High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the Layout: Images, Video, and HTML Frames component
ComponentLayout
Bug ClassLogic Error
Tracker2082040
Fix commitb48bed5acc18 (firefox) +19/-17
CISA KEVNot listed
CreditedOpenAI Codex Security (kylebot)
Disclosed2026-10-27

Changed Functions

FunctionChangeNotes
if
layout/generic/nsSubDocumentFrame.cpp
modified

Files Changed

  • layout/generic/nsSubDocumentFrame.cpp
diff --git a/layout/generic/nsSubDocumentFrame.cpp b/layout/generic/nsSubDocumentFrame.cpp
index 7c55235845e..59e06e56ff9 100644
--- a/layout/generic/nsSubDocumentFrame.cpp
+++ b/layout/generic/nsSubDocumentFrame.cpp
@@ -162,6 +162,7 @@ void nsSubDocumentFrame::Init(nsIContent* aContent, nsContainerFrame* aParent,
 }
 
 void nsSubDocumentFrame::UpdateEmbeddedBrowsingContextDependentData() {
+  MOZ_ASSERT(!nsContentUtils::IsSafeToRunScript());
   if (!mFrameLoader) {
     return;
   }
@@ -201,24 +202,25 @@ void nsSubDocumentFrame::ShowViewer() {
   if (!frameloader->IsRemoteFrame() && !PresContext()->IsDynamic()) {
     // We let the printing code take care of loading the document and
     // initializing the shell.
-  } else {
-    AutoWeakFrame weakThis(this);
-    mCallingShow = true;
-    bool didCreateDoc = frameloader->Show(this);
-    if (!weakThis.IsAlive()) {
-      return;
-    }
-    mCallingShow = false;
-    mDidCreateDoc = didCreateDoc;
-    if (!HasAnyStateBits(NS_FRAME_FIRST_REFLOW)) {
-      frameloader->UpdatePositionAndSize(this);
-    }
-    if (!weakThis.IsAlive()) {
-      return;
-    }
-    UpdateEmbeddedBrowsingContextDependentData();
-    InvalidateFrame();
+    return;
   }
+  AutoWeakFrame weakThis(this);
+  mCallingShow = true;
+  bool didCreateDoc = frameloader->Show(this);
+  if (!weakThis.IsAlive()) {
+    return;
+  }
+  mCallingShow = false;
+  mDidCreateDoc = didCreateDoc;
+  if (!HasAnyStateBits(NS_FRAME_FIRST_REFLOW)) {
+    frameloader->UpdatePositionAndSize(this);
+  }
+  if (!weakThis.IsAlive()) {
+    return;
+  }
+  nsAutoScriptBlocker sb;
+  UpdateEmbeddedBrowsingContextDependentData();
+  InvalidateFrame();
 }
 
 Document* nsSubDocumentFrame::GetExtantSubdocument() {
Loading diff…