In nsHttpChannel::ContinueOnStopRequest, the terminal notification was dispatched by dereferencing the raw member pointer directly as mListener->OnStopRequest(this, aStatus). Because OnStopRequest runs arbitrary listener code, that callback (or reentrancy it triggers, such as tearing down or reassigning the channel’s listener chain) can drop the last strong reference to the object that mListener points at, freeing it while the virtual call is still in progress. The invariant violated is that a callee must remain alive for the full duration of a call made through a pointer to it; here no local strong reference guarded the listener across the OnStopRequest invocation.

The fix copies mListener into a local nsCOMPtr<nsIStreamListener> listener before invoking the method, so the listener holds an owning reference on the stack that outlives the call regardless of what the callback does to mListener. This closes the use-after-free window without changing the notification semantics.

An attacker who can shape a channel’s listener behavior gains a use-after-free triggered at HTTP request completion, corrupting freed heap memory that could be leveraged toward controlled reuse. This occurs in the process running the networking/HTTP stack during normal request teardown. The precondition is the ability to induce the listener to be released from inside its own OnStopRequest callback.