory’s “use-after-free in DOM: Core & HTML” matches the diff exactly.

This runs in the content/renderer process and is reachable from ordinary web content via form-submission APIs, requiring no special privilege. The primitive is a use-after-free of a Document, reached during submission when script can run and drop the document. The diff proves the lifetime bug (raw pointer → RefPtr) but does not demonstrate a working exploit primitive beyond the dangling dereference; escalation to code execution would require controlling the freed allocation (inferred). Mozilla rates it moderate.